diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 5dda458c6313..e9a3dd723910 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -190,6 +190,7 @@
 # Web Standards
 /lib/internal/bootstrap/web/* @nodejs/web-standards
 /lib/internal/navigator.js @nodejs/web-standards
+/lib/internal/webidl.js @nodejs/web-standards
 /test/fixtures/wpt/ @nodejs/web-standards
 /test/wpt/ @nodejs/web-standards
 
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c63475dc60f5..771d9034b64c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,11 @@ updates:
     commit-message:
       prefix: meta
     open-pull-requests-limit: 10
+    groups:
+      codeql-action:
+        applies-to: version-updates
+        patterns:
+          - github/codeql-action
 
   - package-ecosystem: npm
     directory: /tools/eslint
diff --git a/.github/workflows/author-ready-conflicts.yml b/.github/workflows/author-ready-conflicts.yml
new file mode 100644
index 000000000000..f447c6b80a2e
--- /dev/null
+++ b/.github/workflows/author-ready-conflicts.yml
@@ -0,0 +1,48 @@
+name: Unlabel not-ready pull requests
+
+on:
+  schedule:
+    - cron: 15 3 * * *
+
+permissions:
+  contents: read
+
+jobs:
+  remove-label:
+    name: Remove author ready
+    if: github.repository == 'nodejs/node'
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Remove the label and comment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MESSAGE: >-
+            This pull request has conflicts with its base branch, removing the
+            `author ready` label.
+
+            Please
+            [rebase](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-5-rebase)
+            your branch onto the latest base branch, resolve the conflicts
+            locally, and force-push.
+
+            Afterwards the pull request needs a fresh collaborator approval,
+            and a collaborator will add the label back once it is
+            [author ready](https://github.com/nodejs/node/blob/HEAD/doc/contributing/collaborator-guide.md#author-ready-pull-requests)
+            again.
+        run: |
+          # Requesting the mergeable field makes GitHub compute the merge state,
+          # pull requests still reported as UNKNOWN are picked up by a later run.
+          gh pr list \
+            --repo "$GITHUB_REPOSITORY" \
+            --label 'author ready' \
+            --state open \
+            --limit 100 \
+            --json number,mergeable \
+            --jq '.[] | select(.mergeable == "CONFLICTING") | .number' |
+            while read -r number; do
+              gh pr edit "$number" --repo "$GITHUB_REPOSITORY" --remove-label 'author ready'
+              printf '%s\n' "$MESSAGE" |
+                gh pr comment "$number" --repo "$GITHUB_REPOSITORY" --body-file -
+            done
diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
index 0a69ff636f25..8c01b0592c2e 100644
--- a/.github/workflows/auto-start-ci.yml
+++ b/.github/workflows/auto-start-ci.yml
@@ -9,7 +9,7 @@ on:
     # optimistic, it can take longer to run.
     # To understand why `schedule` is used instead of other events, refer to
     # ./doc/contributing/commit-queue.md
-    - cron: '*/5 * * * *'
+    - cron: 3/5 * * * *
 
 concurrency: ${{ github.workflow }}
 
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml
index 4bb9702797de..8b306b59fe7e 100644
--- a/.github/workflows/build-tarball.yml
+++ b/.github/workflows/build-tarball.yml
@@ -41,7 +41,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -68,7 +68,7 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions/install-clang
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 23084c68ac5e..1b3179ef4af1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -24,19 +24,21 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           category: /language:${{matrix.language}}
diff --git a/.github/workflows/commit-lint-problem-matcher.json b/.github/workflows/commit-lint-problem-matcher.json
deleted file mode 100644
index 72dd13b9e092..000000000000
--- a/.github/workflows/commit-lint-problem-matcher.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "problemMatcher": [
-    {
-      "owner": "core-validate-commit",
-      "pattern": [
-        {
-          "regexp": "^not ok \\d+ (.*)$",
-          "message": 1
-        }
-      ]
-    }
-  ]
-}
diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
index 896340ba3a82..6b173d8bc978 100644
--- a/.github/workflows/commit-lint.yml
+++ b/.github/workflows/commit-lint.yml
@@ -1,7 +1,7 @@
 name: First commit message adheres to guidelines
 
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - main
 
@@ -9,27 +9,48 @@ env:
   NODE_VERSION: lts/*
 
 permissions:
-  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   lint-commit-message:
+    name: lint-commit-message
     runs-on: ubuntu-slim
     steps:
-      - name: Compute number of commits in the PR
-        id: nb-of-commits
-        run: |
-          echo "plusOne=$((${{ github.event.pull_request.commits }} + 1))" >> $GITHUB_OUTPUT
-          echo "minusOne=$((${{ github.event.pull_request.commits }} - 1))" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          fetch-depth: ${{ steps.nb-of-commits.outputs.plusOne }}
-          persist-credentials: false
-      - run: git reset HEAD^2
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
-      - name: Validate commit message
-        run: |
-          echo "::add-matcher::.github/workflows/commit-lint-problem-matcher.json"
-          git rev-parse HEAD~${{ steps.nb-of-commits.outputs.minusOne }} | xargs npx -q core-validate-commit --no-validate-metadata --tap
+      - name: Validate first commit message
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        with:
+          script: |
+            const { data: [commit] } = await github.rest.pulls.listCommits({
+              ...context.repo,
+              pull_number: context.issue.number,
+              per_page: 1,
+            });
+            if (!commit) {
+              throw new Error('No commits found in pull request');
+            }
+            const { exitCode, stdout, stderr } = await exec.getExecOutput('npx', [
+              '-q', '--yes', '--ignore-scripts', 'core-validate-commit@6.0.0',
+              '--no-validate-metadata', '--tap', '-',
+            ], {
+              cwd: process.env.RUNNER_TEMP,
+              input: Buffer.from(JSON.stringify([{
+                id: commit.sha,
+                message: commit.commit.message,
+                author: commit.commit.author,
+              }])),
+              silent: true,
+              ignoreReturnCode: true,
+            });
+            if (exitCode !== 0) {
+              core.setFailed(stdout + stderr || 'Commit message validation failed');
+            } else {
+              core.info('First commit message passes validation');
+            }
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index a1d691e9e19f..8f29a390c678 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -11,7 +11,7 @@ on:
   # be read-only, and the Action won't have access to any other repository
   # secrets, which it needs to access Jenkins API.
   schedule:
-    - cron: '*/5 * * * *'
+    - cron: 3/5 * * * *
 
 concurrency: ${{ github.workflow }}
 
@@ -28,6 +28,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     outputs:
+      aged_prs: ${{ steps.get_candidate_prs.outputs.aged_prs }}
       candidates: ${{ steps.get_candidate_prs.outputs.candidates }}
     steps:
       - name: Get Pull Request Candidates
@@ -50,6 +51,7 @@ jobs:
                   --search "-label:blocked")
           candidates=$(printf '%s %s\n' "$fast_track_prs" "$aged_prs" |
                   jq -r -s 'reduce .[] as $pr ([]; if index($pr) then . else . + [$pr] end) | join(" ")')
+          echo "aged_prs=$aged_prs" >> "$GITHUB_OUTPUT"
           echo "candidates=$candidates" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: ${{ github.token }}
@@ -64,7 +66,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -93,6 +95,7 @@ jobs:
           curl -fsSLo "$readme" "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/README.md"
 
           numbers=
+          lacks_second_approval_prs=
           # shellcheck disable=SC2086
           for pr in $CANDIDATES; do
             metadata="${RUNNER_TEMP}/metadata-${pr}.json"
@@ -139,6 +142,14 @@ jobs:
             if [ "$metadata_status" -ge 20 ] && [ "$metadata_status" -le 29 ]; then
               echo "pr ${pr} skipped, not ready to land"
               echo "reason codes: ${metadata_reason_codes}"
+              if jq -e '
+                    (.reasonCodes | index("wait-time")) and
+                    (.pullRequest.labels | index("lacks-second-approval") | not)
+                  ' "$metadata" > /dev/null; then
+                case " $AGED_PRS " in
+                  *" $pr "*) lacks_second_approval_prs="$lacks_second_approval_prs $pr" ;;
+                esac
+              fi
               continue
             fi
 
@@ -148,12 +159,28 @@ jobs:
           done
 
           numbers=$(echo "$numbers" | xargs)
+          lacks_second_approval_prs=$(echo "$lacks_second_approval_prs" | xargs)
           echo "numbers=$numbers" >> "$GITHUB_OUTPUT"
+          echo "lacks_second_approval_prs=$lacks_second_approval_prs" >> "$GITHUB_OUTPUT"
         env:
+          AGED_PRS: ${{ needs.get_candidate_prs.outputs.aged_prs }}
           CANDIDATES: ${{ needs.get_candidate_prs.outputs.candidates }}
           GH_TOKEN: ${{ github.token }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - name: Label Pull Requests Lacking a Second Approval
+        if: steps.get_mergeable_prs.outputs.lacks_second_approval_prs != ''
+        run: |
+          # shellcheck disable=SC2086
+          for pr in $PULL_REQUESTS; do
+            if ! gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label 'lacks-second-approval'; then
+              echo "::warning::Failed to add lacks-second-approval to PR ${pr}"
+            fi
+          done
+        env:
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.lacks_second_approval_prs }}
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: steps.get_mergeable_prs.outputs.numbers != ''
         with:
           # A personal token is required because pushing with GITHUB_TOKEN will
@@ -161,6 +188,7 @@ jobs:
           # to be set here because `checkout` configures GitHub authentication
           # for push as well.
           token: ${{ secrets.GH_USER_TOKEN }}
+          persist-credentials: true
 
       - name: Start the Commit Queue
         if: steps.get_mergeable_prs.outputs.numbers != ''
diff --git a/.github/workflows/contributor-guidance.yml b/.github/workflows/contributor-guidance.yml
new file mode 100644
index 000000000000..4035ea932077
--- /dev/null
+++ b/.github/workflows/contributor-guidance.yml
@@ -0,0 +1,141 @@
+# This action requires the following secrets to be set on the repository:
+#   GH_USER_TOKEN: GitHub user token, used because FIRST_TIMER and
+#                  FIRST_TIME_CONTRIBUTOR associations are only returned for
+#                  privileged API calls
+
+name: Contributor guidance
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions: {}
+
+jobs:
+  contributor:
+    name: Resolve contributor status
+    # Avoid allocating a runner unless a welcome or scan is a plausible outcome.
+    if: >-
+      github.run_attempt == 1 &&
+      github.repository == 'nodejs/node' &&
+      github.event.pull_request.user.type != 'Bot' &&
+      (github.event.pull_request.author_association == 'CONTRIBUTOR' ||
+      github.event.pull_request.author_association == 'FIRST_TIMER' ||
+      github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' ||
+      github.event.pull_request.author_association == 'NONE')
+    runs-on: ubuntu-slim
+    outputs:
+      is_first_time: ${{ steps.resolve.outputs.is_first_time }}
+      # The event association may not expose private organization membership,
+      # so gate the guidance job on the privileged API result.
+      should_scan: ${{ steps.resolve.outputs.should_scan }}
+    steps:
+      - name: Check author association
+        id: resolve
+        env:
+          EVENT_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          api_association=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$NUMBER" \
+            --jq '.author_association')
+          echo "API author association: $api_association"
+          echo "Event author association: $EVENT_ASSOCIATION"
+
+          case "$api_association" in
+            FIRST_TIMER|FIRST_TIME_CONTRIBUTOR)
+              echo 'is_first_time=true' >> "$GITHUB_OUTPUT"
+              echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+              ;;
+            CONTRIBUTOR|NONE)
+              echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+              echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+              ;;
+            COLLABORATOR|MANNEQUIN|MEMBER|OWNER)
+              echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+              echo 'should_scan=false' >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "Unexpected author association: $api_association" >&2
+              exit 1
+              ;;
+          esac
+
+  guidance:
+    name: Apply contributor guidance
+    needs: contributor
+    if: needs.contributor.outputs.should_scan == 'true'
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Scan contributor activity
+        id: agentscan
+        # The welcome should still be posted if this advisory scan fails.
+        continue-on-error: true
+        uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410  # v2.5.0
+        with:
+          github-token: ${{ github.token }}
+          mode: labels
+          scan-pull-requests: true
+          scan-issues: false
+          auto-close: false
+          honeypot: false
+          # The privileged association check skips trusted authors before this job,
+          # so `trusted-author-associations` would be redundant here.
+          # trusted-author-associations: collaborator,member,owner
+
+      - name: Comment with contributor guidance
+        if: env.IS_FIRST_TIME == 'true' || env.ADD_CAUTION == 'true'
+        env:
+          ADD_CAUTION: >-
+            ${{
+              steps.agentscan.outputs.classification == 'mixed' ||
+              steps.agentscan.outputs.classification == 'automation' ||
+              steps.agentscan.outputs['community-flagged'] == 'true'
+            }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          IS_FIRST_TIME: ${{ needs.contributor.outputs.is_first_time }}
+          NUMBER: ${{ github.event.pull_request.number }}
+          WELCOME_MESSAGE: >2-
+              Welcome to Node.js, and thank you for your first contribution!
+
+            Before review, please take a moment to read:
+
+              * the [guide for first-time contributors](https://github.com/nodejs/node/blob/HEAD/doc/contributing/first-contributions.md)
+              * the [contribution and automation policies](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md)
+              * the [pull request guide](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md)
+              * the [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md)
+              * the [Code of Conduct](https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md)
+
+            Please make sure every commit is
+            [signed off](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-4-commit).
+            For a first pull request, GitHub Actions require collaborator
+            approval and Jenkins CI must be started by a collaborator or triager,
+            so an initial wait is normal.
+          CAUTION_MESSAGE: >-
+            > [!CAUTION]
+
+            > AgentScan found account activity patterns that may be consistent with
+            automation. This is a heuristic, not proof that this pull request was
+            opened by an agent or violates policy. AI-assisted contributions are
+            permitted, but automated tooling must not open pull requests without
+            advance approval, and contributors must personally understand, test,
+            verify, and take responsibility for every submitted change. See the
+            [AgentScan analysis](https://agentscan.tools/user/${{ github.event.pull_request.user.login }}),
+            [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md),
+            and
+            [automation policy](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md#automation-and-bots)
+            for additional context.
+        run: |
+          if [[ "$IS_FIRST_TIME" == "true" && "$ADD_CAUTION" == "true" ]]; then
+            body="$WELCOME_MESSAGE"$'\n\n'"$CAUTION_MESSAGE"
+          elif [[ "$IS_FIRST_TIME" == "true" ]]; then
+            body="$WELCOME_MESSAGE"
+          else
+            body="$CAUTION_MESSAGE"
+          fi
+
+          printf '%s\n' "$body" |
+            gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body-file -
diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml
index 19e03391f1cf..61309d3d6aeb 100644
--- a/.github/workflows/coverage-linux-without-intl.yml
+++ b/.github/workflows/coverage-linux-without-intl.yml
@@ -49,7 +49,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml
index c2c4b22c57a3..4d350ebd2e0b 100644
--- a/.github/workflows/coverage-linux.yml
+++ b/.github/workflows/coverage-linux.yml
@@ -49,7 +49,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/coverage-windows.yml b/.github/workflows/coverage-windows.yml
index cbb5a776cb0e..d735ea551c93 100644
--- a/.github/workflows/coverage-windows.yml
+++ b/.github/workflows/coverage-windows.yml
@@ -69,7 +69,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: windows-2025
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/create-release-proposal.yml b/.github/workflows/create-release-proposal.yml
index 883bb48b0df2..735b15ffd12f 100644
--- a/.github/workflows/create-release-proposal.yml
+++ b/.github/workflows/create-release-proposal.yml
@@ -33,14 +33,14 @@ jobs:
       RELEASE_LINE: ${{ inputs.release-line }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ env.STAGING_BRANCH }}
           persist-credentials: false
 
       # Install dependencies
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml
index 0895f1353e57..107889949997 100644
--- a/.github/workflows/daily-wpt-fyi.yml
+++ b/.github/workflows/daily-wpt-fyi.yml
@@ -49,7 +49,7 @@ jobs:
         run: echo "NIGHTLY=$(curl -s https://nodejs.org/download/nightly/index.json | jq -r '[.[] | select(.files[] | contains("linux-arm64"))][0].version')" >> $GITHUB_ENV
       - name: Install Node.js
         id: setup-node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NIGHTLY || matrix.node-version }}
           check-latest: true
@@ -61,7 +61,7 @@ jobs:
           SHORT_SHA=$(node -p 'process.version.split(/-nightly\d{8}/)[1]')
           echo "NIGHTLY_REF=$(gh api /repos/nodejs/node/commits/$SHORT_SHA --jq '.sha')" >> $GITHUB_ENV
       - name: Checkout ${{ steps.setup-node.outputs.node-version }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ env.NIGHTLY_REF || steps.setup-node.outputs.node-version }}
@@ -77,7 +77,7 @@ jobs:
         run: rm -rf wpt
         working-directory: test/fixtures
       - name: Checkout epochs/daily WPT
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: web-platform-tests/wpt
           persist-credentials: false
@@ -108,7 +108,7 @@ jobs:
       # version-specific checkout above overwrites .github/actions/
       - name: Checkout undici WPT actions
         if: ${{ env.WPT_REPORT != '' }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           sparse-checkout: |
             .github/actions/undici-wpt-current
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 6c4b2ec9a4be..b7a616e2df5d 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -16,11 +16,11 @@ jobs:
     if: github.repository == 'nodejs/node' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Build lto
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 6e5dfe732646..693d9ad3dd24 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -24,11 +24,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Build
diff --git a/.github/workflows/find-inactive-collaborators.yml b/.github/workflows/find-inactive-collaborators.yml
index e6e0c7f54f69..8c74fda22428 100644
--- a/.github/workflows/find-inactive-collaborators.yml
+++ b/.github/workflows/find-inactive-collaborators.yml
@@ -19,13 +19,13 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/find-inactive-tsc.yml b/.github/workflows/find-inactive-tsc.yml
index c1804b78d378..d59f26b73b2b 100644
--- a/.github/workflows/find-inactive-tsc.yml
+++ b/.github/workflows/find-inactive-tsc.yml
@@ -20,13 +20,13 @@ jobs:
 
     steps:
       - name: Checkout the repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Clone nodejs/TSC repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           path: .tmp
@@ -34,7 +34,7 @@ jobs:
           repository: nodejs/TSC
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/license-builder.yml b/.github/workflows/license-builder.yml
index a95ee13c45f4..3bdf3fc31dcc 100644
--- a/.github/workflows/license-builder.yml
+++ b/.github/workflows/license-builder.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - run: ./tools/license-builder.sh  # Run the license builder tool
diff --git a/.github/workflows/lint-release-proposal.yml b/.github/workflows/lint-release-proposal.yml
index e8ffab178458..027aee336ace 100644
--- a/.github/workflows/lint-release-proposal.yml
+++ b/.github/workflows/lint-release-proposal.yml
@@ -23,7 +23,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 2
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
index 9a9177e01c91..38980ecf6d93 100644
--- a/.github/workflows/linters.yml
+++ b/.github/workflows/linters.yml
@@ -25,11 +25,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Lint addon docs
@@ -38,7 +38,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -51,12 +51,12 @@ jobs:
     if: ${{ github.event.pull_request && github.event.pull_request.draft == false && github.base_ref == github.event.repository.default_branch }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -87,11 +87,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Lint JavaScript files
@@ -134,7 +134,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -159,7 +159,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -181,7 +181,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -197,7 +197,7 @@ jobs:
     # cannot use ubuntu-24.04-arm here because the docker image is x86 only
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - uses: mszostok/codeowners-validator@7f3f5e28c6d7b8dfae5731e54ce2272ca384592f
@@ -207,7 +207,7 @@ jobs:
     if: ${{ github.event.pull_request }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -222,7 +222,7 @@ jobs:
   lint-readme:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/notify-on-push.yml b/.github/workflows/notify-on-push.yml
index e709df93a8d7..25421b8447d8 100644
--- a/.github/workflows/notify-on-push.yml
+++ b/.github/workflows/notify-on-push.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Slack Notification
-        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # 2.4.0
+        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # v2.4.0
         env:
           SLACK_COLOR: '#DE512A'
           SLACK_ICON: https://github.com/nodejs.png?size=48
@@ -32,12 +32,15 @@ jobs:
           SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
 
   validateCommitMessage:
+    # If a commit is force-pushed out of the main branch, the `commits` array is
+    # empty and there are no checks to run.
+    if: github.event.commits[0]
     name: Notify on Push on `main` with invalid message
     # cannot use ubuntu-slim here because rtCamp/action-slack-notify is dockerized
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Validate commits
@@ -47,7 +50,7 @@ jobs:
           COMMITS: ${{ toJSON(github.event.commits) }}
       - name: Slack Notification
         if: ${{ failure() && steps.commit-check.conclusion == 'failure' && github.repository == 'nodejs/node' }}
-        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # 2.4.0
+        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # v2.4.0
         env:
           SLACK_COLOR: '#DE512A'
           SLACK_ICON: https://github.com/nodejs.png?size=48
diff --git a/.github/workflows/notify-on-review-wanted.yml b/.github/workflows/notify-on-review-wanted.yml
index 2f1f3af8139b..effc6c209eb1 100644
--- a/.github/workflows/notify-on-review-wanted.yml
+++ b/.github/workflows/notify-on-review-wanted.yml
@@ -34,7 +34,7 @@ jobs:
           fi
 
       - name: Slack Notification
-        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # 2.4.0
+        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # v2.4.0
         env:
           MSG_MINIMAL: actions url
           SLACK_COLOR: '#3d85c6'
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f84c91e1a381..4a7415bc90e1 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,12 +36,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit  # TODO: change to 'egress-policy: block' after couple of runs
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -76,6 +76,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
index 10f61e8f922e..af1df77fe5f8 100644
--- a/.github/workflows/stress-test.yml
+++ b/.github/workflows/stress-test.yml
@@ -54,7 +54,7 @@ jobs:
       SCCACHE_GHA_ENABLED: 'true'
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml
index 2bc7a1f029a1..ee3a85d10fc9 100644
--- a/.github/workflows/test-internet.yml
+++ b/.github/workflows/test-internet.yml
@@ -46,7 +46,7 @@ jobs:
     if: (github.event_name == 'schedule' && github.repository == 'nodejs/node') || (github.event.pull_request && github.event.pull_request.draft == false)
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml
index 9916b7993d00..c1a57509c0ba 100644
--- a/.github/workflows/test-linux-quic.yml
+++ b/.github/workflows/test-linux-quic.yml
@@ -45,7 +45,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
index e154ee866df8..03f349fbed9e 100644
--- a/.github/workflows/test-linux.yml
+++ b/.github/workflows/test-linux.yml
@@ -54,7 +54,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml
index 943ea4cb6c7c..29b9d4b0b93a 100644
--- a/.github/workflows/test-macos.yml
+++ b/.github/workflows/test-macos.yml
@@ -50,7 +50,7 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/timezone-update.yml b/.github/workflows/timezone-update.yml
index 94961f8ae6ed..481c20da4e05 100644
--- a/.github/workflows/timezone-update.yml
+++ b/.github/workflows/timezone-update.yml
@@ -21,12 +21,12 @@ jobs:
 
     steps:
       - name: Checkout nodejs/node
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout unicode-org/icu-data
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           path: icu-data
           persist-credentials: false
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index 900cf3ae00ce..89ed96f31d2c 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -286,7 +286,7 @@ jobs:
               tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
               rm temp-output
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         with:
           persist-credentials: false
@@ -311,7 +311,7 @@ jobs:
         # no-op if the base branch is already up-to-date.
         with:
           token: ${{ secrets.GH_USER_TOKEN }}
-          branch: actions/${{ github.ref_name == 'main' || format('{0}/', github.ref_name) }}tools-update-${{ matrix.id }}  # Custom branch *just* for this Action.
+          branch: actions/${{ github.ref_name != 'main' && format('{0}/', github.ref_name) || '' }}tools-update-${{ matrix.id }}  # Custom branch *just* for this Action.
           delete-branch: true
           commit-message: ${{ env.COMMIT_MSG }}
           labels: ${{ matrix.label }}
diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml
index 49f0006526b0..10eb3289a1f7 100644
--- a/.github/workflows/update-openssl.yml
+++ b/.github/workflows/update-openssl.yml
@@ -15,7 +15,7 @@ jobs:
     # Cannot use ubuntu-slim here because the update script requires Docker
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Check and download new OpenSSL version
diff --git a/.github/workflows/update-v8.yml b/.github/workflows/update-v8.yml
index e365cf770174..8e71e563896b 100644
--- a/.github/workflows/update-v8.yml
+++ b/.github/workflows/update-v8.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Cache node modules and update-v8
@@ -30,7 +30,7 @@ jobs:
             ~/.npm
           key: ${{ runner.os }}-build-${{ env.cache-name }}
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Install @node-core/utils
diff --git a/.github/workflows/update-wpt.yml b/.github/workflows/update-wpt.yml
index 4f752cc18985..7b59a2f137f3 100644
--- a/.github/workflows/update-wpt.yml
+++ b/.github/workflows/update-wpt.yml
@@ -27,12 +27,12 @@ jobs:
         subsystem: ${{ fromJSON(github.event.inputs.subsystems || '["url", "urlpattern", "WebCryptoAPI"]') }}
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/BUILDING.md b/BUILDING.md
index 36d80912f582..6770bd3711b5 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -776,16 +776,7 @@ Follow <https://github.com/ccache/ccache/wiki/MS-Visual-Studio>, and you
 should notice that obj file will be bigger than the normal one.
 
 First, install ccache. Assuming the installation of ccache is in `c:\ccache`
-(where you can find `ccache.exe`), copy `c:\ccache\ccache.exe` to `c:\ccache\cl.exe`
-with this command.
-
-```powershell
-cp c:\ccache\ccache.exe c:\ccache\cl.exe
-```
-
-With newer version of Visual Studio, it may need the copy to be `clang-cl.exe`
-instead. If the output of `vcbuild.bat` suggests missing `clang-cl.exe`, copy
-it differently:
+(where you can find `ccache.exe`), setup aliases as the following commands:
 
 ```powershell
 cp c:\ccache\ccache.exe c:\ccache\clang-cl.exe
@@ -800,12 +791,6 @@ When building Node.js, provide a path to your ccache via the option:
 This will allow for near-instantaneous rebuilds when switching branches back
 and forth that were built with cache.
 
-To use it with ClangCL, run this instead:
-
-```powershell
-.\vcbuild.bat clang-cl ccache c:\ccache\
-```
-
 ### Android
 
 Android is not a supported platform. Patches to improve the Android build are
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6791109aecaa..4f5a7066d6df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -40,7 +40,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V24.md#24.21.0">24.21.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V24.md#24.22.0">24.22.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V24.md#24.21.0">24.21.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V24.md#24.20.0">24.20.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V24.md#24.19.0">24.19.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V24.md#24.18.1">24.18.1</a><br/>
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
index a1fd4148aaee..c71ec5ee96a1 100644
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -12,6 +12,7 @@
   * [Ideal Nominees](#ideal-nominees)
   * [Nominating a new Collaborator](#nominating-a-new-collaborator)
   * [Onboarding](#onboarding)
+  * [Restoring emeritus Collaborators](#restoring-emeritus-collaborators)
 * [Consensus seeking process](#consensus-seeking-process)
 
 <!-- /TOC -->
@@ -68,7 +69,8 @@ See:
 * Merging pull requests
 
 The TSC can remove inactive collaborators or provide them with _emeritus_
-status. Emeriti may request that the TSC restore them to active status.
+status. Emeriti may request that the TSC restore them to active status. See
+[Restoring emeritus Collaborators](#restoring-emeritus-collaborators).
 
 A collaborator is automatically made emeritus (and removed from active
 collaborator status) if it has been more than 12 months since the collaborator
@@ -335,6 +337,29 @@ After the nomination passes, a TSC member onboards the new collaborator. See
 [the onboarding guide](./onboarding.md) for details of the onboarding
 process.
 
+### Restoring emeritus Collaborators
+
+An emeritus collaborator who has resumed contributing may request restoration to
+active status by opening an issue in [the TSC issue tracker][]. The request
+describes their recent contributions and their intent to take on collaborator
+responsibilities again. There is no new nomination and no vote. The request
+stays open for one week, matching the window for a collaborator nomination. If
+no TSC member objects, the request passes.
+
+Before restoring access, a TSC member confirms that the account making the
+request is still under the control of the same person. See
+[The Authenticity of Contributors](#the-authenticity-of-contributors).
+
+After the request passes, a TSC member re-onboards the returning collaborator,
+reversing the applicable
+[offboarding tasks](./doc/contributing/offboarding.md). As in
+[the onboarding guide][], the returning collaborator authors the pull request
+moving themselves from the emeriti list back to the active list in the README.
+That restarts the activity clock the [inactive collaborator workflow][] measures.
+
+An emeritus TSC member returning as a collaborator rejoins the TSC through a TSC
+motion under [Section 3 of the TSC Charter][TSC Charter].
+
 ## Consensus seeking process
 
 The TSC follows a [Consensus Seeking][] decision-making model per the
@@ -343,5 +368,8 @@ The TSC follows a [Consensus Seeking][] decision-making model per the
 [Consensus Seeking]: https://en.wikipedia.org/wiki/Consensus-seeking_decision-making
 [TSC Charter]: https://github.com/nodejs/TSC/blob/HEAD/TSC-Charter.md
 [discussion in the nodejs/collaborators]: https://github.com/nodejs/collaborators/discussions/categories/collaborator-nominations
+[inactive collaborator workflow]: https://github.com/nodejs/node/blob/HEAD/.github/workflows/find-inactive-collaborators.yml
 [nodejs/help]: https://github.com/nodejs/help
 [nodejs/node]: https://github.com/nodejs/node
+[the TSC issue tracker]: https://github.com/nodejs/TSC/issues
+[the onboarding guide]: ./onboarding.md#exercise-make-a-pull-request-adding-yourself-to-the-readme
diff --git a/Makefile b/Makefile
index 37182634b5b5..3672ac9be042 100644
--- a/Makefile
+++ b/Makefile
@@ -96,7 +96,7 @@ BUILD_RELEASE_FLAGS ?= $(BUILD_DOWNLOAD_FLAGS) $(BUILD_INTL_FLAGS)
 
 # Default to quiet/pretty builds.
 # To do verbose builds, run `make V=1` or set the V environment variable.
-V ?= 0
+V ?=
 
 # Use -e to double check in case it's a broken link
 available-node = \
@@ -1414,7 +1414,8 @@ format-md: tools/lint-md/node_modules/remark-parse/package.json ## Format the ma
 LINT_JS_TARGETS = eslint.config.mjs benchmark doc lib test tools
 
 run-lint-js = tools/eslint/node_modules/eslint/bin/eslint.js --cache \
-	--max-warnings=0 --report-unused-disable-directives $(LINT_JS_TARGETS)
+	--max-warnings=0 --report-unused-disable-directives \
+	--concurrency auto $(LINT_JS_TARGETS)
 run-lint-js-fix = $(run-lint-js) --fix
 
 tools/eslint/node_modules/eslint/bin/eslint.js: tools/eslint/package-lock.json
@@ -1441,7 +1442,7 @@ jslint: lint-js
 
 run-lint-js-ci = tools/eslint/node_modules/eslint/bin/eslint.js \
   --max-warnings=0 --report-unused-disable-directives -f tap \
-	-o test-eslint.tap $(LINT_JS_TARGETS)
+  --concurrency auto -o test-eslint.tap $(LINT_JS_TARGETS)
 
 .PHONY: lint-js-ci
 # On the CI the output is emitted in the TAP format.
diff --git a/README.md b/README.md
index 3827556a44fb..d90887e0f5d8 100644
--- a/README.md
+++ b/README.md
@@ -285,6 +285,8 @@ For information about the governance of the Node.js project, see
   **Antoine du Hamel** <<duhamelantoine1995@gmail.com>> (he/him) - [Support me](https://github.com/sponsors/aduh95)
 * [anonrig](https://github.com/anonrig) -
   **Yagiz Nizipli** <<yagiz@nizipli.com>> (he/him) - [Support me](https://github.com/sponsors/anonrig)
+* [araujogui](https://github.com/araujogui) -
+  **Guilherme Araújo** <<arauujogui@gmail.com>> (he/him)
 * [atlowChemi](https://github.com/atlowChemi) -
   **Chemi Atlow** <<chemi@atlow.co.il>> (he/him)
 * [avivkeller](https://github.com/avivkeller) -
@@ -761,6 +763,8 @@ maintaining the Node.js project.
   **Wiyeong Seo** <<hbsps.dev@gmail.com>>
 * [iam-frankqiu](https://github.com/iam-frankqiu) -
   **Frank Qiu** <<iam.frankqiu@gmail.com>> (he/him)
+* [inoway46](https://github.com/inoway46) -
+  **Yuya Inoue** <<inoueyuya416@gmail.com>> (he/him)
 * [milesguicent](https://github.com/milesguicent) -
   **Miles Guicent** <<guicent@pm.me>> (he/him)
 * [preveen-stack](https://github.com/preveen-stack) -
@@ -800,7 +804,6 @@ that server.
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 # Antoine du Hamel
 gpg --keyserver hkps://keys.openpgp.org --recv-keys DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 # Juan José Arboleda
 gpg --keyserver hkps://keys.openpgp.org --recv-keys CC68F5A3106FF448322E48ED27F5E38D5B0A215F # Marco Ippolito
-gpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 # Michaël Zasso
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga
 gpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno
diff --git a/SECURITY.md b/SECURITY.md
index 10763d91ffc7..cdf2469343bb 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -151,6 +151,28 @@ are not part of the Node.js documented API surface, are not enabled by
 default in production builds, and may have incomplete implementations or
 missing security hardening.
 
+### Security triage dispositions
+
+When triaging a report, the project classifies it into one of the following
+dispositions:
+
+* **Vulnerability**: A Node.js defect that is exploitable across a
+  Node.js-owned security boundary and meets the criteria under
+  [What constitutes a vulnerability](#what-constitutes-a-vulnerability),
+  including any applicable DoS criteria.
+* **Security-interest bug**: A real Node.js defect, or an API behavior likely
+  to cause security bugs in applications, that is not itself a vulnerability
+  under this threat model. These are fixed as regular bugs and do not
+  automatically receive a CVE, but should still be reported privately first
+  when they affect a common security control such as protocol interpretation,
+  permission enforcement, or certificate/TLS decisions.
+* **Common bug**: A correctness, robustness, or crash issue without a
+  Node.js-owned security boundary or a realistic cross-boundary attacker benefit.
+* **Invalid / out of scope**: A bug report that meets one of these criteria:
+  * Cannot be reproduced
+  * Is not a Node.js defect (e.g., an application bug)
+  * Is excluded by policy (e.g., experimental features)
+
 ### What constitutes a vulnerability
 
 Being able to cause the following through control of the elements that Node.js
@@ -329,6 +351,19 @@ the community they pose.
 * Code is trusted by Node.js. Therefore any scenario that requires a malicious
   third-party module cannot result in a vulnerability in Node.js.
 
+#### Same-process self-harm
+
+* Node.js trusts the code it is asked to run. A defect that can only be
+  triggered by JavaScript, WASM, native, addon, FFI, or dependency code already
+  executing in the target process is not a Node.js vulnerability merely because
+  that code can crash, corrupt, or confuse the process it already controls.
+  This includes forging an internal handle, reflecting or overwriting an
+  internal `Symbol()`, installing a `Symbol.hasInstance` hook, or reaching into
+  an internal binding.
+* Such issues may still be fixed as common bugs. They become vulnerabilities
+  only if the same defect is reachable from an element Node.js does not trust
+  without relying on an application-created boundary.
+
 #### Prototype Pollution Attacks (CWE-1321)
 
 * Node.js trusts the inputs provided to it by application code.
@@ -445,12 +480,35 @@ resources a Node.js process may access. It is designed to reduce the blast
 radius of mistakes in trusted application code, **not** to act as a security
 boundary against intentional misuse or a compromised process.
 
+Permission Model reports are triaged in three lanes:
+
+* **Vulnerability**: An element Node.js does not trust crosses a Node.js-owned
+  permission check without trusted code already executing in the protected
+  process.
+* **Security-interest bug**: Trusted application code uses documented, stable
+  APIs as intended, but Node.js fails to enforce a documented permission
+  invariant consistently — for example, one API enforces a check that an
+  equivalent API omits. These are fixed as hardening and are not automatically
+  CVE-class, because the Permission Model is not a sandbox against malicious
+  same-process code.
+* **Excluded**: Intentional misuse by code already running in the process,
+  operator-selected flags, a modified `execArgv`/`env`, or any expectation that
+  the Permission Model sandboxes malicious same-process code.
+
 The following are **not** vulnerabilities in Node.js:
 
 * **Operator-controlled flags**: Behavior unlocked by flags the operator
   explicitly passes (e.g., `--localstorage-file`) is the operator's
   responsibility. The permission model does not restrict how Node.js behaves
-  when the operator intentionally configures it.
+  when the operator intentionally configures it. This includes any file or
+  resource that Node.js itself creates, writes, or reads at a location the
+  operator selected through a flag, including every path derived from a
+  template or pattern in that flag. For example, trace files rotated by
+  `--trace-event-file-pattern` (`${rotation}`) being written without a
+  matching `--allow-fs-write` entry is not a permission model bypass. Such
+  paths are part of the operator's configuration, not application file-system
+  access. Inconsistent checks on these paths are treated as regular bugs and
+  should be reported through the public issue tracker.
 
 * **`node:sqlite` and the permission model**: `DatabaseSync` operates with the
   same file-system privileges as the process. Using SQL pragmas or built-in
@@ -465,9 +523,14 @@ The following are **not** vulnerabilities in Node.js:
   symlinks that resolve within the allowed list are similarly not considered
   permission model bypasses.
 
-* **`worker_threads` with modified `execArgv`**: Workers inherit the permission
-  restrictions of their parent process. Passing an empty or modified `execArgv`
-  to a worker does not grant it additional permissions.
+* **`worker_threads` and the permission model**: Creating a worker is gated by
+  `--allow-worker`. A worker started with a modified `execArgv` or `env` may
+  start without inheriting the parent's permission configuration, so the
+  permission model does not reliably propagate to such workers. Because worker
+  creation already requires `--allow-worker`, and the Permission Model is not a
+  sandbox against intentional misuse by trusted code, this is not considered a
+  vulnerability. Applications that rely on the Permission Model must not grant
+  `--allow-worker` to code they do not trust.
 
 #### V8 Sandbox
 
diff --git a/benchmark/README.md b/benchmark/README.md
index 2f52a44f251a..8bccdb04d2a5 100644
--- a/benchmark/README.md
+++ b/benchmark/README.md
@@ -34,7 +34,7 @@ The actual benchmark scripts should be placed in their corresponding
 directories.
 
 * `_benchmark_progress.js`: implements the progress bar displayed
-  when running `compare.js`
+  when running `compare.js` and `scatter.js`
 * `_cli.js`: parses the command line arguments passed to `compare.js`,
   `run.js` and `scatter.js`
 * `_cli.R`: parses the command line arguments passed to `compare.R`
@@ -49,7 +49,8 @@ directories.
 * `run.js`: command line tool for running individual benchmark suite(s).
 * `scatter.js`: command line tool for comparing the performance
   between different parameters in benchmark configurations,
-  for example to analyze the time complexity.
+  for example to analyze the time complexity. Pass `--analyze` to
+  summarize the results without R.
 * `scatter.R`: R script for visualizing the output of `scatter.js` with
   scatter plots.
 
diff --git a/benchmark/compare.js b/benchmark/compare.js
index 6aaaee7a9190..38fba5ba267b 100644
--- a/benchmark/compare.js
+++ b/benchmark/compare.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const { spawn, fork } = require('node:child_process');
+const { closeSync, openSync, writeSync } = require('node:fs');
 const { inspect } = require('util');
 const path = require('path');
 const CLI = require('./_cli.js');
@@ -27,7 +28,9 @@ const cli = new CLI(`usage: ./node compare.js [options] [--] <category> ...
   --no-progress                 don't show benchmark progress indicator
   --analyze                     perform statistical analysis after benchmarks
                                 complete (Welch's t-test, effect size) instead
-                                of printing csv output
+                                of printing csv output to stdout
+  --csv      filename           write csv output to filename (can be combined
+                                with --analyze). Use - to write to stdout.
   --scale    1000               rate-to-integer multiplier for histogram
                                  precision when using --analyze (default: 1000)
   --max-regression  N           exit with code 1 if any statistically
@@ -60,6 +63,16 @@ if (benchmarks.length === 0) {
   return;
 }
 
+const cvsToStdout = cli.optional.csv === '-';
+const csvFd = cli.optional.csv === undefined || cvsToStdout ?
+  null :
+  openSync(cli.optional.csv, 'w');
+const outputCsv = !analyze || csvFd !== null || cvsToStdout;
+
+function writeCsv(line) {
+  writeSync(csvFd || process.stdout.fd, `${line}\n`);
+}
+
 // When --analyze is set, collect results for statistical analysis.
 const results = analyze ? new Map() : null;
 
@@ -78,17 +91,19 @@ for (const filename of benchmarks) {
 }
 // queue.length = binary.length * runs * benchmarks.length
 
-// Print csv header (unless analyzing inline).
-if (!analyze) {
-  console.log('"binary","filename","configuration","rate","time"');
+// Print csv header unless only analyzing inline.
+if (outputCsv) {
+  writeCsv('"binary","filename","configuration","rate","time"');
 }
 
 const kStartOfQueue = 0;
 
-const showProgress = !cli.optional['no-progress'];
+const showProgress = !cli.optional['no-progress'] && !cvsToStdout;
 let progress;
 if (showProgress) {
-  progress = new BenchmarkProgress(queue, benchmarks, { analyze });
+  progress = new BenchmarkProgress(queue, benchmarks, {
+    analyze: analyze || csvFd !== null,
+  });
   progress.startQueue(kStartOfQueue);
 }
 
@@ -126,11 +141,13 @@ if (showProgress) {
           results.set(name, { old: [], new: [] });
         }
         results.get(name)[job.binary].push(data.rate);
-      } else {
+      }
+
+      if (outputCsv) {
         // Escape quotes (") for correct csv formatting
-        conf = conf.replace(/"/g, '""');
-        console.log(`"${job.binary}","${job.filename}","${conf}",` +
-                    `${data.rate},${data.time}`);
+        const csvConf = conf.replace(/"/g, '""');
+        writeCsv(`"${job.binary}","${job.filename}","${csvConf}",` +
+                 `${data.rate},${data.time}`);
       }
       if (showProgress) {
         // One item in the subqueue has been completed.
@@ -153,12 +170,34 @@ if (showProgress) {
     // If there are more benchmarks execute the next
     if (i + 1 < queue.length) {
       recursive(i + 1);
-    } else if (analyze) {
-      printAnalysis(results, scale, maxRegression);
+    } else {
+      if (csvFd !== null) closeSync(csvFd);
+      if (analyze) printAnalysis(results, scale, maxRegression);
     }
   });
 })(kStartOfQueue);
 
+// Holm-Bonferroni step-down adjustment. Controls the probability of *any*
+// false positive across the whole comparison set, which is what a pass/fail
+// gate needs: an uncorrected suite of 169 comparisons at 5% has a 99.98%
+// chance of flagging something that is not there. Uniformly more powerful
+// than plain Bonferroni, and makes no assumption about independence.
+function holmAdjust(pValues) {
+  const order = pValues
+    .map((p, i) => ({ p, i }))
+    .sort((a, b) => a.p - b.p);
+  const m = order.length;
+  const adjusted = new Array(m);
+  let running = 0;
+  for (let k = 0; k < m; k++) {
+    // Step down, enforcing monotonicity so an adjusted value can never be
+    // smaller than one belonging to a more significant raw p-value.
+    running = Math.max(running, Math.min(1, (m - k) * order[k].p));
+    adjusted[order[k].i] = running;
+  }
+  return adjusted;
+}
+
 function printAnalysis(results, scale, maxRegression) {
   const { createHistogram } = require('node:perf_hooks');
 
@@ -217,43 +256,64 @@ function printAnalysis(results, scale, maxRegression) {
     if (name.length > maxNameLen) maxNameLen = name.length;
   }
 
+  // Adjust for the size of the comparison set. The raw p-value answers "is
+  // this one benchmark different", but a suite is read as a whole, so the
+  // relevant question is "is anything here different".
+  const adjusted = holmAdjust(rows.map((r) => r.pValue));
+  for (let i = 0; i < rows.length; i++) rows[i].pAdjusted = adjusted[i];
+
+  // A comparison can only rule out an effect it was able to resolve. Where no
+  // threshold has been given there is no definition of "worth detecting", so
+  // nothing is claimed. `maxRegression` is exactly such a declaration, so it
+  // is reused rather than inventing a second constant.
+  const resolution = maxRegression > 0 ? maxRegression : null;
+  let underpowered = 0;
+  for (const row of rows) {
+    row.inconclusive = resolution !== null &&
+                       row.stars.trim() === '' &&
+                       row.ci95 > resolution;
+    if (row.inconclusive) underpowered++;
+  }
+
   // Print header.
   const pad = (s, n) => s + ' '.repeat(Math.max(0, n - s.length));
   const rpad = (s, n) => ' '.repeat(Math.max(0, n - s.length)) + s;
 
-  console.log(`${pad('', maxNameLen)}  confidence` +
-              `   improvement   accuracy (*)    (**)   (***)`);
+  writeSync(process.stdout.fd, `${pad('', maxNameLen)}  confidence` +
+              `   improvement   accuracy (*)    (**)   (***)\n`);
 
   for (const row of rows) {
     const imp = `${row.improvement >= 0 ? '+' : ''}${row.improvement.toFixed(2)} %`;
-    console.log(
-      `${pad(row.name, maxNameLen)}  ${pad(row.stars, 10)}` +
+    writeSync(process.stdout.fd,
+              `${pad(row.name, maxNameLen)}  ${pad(row.stars, 10)}` +
       `  ${rpad(imp, 11)}` +
       `   ±${row.ci95.toFixed(2)}%` +
       `  ±${row.ci99.toFixed(2)}%` +
-      `  ±${row.ci999.toFixed(2)}%`,
+      `  ±${row.ci999.toFixed(2)}%` +
+      `${row.inconclusive ? '  (inconclusive)' : ''}\n`,
     );
   }
 
   if (skipped > 0) {
-    console.log('');
-    console.log(
-      `Note: ${skipped} configuration${skipped === 1 ? ' was' : 's were'}` +
+    writeSync(process.stdout.fd, '\n');
+    writeSync(process.stdout.fd,
+              `Note: ${skipped} configuration${skipped === 1 ? ' was' : 's were'}` +
       ` skipped because Welch's t-test requires at least 2 samples per` +
-      ` binary. Use --runs 2 or higher.`,
+      ` binary. Use --runs 2 or higher.\n`,
     );
   }
 
   // --- Bar chart visualization ---
   printChart(rows, maxNameLen);
 
-  console.log('');
-  console.log(
-    `Rates were scaled by ${scale}x into HdrHistogram (3 significant figures).\n` +
-    `Use --scale to adjust precision if needed.\n`,
+  writeSync(process.stdout.fd, '\n');
+  writeSync(process.stdout.fd,
+            `Rates were scaled by ${scale}x into HdrHistogram (3 significant figures).\n` +
+    `Use --scale to adjust precision if needed.\n\n`,
   );
-  console.log(
-    `Be aware that when doing many comparisons the risk of a false-positive\n` +
+  const anyFamilyWise = rows.filter((r) => r.pAdjusted < 0.05).length;
+  writeSync(process.stdout.fd,
+            `Be aware that when doing many comparisons the risk of a false-positive\n` +
     `result increases. In this case, there are ${rows.length} comparisons, ` +
     `you can thus\nexpect the following amount of false-positive results:\n` +
     `  ${(rows.length * 0.05).toFixed(2)} false positives, when considering ` +
@@ -261,23 +321,56 @@ function printAnalysis(results, scale, maxRegression) {
     `  ${(rows.length * 0.01).toFixed(2)} false positives, when considering ` +
     `a   1% risk acceptance (**, ***),\n` +
     `  ${(rows.length * 0.001).toFixed(2)} false positives, when considering ` +
-    `a 0.1% risk acceptance (***)`,
+    `a 0.1% risk acceptance (***)\n` +
+    `\nThe stars above are per-benchmark and uncorrected. Adjusting for the ` +
+    `size of\nthis comparison set (Holm-Bonferroni), ${anyFamilyWise} ` +
+    `comparison${anyFamilyWise === 1 ? '' : 's'} remain${anyFamilyWise === 1 ? 's' : ''} ` +
+    `significant at 5%.\n--max-regression uses the corrected values.\n`,
   );
 
-  // Gate: exit with error if any significant regression exceeds the limit.
+  // Gate: exit with error if any regression is shown to exceed the limit.
   if (maxRegression > 0) {
+    if (underpowered > 0) {
+      writeSync(process.stdout.fd, '\n');
+      writeSync(process.stdout.fd,
+                `Note: ${underpowered} of ${rows.length} comparison` +
+        `${rows.length === 1 ? '' : 's'} could not resolve an effect as ` +
+        `small as ${maxRegression}%, and are marked (inconclusive). They are ` +
+        `not\nevidence of no regression -- the samples are too noisy to tell. ` +
+        `Raise --runs,\nor pin cores with --set CPUSET, to narrow them.\n`,
+      );
+    }
+
+    // Two conditions, both required.
+    //
+    // The confidence interval must lie entirely beyond the threshold. A small
+    // p-value only says the effect is not exactly zero; claiming it exceeds
+    // `maxRegression` is a statement about magnitude, so the interval has to
+    // exclude that magnitude. Testing the point estimate instead systematically
+    // fires on the noisiest benchmarks, because a large point estimate is
+    // easiest to obtain when the interval is wide.
+    //
+    // The p-value must also survive adjustment for the size of the comparison
+    // set, so that a suite of hundreds of benchmarks does not fail purely
+    // because one of them drifted.
     const failures = rows.filter(
-      (r) => r.stars.trim() !== '' && r.improvement < -maxRegression,
+      (r) => r.pAdjusted < 0.05 && r.improvement + r.ci95 < -maxRegression,
     );
+
     if (failures.length > 0) {
-      console.log('');
-      console.log(
-        `FAIL: ${failures.length} benchmark${failures.length === 1 ? '' : 's'}` +
-        ` showed a statistically significant regression exceeding` +
-        ` ${maxRegression}%:`,
+      writeSync(process.stdout.fd, '\n');
+      writeSync(process.stdout.fd,
+                `FAIL: ${failures.length} benchmark${failures.length === 1 ? '' : 's'}` +
+        ` regressed by more than ${maxRegression}%` +
+        ` (interval excludes the threshold,\n` +
+        `family-wise corrected across ${rows.length} comparisons):\n`,
       );
       for (const f of failures) {
-        console.log(`  ${f.name}  ${f.improvement.toFixed(2)}%`);
+        writeSync(process.stdout.fd,
+                  `  ${f.name}  ${f.improvement.toFixed(2)}% ` +
+          `(95% CI up to ${(f.improvement + f.ci95).toFixed(2)}%, ` +
+          `adjusted p=${f.pAdjusted.toExponential(2)})\n`,
+        );
       }
       process.exitCode = 1;
     }
@@ -313,8 +406,8 @@ function printChart(rows, maxNameLen) {
     axisCenter +
     ' '.repeat(Math.max(0, halfWidth - Math.ceil(axisCenter.length / 2) - axisRight.length)) +
     axisRight;
-  console.log('');
-  console.log(leftLabel);
+  writeSync(process.stdout.fd, '\n');
+  writeSync(process.stdout.fd, `${leftLabel}\n`);
 
   for (const row of rows) {
     const imp = row.improvement;
@@ -346,6 +439,6 @@ function printChart(rows, maxNameLen) {
 
     const label = `${row.improvement >= 0 ? '+' : ''}${row.improvement.toFixed(2)}%`;
     const sig = row.stars.trim();
-    console.log(`${pad(row.name, maxNameLen)}  ${chars.join('')}  ${label} ${sig}`);
+    writeSync(process.stdout.fd, `${pad(row.name, maxNameLen)}  ${chars.join('')}  ${label} ${sig}\n`);
   }
 }
diff --git a/benchmark/crypto/class-construction.js b/benchmark/crypto/class-construction.js
new file mode 100644
index 000000000000..fe03b1a43cd2
--- /dev/null
+++ b/benchmark/crypto/class-construction.js
@@ -0,0 +1,86 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const fixtureDir = path.resolve(__dirname, '../../test/fixtures/keys');
+const certificate = fs.readFileSync(path.join(fixtureDir, 'agent1-cert.pem'));
+const dhPrime = crypto.getDiffieHellman('modp14').getPrime();
+const key = Buffer.alloc(32, 0x01);
+const keyObject = crypto.createSecretKey(key);
+const hmacAlgorithm = { name: 'HMAC', hash: 'SHA-256' };
+const keyUsages = ['sign'];
+const iv = Buffer.alloc(16, 0x02);
+
+const iterations = {
+  Certificate: 1e7,
+  Cipheriv: 1e5,
+  Decipheriv: 1e5,
+  DiffieHellman: 10,
+  DiffieHellmanGroup: 2e5,
+  ECDH: 2e5,
+  Hash: 1e5,
+  Hmac: 5e4,
+  KeyObject: 1e5,
+  Sign: 1e5,
+  Verify: 1e5,
+  CryptoKey: 5e4,
+  X509Certificate: 5e3,
+};
+
+const bench = common.createBenchmark(main, {
+  type: Object.keys(iterations),
+  n: [...new Set(Object.values(iterations))],
+}, {
+  combinationFilter({ type, n }) {
+    // Benchmark test mode reduces numeric options to 1.
+    return n === 1 || iterations[type] === n;
+  },
+});
+
+function construct(type) {
+  switch (type) {
+    case 'Certificate':
+      return new crypto.Certificate();
+    case 'Cipheriv':
+      return crypto.createCipheriv('aes-256-ctr', key, iv);
+    case 'Decipheriv':
+      return crypto.createDecipheriv('aes-256-ctr', key, iv);
+    case 'DiffieHellman':
+      return crypto.createDiffieHellman(dhPrime);
+    case 'DiffieHellmanGroup':
+      return crypto.getDiffieHellman('modp14');
+    case 'ECDH':
+      return crypto.createECDH('prime256v1');
+    case 'Hash':
+      return crypto.createHash('sha256');
+    case 'Hmac':
+      return crypto.createHmac('sha256', key);
+    case 'KeyObject':
+      return crypto.createSecretKey(key);
+    case 'Sign':
+      return crypto.createSign('sha256');
+    case 'Verify':
+      return crypto.createVerify('sha256');
+    case 'CryptoKey':
+      return keyObject.toCryptoKey(hmacAlgorithm, true, keyUsages);
+    case 'X509Certificate':
+      return new crypto.X509Certificate(certificate);
+    default:
+      throw new Error(`Unsupported class: ${type}`);
+  }
+}
+
+function main({ type, n }) {
+  const instances = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    instances[i] = construct(type);
+  bench.end(n);
+
+  assert.strictEqual(typeof instances[n - 1], 'object');
+}
diff --git a/benchmark/crypto/class-methods.js b/benchmark/crypto/class-methods.js
new file mode 100644
index 000000000000..9db499b7d1a9
--- /dev/null
+++ b/benchmark/crypto/class-methods.js
@@ -0,0 +1,206 @@
+'use strict';
+
+const common = require('../common.js');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const fixtureDir = path.resolve(__dirname, '../../test/fixtures/keys');
+const certificate = fs.readFileSync(path.join(fixtureDir, 'agent1-cert.pem'));
+const key = Buffer.alloc(32, 0x01);
+const hmacAlgorithm = { name: 'HMAC', hash: 'SHA-256' };
+const keyUsages = ['sign'];
+const iv = Buffer.alloc(16, 0x02);
+const input = Buffer.alloc(16, 0x03);
+
+const iterations = {
+  'Cipheriv-update': 1e6,
+  'Decipheriv-update': 1e6,
+  'DiffieHellman-getGenerator': 2e5,
+  'DiffieHellmanGroup-getGenerator': 2e6,
+  'ECDH-getPrivateKey': 2e6,
+  'Hash-update': 5e6,
+  'Hmac-update': 5e6,
+  'KeyObject-equals': 2e6,
+  'KeyObject-symmetricKeySize-first': 1e5,
+  'KeyObject-type-first': 1e5,
+  'KeyObject-type': 1e8,
+  'Sign-update': 5e6,
+  'Verify-update': 5e6,
+  'CryptoKey-toKeyObject': 2e5,
+  'CryptoKey-algorithm-first': 1e5,
+  'CryptoKey-extractable-first': 1e5,
+  'CryptoKey-type-first': 1e5,
+  'CryptoKey-usages-first': 1e5,
+  'CryptoKey-type': 1e8,
+  'X509Certificate-checkHost': 1e6,
+  'X509Certificate-publicKey-first': 5e3,
+  'X509Certificate-publicKey': 1e8,
+  'X509Certificate-subject-first': 5e3,
+  'X509Certificate-subject': 1e8,
+};
+
+const bench = common.createBenchmark(main, {
+  operation: Object.keys(iterations),
+  n: [...new Set(Object.values(iterations))],
+}, {
+  combinationFilter({ operation, n }) {
+    // Benchmark test mode reduces numeric options to 1.
+    return n === 1 || iterations[operation] === n;
+  },
+});
+
+function setup(operation) {
+  switch (operation) {
+    case 'Cipheriv-update': {
+      const cipher = crypto.createCipheriv('aes-256-ctr', key, iv);
+      return {
+        run: () => cipher.update(input),
+        finish: () => cipher.final(),
+      };
+    }
+    case 'Decipheriv-update': {
+      const decipher = crypto.createDecipheriv('aes-256-ctr', key, iv);
+      return {
+        run: () => decipher.update(input),
+        finish: () => decipher.final(),
+      };
+    }
+    case 'DiffieHellman-getGenerator': {
+      const dh = crypto.createDiffieHellman(
+        crypto.getDiffieHellman('modp14').getPrime());
+      return { run: () => dh.getGenerator() };
+    }
+    case 'DiffieHellmanGroup-getGenerator': {
+      const dh = crypto.getDiffieHellman('modp14');
+      return { run: () => dh.getGenerator() };
+    }
+    case 'ECDH-getPrivateKey': {
+      const ecdh = crypto.createECDH('prime256v1');
+      ecdh.generateKeys();
+      return { run: () => ecdh.getPrivateKey() };
+    }
+    case 'Hash-update': {
+      const hash = crypto.createHash('sha256');
+      return {
+        run: () => hash.update(input),
+        finish: () => hash.digest(),
+      };
+    }
+    case 'Hmac-update': {
+      const hmac = crypto.createHmac('sha256', key);
+      return {
+        run: () => hmac.update(input),
+        finish: () => hmac.digest(),
+      };
+    }
+    case 'KeyObject-equals': {
+      const keyObject = crypto.createSecretKey(key);
+      return { run: () => keyObject.equals(keyObject) };
+    }
+    case 'KeyObject-symmetricKeySize-first': {
+      return { run: () => crypto.createSecretKey(key).symmetricKeySize };
+    }
+    case 'KeyObject-type-first': {
+      return { run: () => crypto.createSecretKey(key).type };
+    }
+    case 'KeyObject-type': {
+      const keyObjects = Array.from(
+        { length: 64 }, () => crypto.createSecretKey(key));
+      for (const keyObject of keyObjects) {
+        if (keyObject.type !== 'secret')
+          throw new Error('Unexpected KeyObject type');
+      }
+      let index = 0;
+      return { run: () => keyObjects[index++ & 63].type };
+    }
+    case 'Sign-update': {
+      const sign = crypto.createSign('sha256');
+      return { run: () => sign.update(input) };
+    }
+    case 'Verify-update': {
+      const verify = crypto.createVerify('sha256');
+      return { run: () => verify.update(input) };
+    }
+    case 'CryptoKey-toKeyObject': {
+      const keyObject = crypto.createSecretKey(key);
+      const cryptoKey = keyObject.toCryptoKey(
+        hmacAlgorithm, true, keyUsages);
+      return { run: () => crypto.KeyObject.from(cryptoKey) };
+    }
+    case 'CryptoKey-algorithm-first':
+    case 'CryptoKey-extractable-first':
+    case 'CryptoKey-type-first':
+    case 'CryptoKey-usages-first': {
+      const keyObject = crypto.createSecretKey(key);
+      const property = operation.slice('CryptoKey-'.length, -'-first'.length);
+      return {
+        run: () => keyObject.toCryptoKey(
+          hmacAlgorithm, true, keyUsages)[property],
+      };
+    }
+    case 'CryptoKey-type': {
+      const keyObject = crypto.createSecretKey(key);
+      const cryptoKeys = Array.from(
+        { length: 64 },
+        () => keyObject.toCryptoKey(hmacAlgorithm, true, keyUsages));
+      for (const cryptoKey of cryptoKeys) {
+        if (cryptoKey.type !== 'secret')
+          throw new Error('Unexpected CryptoKey type');
+      }
+      let index = 0;
+      return { run: () => cryptoKeys[index++ & 63].type };
+    }
+    case 'X509Certificate-checkHost': {
+      const x509 = new crypto.X509Certificate(certificate);
+      return { run: () => x509.checkHost('agent1') };
+    }
+    case 'X509Certificate-publicKey-first': {
+      return {
+        run: () => new crypto.X509Certificate(certificate).publicKey,
+      };
+    }
+    case 'X509Certificate-publicKey': {
+      const certificates = Array.from(
+        { length: 64 }, () => new crypto.X509Certificate(certificate));
+      for (const x509 of certificates) {
+        if (x509.publicKey === undefined)
+          throw new Error('Missing certificate public key');
+      }
+      let index = 0;
+      return { run: () => certificates[index++ & 63].publicKey };
+    }
+    case 'X509Certificate-subject-first': {
+      return {
+        run: () => new crypto.X509Certificate(certificate).subject,
+      };
+    }
+    case 'X509Certificate-subject': {
+      const certificates = Array.from(
+        { length: 64 }, () => new crypto.X509Certificate(certificate));
+      for (const x509 of certificates) {
+        if (x509.subject === undefined)
+          throw new Error('Missing certificate subject');
+      }
+      let index = 0;
+      return { run: () => certificates[index++ & 63].subject };
+    }
+    default:
+      throw new Error(`Unsupported operation: ${operation}`);
+  }
+}
+
+function main({ operation, n }) {
+  const state = setup(operation);
+  let result;
+
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = state.run();
+  bench.end(n);
+
+  if (state.finish)
+    state.finish();
+  if (result === state)
+    throw new Error('Unexpected benchmark result');
+}
diff --git a/benchmark/crypto/create-cipheriv.js b/benchmark/crypto/create-cipheriv.js
new file mode 100644
index 000000000000..7774e393b403
--- /dev/null
+++ b/benchmark/crypto/create-cipheriv.js
@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+  getCiphers,
+} = require('node:crypto');
+
+const configurations = {
+  'aes-128-cbc': { keyLength: 16, ivLength: 16 },
+  'aes-128-gcm': { keyLength: 16, ivLength: 12 },
+  'aes-128-cbc-cts': { keyLength: 16, ivLength: 16 },
+  'aes-128-wrap-inv': { keyLength: 16, ivLength: 8 },
+  'aes128-wrap-inv': {
+    keyLength: 16,
+    ivLength: 8,
+    warmupCipher: 'aes-128-wrap-inv',
+  },
+};
+
+const ciphers = ['aes-128-cbc', 'aes-128-gcm'];
+const availableCiphers = new Set(getCiphers());
+for (const cipher of [
+  'aes-128-cbc-cts',
+  'aes-128-wrap-inv',
+  'aes128-wrap-inv',
+]) {
+  if (availableCiphers.has(cipher)) {
+    ciphers.push(cipher);
+  }
+}
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  cipher: ciphers,
+  operation: ['encrypt', 'decrypt'],
+});
+
+function main({ n, cipher, operation }) {
+  const {
+    keyLength,
+    ivLength,
+    warmupCipher = cipher,
+  } = configurations[cipher];
+  const key = Buffer.alloc(keyLength);
+  const iv = Buffer.alloc(ivLength);
+  const results = new Array(n);
+  const method = operation === 'encrypt' ? createCipheriv : createDecipheriv;
+
+  const warmup = method(warmupCipher, key, iv);
+  assert.strictEqual(typeof warmup, 'object');
+
+  bench.start();
+  for (let i = 0; i < n; ++i) {
+    results[i] = method(cipher, key, iv);
+  }
+  bench.end(n);
+
+  assert.strictEqual(typeof results[n - 1], 'object');
+}
diff --git a/benchmark/crypto/create-keyobject.js b/benchmark/crypto/create-keyobject.js
index 7cd6db2d567a..df95ad393234 100644
--- a/benchmark/crypto/create-keyobject.js
+++ b/benchmark/crypto/create-keyobject.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -26,7 +26,7 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private_seed_only');
 }
 
diff --git a/benchmark/crypto/ec-jwk-export.js b/benchmark/crypto/ec-jwk-export.js
new file mode 100644
index 000000000000..0539fc6468a0
--- /dev/null
+++ b/benchmark/crypto/ec-jwk-export.js
@@ -0,0 +1,19 @@
+'use strict';
+
+const common = require('../common.js');
+const { generateKeyPairSync } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  namedCurve: ['prime256v1', 'secp384r1', 'secp521r1', 'secp256k1'],
+  type: ['public', 'private'],
+  n: [10000],
+});
+
+function main({ namedCurve, type, n }) {
+  const key = generateKeyPairSync('ec', { namedCurve })[`${type}Key`];
+  const options = { format: 'jwk' };
+  bench.start();
+  for (let index = 0; index < n; index++)
+    key.export(options);
+  bench.end(n);
+}
diff --git a/benchmark/crypto/ec-key-details.js b/benchmark/crypto/ec-key-details.js
new file mode 100644
index 000000000000..e7266e9ad19b
--- /dev/null
+++ b/benchmark/crypto/ec-key-details.js
@@ -0,0 +1,23 @@
+'use strict';
+
+const common = require('../common.js');
+const { KeyObject } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  namedCurve: ['P-256', 'P-384', 'P-521'],
+  type: ['public', 'private'],
+  n: [10000],
+});
+
+async function main({ namedCurve, type, n }) {
+  const pair = await crypto.subtle.generateKey({
+    name: 'ECDSA', namedCurve,
+  }, true, ['sign', 'verify']);
+  const cryptoKey = pair[`${type}Key`];
+  bench.start();
+  for (let index = 0; index < n; index++) {
+    if (!KeyObject.from(cryptoKey).asymmetricKeyDetails.namedCurve)
+      throw new Error('Missing named curve');
+  }
+  bench.end(n);
+}
diff --git a/benchmark/crypto/ec-raw-export.js b/benchmark/crypto/ec-raw-export.js
new file mode 100644
index 000000000000..15c1d9333bb4
--- /dev/null
+++ b/benchmark/crypto/ec-raw-export.js
@@ -0,0 +1,23 @@
+'use strict';
+
+const common = require('../common.js');
+const { generateKeyPairSync } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  namedCurve: ['prime256v1', 'secp384r1', 'secp521r1'],
+  format: ['raw-private', 'raw-public'],
+  type: ['uncompressed', 'compressed'],
+  n: [10000],
+}, {
+  combinationFilter: ({ format, type }) => format === 'raw-public' || type === 'uncompressed',
+});
+
+function main({ namedCurve, format, type, n }) {
+  const pair = generateKeyPairSync('ec', { namedCurve });
+  const key = format === 'raw-private' ? pair.privateKey : pair.publicKey;
+  const options = format === 'raw-public' ? { format, type } : { format };
+  bench.start();
+  for (let index = 0; index < n; index++)
+    key.export(options);
+  bench.end(n);
+}
diff --git a/benchmark/crypto/ecdh-compute-secret.js b/benchmark/crypto/ecdh-compute-secret.js
new file mode 100644
index 000000000000..3061c5b2cc36
--- /dev/null
+++ b/benchmark/crypto/ecdh-compute-secret.js
@@ -0,0 +1,117 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+
+const kCurve = 'prime256v1';
+const kPeerPoolSize = 32;
+const scenarios = [
+  'first-after-generate',
+  'full-lifecycle',
+  'reused-local-same-peer',
+  'reused-local-peer-pool',
+];
+
+const bench = common.createBenchmark(main, {
+  scenario: scenarios,
+  n: [5_000],
+}, {
+  test: { scenario: 'first-after-generate', n: 1 },
+});
+
+function generateContext() {
+  const context = crypto.createECDH(kCurve);
+  context.generateKeys();
+  return context;
+}
+
+function verifySecret(secret, local, peer) {
+  assert.deepStrictEqual(secret, peer.computeSecret(local.getPublicKey()));
+}
+
+function firstAfterGenerate(n) {
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  const warmup = generateContext();
+  warmup.computeSecret(peerPublicKey);
+
+  const locals = Array.from({ length: n }, generateContext);
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = locals[i].computeSecret(peerPublicKey);
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], locals[n - 1], peer);
+}
+
+function fullLifecycle(n) {
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  const warmup = generateContext();
+  warmup.computeSecret(peerPublicKey);
+
+  const locals = new Array(n);
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    const local = locals[i] = generateContext();
+    secrets[i] = local.computeSecret(peerPublicKey);
+  }
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], locals[n - 1], peer);
+}
+
+function reusedLocalSamePeer(n) {
+  const local = generateContext();
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  local.computeSecret(peerPublicKey);
+
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = local.computeSecret(peerPublicKey);
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], local, peer);
+}
+
+function reusedLocalPeerPool(n) {
+  const local = generateContext();
+  const peers = Array.from(
+    { length: Math.min(n, kPeerPoolSize) },
+    generateContext);
+  const peerPublicKeys = peers.map((peer) => peer.getPublicKey());
+  local.computeSecret(peerPublicKeys[0]);
+
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = local.computeSecret(peerPublicKeys[i % peers.length]);
+  bench.end(n);
+
+  const lastPeer = peers[(n - 1) % peers.length];
+  verifySecret(secrets[n - 1], local, lastPeer);
+}
+
+function main({ scenario, n }) {
+  switch (scenario) {
+    case 'first-after-generate':
+      return firstAfterGenerate(n);
+    case 'full-lifecycle':
+      return fullLifecycle(n);
+    case 'reused-local-same-peer':
+      return reusedLocalSamePeer(n);
+    case 'reused-local-peer-pool':
+      return reusedLocalPeerPool(n);
+    default:
+      throw new Error(`Unsupported scenario: ${scenario}`);
+  }
+}
diff --git a/benchmark/crypto/kem.js b/benchmark/crypto/kem.js
index a544fc2124af..34374dfc8494 100644
--- a/benchmark/crypto/kem.js
+++ b/benchmark/crypto/kem.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -24,7 +24,7 @@ if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-kem-512'] = readKeyPair('ml_kem_512_public', 'ml_kem_512_private');
   keyFixtures['ml-kem-768'] = readKeyPair('ml_kem_768_public', 'ml_kem_768_private');
   keyFixtures['ml-kem-1024'] = readKeyPair('ml_kem_1024_public', 'ml_kem_1024_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-kem-768'] = readKeyPair('ml_kem_768_public', 'ml_kem_768_private_seed_only');
   keyFixtures['ml-kem-1024'] = readKeyPair('ml_kem_1024_public', 'ml_kem_1024_private_seed_only');
 }
@@ -45,7 +45,8 @@ if (Object.keys(keyFixtures).length === 0) {
 }
 
 const bench = common.createBenchmark(main, {
-  keyType: Object.keys(keyFixtures),
+  // Keep one size per family by default; other fixtures remain available via keyType.
+  keyType: ['rsa', 'p-256', 'x25519', 'ml-kem-768'].filter((type) => keyFixtures[type]),
   mode: ['sync', 'async', 'async-parallel'],
   keyFormat: ['keyObject', 'keyObject.unique', 'pem', 'der', 'jwk',
               'raw-public', 'raw-private', 'raw-seed'],
@@ -57,6 +58,9 @@ const bench = common.createBenchmark(main, {
     // assess whether mutexes over the key material impact the operation
     if (p.keyFormat === 'keyObject.unique')
       return p.mode === 'async-parallel';
+    // Compare execution modes with pre-imported keys; measure parsing synchronously.
+    if (p.mode !== 'sync' && p.keyFormat !== 'keyObject')
+      return false;
     // raw-public is only supported for encapsulate, not rsa
     if (p.keyFormat === 'raw-public')
       return p.keyType !== 'rsa' && p.op === 'encapsulate';
@@ -127,7 +131,8 @@ function main({ n, mode, keyFormat, keyType, op }) {
     keyFixtures[keyType].publicKey :
     keyFixtures[keyType].privateKey;
   const createKeyFn = isEncapsulate ? crypto.createPublicKey : crypto.createPrivateKey;
-  const pems = [...Buffer.alloc(n)].map(() => pemSource);
+  const count = keyFormat === 'keyObject.unique' ? n : 1;
+  const pems = Array(count).fill(pemSource);
   const keyObjects = pems.map(createKeyFn);
 
   // Warm up OpenSSL's provider operation cache for each key object
diff --git a/benchmark/crypto/keyobject-serialization.js b/benchmark/crypto/keyobject-serialization.js
new file mode 100644
index 000000000000..76cd6cb3387c
--- /dev/null
+++ b/benchmark/crypto/keyobject-serialization.js
@@ -0,0 +1,79 @@
+'use strict';
+
+const common = require('../common.js');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../../test/common/crypto.js');
+const fixtures = require('../../test/common/fixtures.js');
+const { createPrivateKey, createPublicKey } = require('crypto');
+
+const keys = {
+  'rsa': 'rsa_private_2048',
+  'rsa-pss': 'rsa_pss_private_2048',
+  'p-256': 'ec_p256_private',
+  'p-384': 'ec_p384_private',
+  'p-521': 'ec_p521_private',
+  'ed25519': 'ed25519_private',
+  'x25519': 'x25519_private',
+};
+if (!isBoringSSL) {
+  keys.ed448 = 'ed448_private';
+  keys.x448 = 'x448_private';
+  if (!hasFIPS()) keys['rsa-multiprime'] = 'rsa_private_2048_3_primes';
+}
+if (hasOpenSSL(3, 5) || isBoringSSL) {
+  keys['ml-dsa-44'] = 'ml_dsa_44_private_seed_only';
+  keys['ml-dsa-87'] = 'ml_dsa_87_private_seed_only';
+  keys['ml-kem-768'] = 'ml_kem_768_private_seed_only';
+  keys['ml-kem-1024'] = 'ml_kem_1024_private_seed_only';
+}
+if (hasOpenSSL(3, 5)) {
+  keys['slh-dsa-sha2-128s'] = 'slh_dsa_sha2_128s_private';
+  keys['slh-dsa-shake-256s'] = 'slh_dsa_shake_256s_private';
+}
+
+const bench = common.createBenchmark(main, {
+  // Keep one size per family by default; other fixtures remain available via keyType.
+  keyType: ['rsa', 'rsa-pss', 'p-256', 'ed25519', 'x25519',
+            'ml-dsa-44', 'ml-kem-768', 'slh-dsa-sha2-128s'].filter((type) => keys[type]),
+  operation: ['import', 'export'],
+  // PEM can be selected with format=pem; DER covers ASN.1 encoding by default.
+  format: ['jwk', 'der', 'raw-public', 'raw-private', 'raw-seed'],
+  type: ['public', 'private'],
+  n: [1e4],
+}, {
+  combinationFilter({ keyType, format, type }) {
+    if (format === 'jwk') return keyType !== 'rsa-pss';
+    if (!format.startsWith('raw-')) return true;
+    if (keyType.startsWith('rsa')) return false;
+    if (format === 'raw-public') return type === 'public';
+    if (format === 'raw-private') return type === 'private' && !keyType.startsWith('ml-');
+    return type === 'private' && keyType.startsWith('ml-');
+  },
+});
+
+function main({ keyType, operation, format, type, n }) {
+  const privateKey = createPrivateKey(fixtures.readKey(`${keys[keyType]}.pem`));
+  const key = type === 'private' ? privateKey : createPublicKey(privateKey);
+  const options = { format };
+  if (format === 'pem' || format === 'der') {
+    options.type = type === 'private' ? 'pkcs8' : 'spki';
+  }
+  let run;
+  if (operation === 'export') {
+    run = () => key.export(options);
+  } else {
+    const input = { ...options, key: key.export(options) };
+    if (format.startsWith('raw-')) {
+      input.asymmetricKeyType = key.asymmetricKeyType;
+      if (input.asymmetricKeyType === 'ec') {
+        input.namedCurve = key.asymmetricKeyDetails.namedCurve;
+      }
+    }
+    const importKey = type === 'private' ? createPrivateKey : createPublicKey;
+    run = () => importKey(input);
+  }
+  // Resolve provider operations and warm the JS path before timing.
+  for (let i = 0; i < 100; i++) run();
+  bench.start();
+  for (let i = 0; i < n; i++) run();
+  bench.end(n);
+}
diff --git a/benchmark/crypto/mac.js b/benchmark/crypto/mac.js
new file mode 100644
index 000000000000..ea9d3a56e59f
--- /dev/null
+++ b/benchmark/crypto/mac.js
@@ -0,0 +1,254 @@
+'use strict';
+
+const common = require('../common.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
+const assert = require('node:assert');
+const {
+  createHmac,
+  createMac,
+  getMacs,
+} = require('node:crypto');
+
+if (!hasOpenSSL(3) ||
+    isBoringSSL ||
+    typeof createMac !== 'function' ||
+    typeof getMacs !== 'function') {
+  console.log('Skipping: generic MAC API requires OpenSSL >= 3');
+  process.exit(0);
+}
+
+const operations = [
+  'get-macs-cold',
+  'get-macs-warm',
+  'create-cold',
+  'create-warm',
+  'hmac-lifecycle',
+  'mac-lifecycle',
+  'mac-stream-lifecycle',
+  'update',
+  'stream',
+  'final-buffer',
+  'final-hex',
+];
+const configurations = {
+  'hmac-sha256': {
+    algorithm: 'HMAC',
+    key: Buffer.alloc(32, 0x42),
+    options: { digest: 'SHA256' },
+  },
+  'kmac-128': {
+    algorithm: 'KMAC-128',
+    key: Buffer.alloc(32, 0x42),
+    options: { outputLength: 32 },
+  },
+};
+
+const bench = common.createBenchmark(main, {
+  operation: operations,
+  algorithm: Object.keys(configurations),
+  length: [0, 64, 4096],
+  n: [1, 10_000, 20_000, 500_000],
+}, {
+  combinationFilter({ operation, algorithm, length, n }) {
+    if (operation === 'get-macs-cold') {
+      return algorithm === 'hmac-sha256' && length === 0 && n === 1;
+    }
+    if (operation === 'get-macs-warm') {
+      return algorithm === 'hmac-sha256' && length === 0 && n === 500_000;
+    }
+    if (operation === 'create-cold')
+      return length === 0 && n === 1;
+    if (operation === 'create-warm')
+      return length === 0 && n === 20_000;
+    if (operation === 'hmac-lifecycle') {
+      return algorithm === 'hmac-sha256' && n === 10_000;
+    }
+    if (operation === 'mac-lifecycle' ||
+        operation === 'mac-stream-lifecycle') {
+      return n === 10_000;
+    }
+    if (operation === 'update' || operation === 'stream') {
+      return length === 64 && n === 500_000;
+    }
+    if (operation === 'final-buffer' || operation === 'final-hex') {
+      return algorithm === 'hmac-sha256' &&
+             length === 64 &&
+             n === 20_000;
+    }
+    return false;
+  },
+  test: {
+    operation: ['create-cold'],
+    algorithm: ['hmac-sha256'],
+    length: [0],
+    n: [1],
+  },
+});
+
+function main({ operation, algorithm, length, n }) {
+  const configuration = configurations[algorithm];
+  const data = Buffer.alloc(length, 0x61);
+
+  switch (operation) {
+    case 'get-macs-cold':
+      measureGetMacs(n, false);
+      break;
+    case 'get-macs-warm':
+      measureGetMacs(n, true);
+      break;
+    case 'create-cold':
+      measureCreate(configuration, n, false);
+      break;
+    case 'create-warm':
+      measureCreate(configuration, n, true);
+      break;
+    case 'hmac-lifecycle':
+      measureHmacLifecycle(configuration, data, n);
+      break;
+    case 'mac-lifecycle':
+      measureMacLifecycle(configuration, data, n);
+      break;
+    case 'mac-stream-lifecycle':
+      measureMacStreamLifecycle(configuration, data, n);
+      break;
+    case 'update':
+      measureUpdate(configuration, data, n);
+      break;
+    case 'stream':
+      measureStream(configuration, data, n);
+      break;
+    case 'final-buffer':
+      measureFinal(configuration, data, n);
+      break;
+    case 'final-hex':
+      measureFinal(configuration, data, n, 'hex');
+      break;
+    default:
+      throw new Error(`unknown operation: ${operation}`);
+  }
+}
+
+function measureGetMacs(n, warm) {
+  if (warm)
+    getMacs();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = getMacs();
+  bench.end(n);
+
+  assert(Array.isArray(result));
+}
+
+function measureCreate({ algorithm, key, options }, n, warm) {
+  if (warm)
+    createMac(algorithm, key, options).final();
+
+  const contexts = new Array(n);
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    contexts[i] = createMac(algorithm, key, options);
+  bench.end(n);
+
+  assert.strictEqual(typeof contexts[n - 1], 'object');
+}
+
+function measureHmacLifecycle({ key, options }, data, n) {
+  createHmac(options.digest, key).update(data).digest();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = createHmac(options.digest, key).update(data).digest();
+  bench.end(n);
+
+  assert(Buffer.isBuffer(result));
+}
+
+function measureMacLifecycle({ algorithm, key, options }, data, n) {
+  createMac(algorithm, key, options).update(data).final();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    result = createMac(algorithm, key, options).update(data).final();
+  bench.end(n);
+
+  assert(Buffer.isBuffer(result));
+}
+
+function measureMacStreamLifecycle({ algorithm, key, options }, data, n) {
+  const warmup = createMac(algorithm, key, options);
+  warmup.end(data);
+  warmup.read();
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; ++i) {
+    const context = createMac(algorithm, key, options);
+    context.end(data);
+    result = context.read();
+  }
+  bench.end(n);
+
+  assert(Buffer.isBuffer(result));
+}
+
+function measureUpdate({ algorithm, key, options }, data, n) {
+  const warmup = createMac(algorithm, key, options);
+  warmup.update(data).final();
+
+  const context = createMac(algorithm, key, options);
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    context.update(data);
+  bench.end(n);
+
+  assert(Buffer.isBuffer(context.final()));
+}
+
+function measureStream({ algorithm, key, options }, data, n) {
+  const warmup = createMac(algorithm, key, options);
+  warmup.end(data);
+  warmup.read();
+
+  const context = createMac(algorithm, key, options);
+  bench.start();
+  for (let i = 0; i < n; ++i)
+    context.write(data);
+  bench.end(n);
+
+  context.end();
+  assert(Buffer.isBuffer(context.read()));
+}
+
+function measureFinal({ algorithm, key, options }, data, n, encoding) {
+  const warmup = createMac(algorithm, key, options).update(data);
+  if (encoding === undefined)
+    warmup.final();
+  else
+    warmup.final(encoding);
+
+  const contexts = new Array(n);
+  for (let i = 0; i < n; ++i)
+    contexts[i] = createMac(algorithm, key, options).update(data);
+
+  let result;
+  if (encoding === undefined) {
+    bench.start();
+    for (let i = 0; i < n; ++i)
+      result = contexts[i].final();
+    bench.end(n);
+  } else {
+    bench.start();
+    for (let i = 0; i < n; ++i)
+      result = contexts[i].final(encoding);
+    bench.end(n);
+  }
+
+  if (encoding === undefined)
+    assert(Buffer.isBuffer(result));
+  else
+    assert.strictEqual(typeof result, 'string');
+}
diff --git a/benchmark/crypto/oneshot-sign.js b/benchmark/crypto/oneshot-sign.js
index 72e3726d9a53..d2a8bab446d1 100644
--- a/benchmark/crypto/oneshot-sign.js
+++ b/benchmark/crypto/oneshot-sign.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -19,15 +19,12 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKey('ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKey('ml_dsa_44_private_seed_only');
 }
 
 const data = crypto.randomBytes(256);
 
-let pems;
-let keyObjects;
-
 const bench = common.createBenchmark(main, {
   keyType: Object.keys(keyFixtures),
   mode: ['sync', 'async', 'async-parallel'],
@@ -39,6 +36,9 @@ const bench = common.createBenchmark(main, {
     // assess whether mutexes over the key material impact the operation
     if (p.keyFormat === 'keyObject.unique')
       return p.mode === 'async-parallel';
+    // Compare execution modes with pre-imported keys; measure parsing synchronously.
+    if (p.mode !== 'sync' && p.keyFormat !== 'keyObject')
+      return false;
     // raw-private is not supported for rsa and ml-dsa
     if (p.keyFormat === 'raw-private')
       return p.keyType !== 'rsa' && !p.keyType.startsWith('ml-');
@@ -97,8 +97,9 @@ function measureAsyncParallel(n, digest, privateKey, keys) {
 }
 
 function main({ n, mode, keyFormat, keyType }) {
-  pems ||= [...Buffer.alloc(n)].map(() => keyFixtures[keyType]);
-  keyObjects ||= pems.map(crypto.createPrivateKey);
+  const count = keyFormat === 'keyObject.unique' ? n : 1;
+  const pems = Array(count).fill(keyFixtures[keyType]);
+  const keyObjects = pems.map(crypto.createPrivateKey);
 
   // Warm up OpenSSL's provider operation cache for each key object
   for (const keyObject of keyObjects) {
diff --git a/benchmark/crypto/oneshot-verify.js b/benchmark/crypto/oneshot-verify.js
index 8b397b02dbf2..eb65d912877d 100644
--- a/benchmark/crypto/oneshot-verify.js
+++ b/benchmark/crypto/oneshot-verify.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -26,15 +26,12 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private_seed_only');
 }
 
 const data = crypto.randomBytes(256);
 
-let pems;
-let keyObjects;
-
 const bench = common.createBenchmark(main, {
   keyType: Object.keys(keyFixtures),
   mode: ['sync', 'async', 'async-parallel'],
@@ -46,6 +43,9 @@ const bench = common.createBenchmark(main, {
     // assess whether mutexes over the key material impact the operation
     if (p.keyFormat === 'keyObject.unique')
       return p.mode === 'async-parallel';
+    // Compare execution modes with pre-imported keys; measure parsing synchronously.
+    if (p.mode !== 'sync' && p.keyFormat !== 'keyObject')
+      return false;
     // raw-public is not supported by rsa
     if (p.keyFormat === 'raw-public')
       return p.keyType !== 'rsa';
@@ -104,8 +104,9 @@ function measureAsyncParallel(n, digest, signature, publicKey, keys) {
 }
 
 function main({ n, mode, keyFormat, keyType }) {
-  pems ||= [...Buffer.alloc(n)].map(() => keyFixtures[keyType].publicKey);
-  keyObjects ||= pems.map(crypto.createPublicKey);
+  const count = keyFormat === 'keyObject.unique' ? n : 1;
+  const pems = Array(count).fill(keyFixtures[keyType].publicKey);
+  const keyObjects = pems.map(crypto.createPublicKey);
 
   // Warm up OpenSSL's provider operation cache for each key object
   const warmupDigest = keyType === 'rsa' || keyType === 'ec' ? 'sha256' : null;
diff --git a/benchmark/crypto/prepare-asymmetric-key.js b/benchmark/crypto/prepare-asymmetric-key.js
new file mode 100644
index 000000000000..dd536c3f451c
--- /dev/null
+++ b/benchmark/crypto/prepare-asymmetric-key.js
@@ -0,0 +1,178 @@
+'use strict';
+
+const common = require('../common.js');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const { pathToFileURL } = require('node:url');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
+
+const inputs = [
+  'public-keyobject', 'public-keyobject-wrapped', 'public-pem-buffer-wrapped',
+  'private-keyobject', 'private-keyobject-wrapped',
+  'private-pem-string', 'private-pem-buffer', 'private-pem-arraybuffer',
+  'private-pem-string-wrapped', 'private-pem-buffer-wrapped', 'private-pem-arraybuffer-wrapped',
+  'private-jwk',
+  'public-der-pkcs1-bytes', 'private-der-pkcs1-bytes', 'private-pem-pkcs8-bytes',
+  'private-der-pkcs8-bytes', 'private-der-pkcs8-base64', 'private-der-pkcs8-hex',
+  'public-der-spki-bytes', 'private-der-sec1-bytes',
+  'raw-public-ec-buffer', 'raw-public-ed25519-buffer',
+  'raw-private-ec-buffer', 'raw-private-ec-arraybuffer', 'raw-private-ed25519-buffer',
+  'pem-passphrase-absent', 'pem-passphrase-empty', 'pem-passphrase-string',
+  'pem-passphrase-base64', 'pem-passphrase-buffer', 'pem-passphrase-arraybuffer',
+  'file-passphrase-absent', 'file-passphrase-string', 'file-direct',
+  'provider-passphrase-absent', 'provider-passphrase-absent-properties',
+  'provider-passphrase-empty', 'provider-passphrase-string', 'provider-passphrase-base64',
+  'provider-passphrase-buffer', 'provider-passphrase-arraybuffer', 'provider-direct',
+];
+
+if (hasOpenSSL(3, 5) || isBoringSSL)
+  inputs.push('raw-seed-ml-dsa-44-buffer');
+
+const bench = common.createBenchmark(main, {
+  input: inputs,
+  context: ['consume-public', 'consume-private', 'create-public'],
+  n: [1e6],
+}, {
+  flags: ['--expose-internals'],
+  combinationFilter({ input, context }) {
+    if (input === 'private-keyobject' || input === 'private-keyobject-wrapped')
+      return true;
+    if (input.startsWith('public-') || input.startsWith('raw-public-'))
+      return context === 'consume-public';
+    return context === 'consume-private';
+  },
+});
+
+function main({ input, context, n }) {
+  const {
+    prepareAsymmetricKey,
+    kConsumePublic,
+    kConsumePrivate,
+    kCreatePublic,
+  } = require('internal/crypto/keys');
+  const ctx = {
+    'consume-public': kConsumePublic,
+    'consume-private': kConsumePrivate,
+    'create-public': kCreatePublic,
+  }[context];
+  const fixtureDir = path.resolve(__dirname, '../../test/fixtures/keys');
+  const privateKeyPath = path.join(fixtureDir, 'rsa_private_2048.pem');
+  const privateKey = crypto.createPrivateKey(fs.readFileSync(privateKeyPath));
+  const publicKey = crypto.createPublicKey(privateKey);
+  const pem = privateKey.export({ format: 'pem', type: 'pkcs8' });
+  const buffer = Buffer.from(pem);
+  const arraybuffer = Uint8Array.from(buffer).buffer;
+  const fileURL = pathToFileURL(privateKeyPath);
+  const providerURL = new URL('pkcs11:object=signing-key;type=private');
+  const passphrase = Buffer.from('password');
+
+  let key;
+  switch (input) {
+    case 'public-keyobject': key = publicKey; break;
+    case 'public-keyobject-wrapped': key = { key: publicKey }; break;
+    case 'public-pem-buffer-wrapped':
+      key = { key: Buffer.from(publicKey.export({ format: 'pem', type: 'spki' })) };
+      break;
+    case 'private-keyobject': key = privateKey; break;
+    case 'private-keyobject-wrapped': key = { key: privateKey }; break;
+    case 'private-pem-string': key = pem; break;
+    case 'private-pem-buffer': key = buffer; break;
+    case 'private-pem-arraybuffer': key = arraybuffer; break;
+    case 'private-pem-string-wrapped': key = { key: pem }; break;
+    case 'private-pem-buffer-wrapped': key = { key: buffer }; break;
+    case 'private-pem-arraybuffer-wrapped': key = { key: arraybuffer }; break;
+    case 'private-jwk': key = { key: privateKey.export({ format: 'jwk' }), format: 'jwk' }; break;
+    case 'public-der-pkcs1-bytes': key = { key: publicKey, format: 'der', type: 'pkcs1' }; break;
+    case 'private-der-pkcs1-bytes': key = { key: privateKey, format: 'der', type: 'pkcs1' }; break;
+    case 'private-pem-pkcs8-bytes': key = { key: privateKey, format: 'pem', type: 'pkcs8' }; break;
+    case 'private-der-pkcs8-bytes': key = { key: privateKey, format: 'der', type: 'pkcs8' }; break;
+    case 'private-der-pkcs8-base64':
+      key = { key: privateKey, format: 'der', type: 'pkcs8', encoding: 'base64' };
+      break;
+    case 'private-der-pkcs8-hex':
+      key = { key: privateKey, format: 'der', type: 'pkcs8', encoding: 'hex' };
+      break;
+    case 'public-der-spki-bytes': key = { key: publicKey, format: 'der', type: 'spki' }; break;
+    case 'private-der-sec1-bytes':
+      key = {
+        key: crypto.createPrivateKey(fs.readFileSync(path.join(fixtureDir, 'ec_p256_private.pem'))),
+        format: 'der', type: 'sec1',
+      };
+      break;
+    case 'raw-public-ec-buffer':
+    case 'raw-public-ed25519-buffer':
+    case 'raw-private-ec-buffer':
+    case 'raw-private-ec-arraybuffer':
+    case 'raw-private-ed25519-buffer': {
+      const asymmetricKeyType = input.includes('-ec-') ? 'ec' : 'ed25519';
+      const fixture = asymmetricKeyType === 'ec' ? 'ec_p256_private.pem' : 'ed25519_private.pem';
+      let rawKey = crypto.createPrivateKey(fs.readFileSync(path.join(fixtureDir, fixture)));
+      const format = input.startsWith('raw-public-') ? 'raw-public' : 'raw-private';
+      if (format === 'raw-public') rawKey = crypto.createPublicKey(rawKey);
+      const bytes = rawKey.export({ format });
+      key = {
+        key: input.endsWith('-arraybuffer') ? Uint8Array.from(bytes).buffer : bytes,
+        format,
+        asymmetricKeyType,
+        namedCurve: asymmetricKeyType === 'ec' ? 'prime256v1' : undefined,
+      };
+      break;
+    }
+    case 'raw-seed-ml-dsa-44-buffer': {
+      const seedKey = crypto.createPrivateKey(
+        fs.readFileSync(path.join(fixtureDir, 'ml_dsa_44_private_seed_only.pem')));
+      key = { key: seedKey.export({ format: 'raw-seed' }), format: 'raw-seed', asymmetricKeyType: 'ml-dsa-44' };
+      break;
+    }
+    case 'pem-passphrase-absent': key = { key: privateKey }; break;
+    case 'pem-passphrase-empty': key = { key: privateKey, passphrase: '' }; break;
+    case 'pem-passphrase-string': key = { key: privateKey, passphrase: 'password' }; break;
+    case 'pem-passphrase-base64':
+      key = { key: privateKey, passphrase: passphrase.toString('base64'), encoding: 'base64' };
+      break;
+    case 'pem-passphrase-buffer': key = { key: privateKey, passphrase }; break;
+    case 'pem-passphrase-arraybuffer':
+      key = { key: privateKey, passphrase: Uint8Array.from(passphrase).buffer };
+      break;
+    case 'file-passphrase-absent': key = { key: fileURL }; break;
+    case 'file-passphrase-string': key = { key: fileURL, passphrase: 'password' }; break;
+    case 'file-direct': key = fileURL; break;
+    case 'provider-passphrase-absent': key = { key: providerURL }; break;
+    case 'provider-passphrase-absent-properties': key = { key: providerURL, properties: 'provider=default' }; break;
+    case 'provider-passphrase-empty': key = { key: providerURL, passphrase: '' }; break;
+    case 'provider-passphrase-string': key = { key: providerURL, passphrase: 'password' }; break;
+    case 'provider-passphrase-base64':
+      key = { key: providerURL, passphrase: passphrase.toString('base64'), encoding: 'base64' };
+      break;
+    case 'provider-passphrase-buffer': key = { key: providerURL, passphrase }; break;
+    case 'provider-passphrase-arraybuffer':
+      key = { key: providerURL, passphrase: Uint8Array.from(passphrase).buffer };
+      break;
+    case 'provider-direct': key = providerURL; break;
+    default: throw new Error(`Unsupported input: ${input}`);
+  }
+
+  if (input.startsWith('pem-passphrase-')) {
+    const bytes = key.passphrase === undefined ? undefined :
+      typeof key.passphrase === 'string' ? Buffer.from(key.passphrase, key.encoding) :
+        Buffer.from(key.passphrase);
+    key = {
+      key: Buffer.from(privateKey.export({
+        format: 'pem', type: 'pkcs8',
+        ...(bytes === undefined ? {} : { cipher: 'aes-256-cbc', passphrase: bytes }),
+      })),
+      format: 'pem', type: 'pkcs8', passphrase: key.passphrase, encoding: key.encoding,
+    };
+  } else if (key.key instanceof crypto.KeyObject && key.format !== undefined) {
+    const bytes = Buffer.from(key.key.export({ format: key.format, type: key.type }));
+    key.key = key.encoding === undefined ? bytes : bytes.toString(key.encoding);
+  }
+
+  prepareAsymmetricKey(key, ctx);
+  bench.start();
+  for (let index = 0; index < n; index++) {
+    prepareAsymmetricKey(key, ctx);
+  }
+  bench.end(n);
+}
diff --git a/benchmark/crypto/rsa-key-details.js b/benchmark/crypto/rsa-key-details.js
new file mode 100644
index 000000000000..cb114226e30d
--- /dev/null
+++ b/benchmark/crypto/rsa-key-details.js
@@ -0,0 +1,26 @@
+'use strict';
+
+const common = require('../common.js');
+const { KeyObject } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  type: ['public', 'private'],
+  n: [10000],
+});
+
+async function main({ type, n }) {
+  const pair = await crypto.subtle.generateKey({
+    name: 'RSA-PSS',
+    modulusLength: 2048,
+    publicExponent: new Uint8Array([1, 0, 1]),
+    hash: 'SHA-256',
+  }, true, ['sign', 'verify']);
+  const cryptoKey = pair[`${type}Key`];
+  // Use a fresh KeyObject so each iteration retrieves uncached key details.
+  bench.start();
+  for (let index = 0; index < n; index++) {
+    if (KeyObject.from(cryptoKey).asymmetricKeyDetails.modulusLength !== 2048)
+      throw new Error('Unexpected modulus length');
+  }
+  bench.end(n);
+}
diff --git a/benchmark/crypto/rsa-pss-key-details.js b/benchmark/crypto/rsa-pss-key-details.js
new file mode 100644
index 000000000000..18cc8f92f458
--- /dev/null
+++ b/benchmark/crypto/rsa-pss-key-details.js
@@ -0,0 +1,35 @@
+'use strict';
+
+const common = require('../common.js');
+const { isBoringSSL } = require('../../test/common/crypto.js');
+const { createPublicKey, generateKeyPairSync } = require('crypto');
+
+if (isBoringSSL) {
+  console.log('Skipping: RSA-PSS key generation is not supported by BoringSSL');
+  process.exit(0);
+}
+
+const restrictions = {
+  absent: {},
+  defaults: { hashAlgorithm: 'sha1', mgf1HashAlgorithm: 'sha1', saltLength: 20 },
+  sha256: { hashAlgorithm: 'sha256', mgf1HashAlgorithm: 'sha256', saltLength: 32 },
+};
+
+const bench = common.createBenchmark(main, {
+  restrictions: Object.keys(restrictions),
+  n: [5000],
+});
+
+function main({ restrictions: name, n }) {
+  const { privateKey } = generateKeyPairSync('rsa-pss', {
+    modulusLength: 2048,
+    ...restrictions[name],
+  });
+  // Use a fresh KeyObject without decoding DER or reusing cached key details.
+  bench.start();
+  for (let index = 0; index < n; index++) {
+    if (createPublicKey(privateKey).asymmetricKeyDetails.modulusLength !== 2048)
+      throw new Error('Unexpected modulus length');
+  }
+  bench.end(n);
+}
diff --git a/benchmark/fs/bench-watch-recursive.js b/benchmark/fs/bench-watch-recursive.js
new file mode 100644
index 000000000000..45ed0871718e
--- /dev/null
+++ b/benchmark/fs/bench-watch-recursive.js
@@ -0,0 +1,23 @@
+'use strict';
+
+// Setting up (and tearing down) a recursive fs.watch() on a directory tree.
+// On Linux and other platforms without a native recursive watcher this is
+// implemented in JavaScript on top of per-directory watchers.
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+
+const bench = common.createBenchmark(main, {
+  n: [5],
+  dir: ['lib', 'test/fixtures'],
+});
+
+function main({ n, dir }) {
+  const fullPath = path.resolve(__dirname, '../../', dir);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    fs.watch(fullPath, { recursive: true }).close();
+  }
+  bench.end(n);
+}
diff --git a/benchmark/http2/full-duplex.js b/benchmark/http2/full-duplex.js
new file mode 100644
index 000000000000..d2fec719f95a
--- /dev/null
+++ b/benchmark/http2/full-duplex.js
@@ -0,0 +1,71 @@
+'use strict';
+
+const common = require('../common.js');
+const fixtures = require('../../test/common/fixtures');
+
+const bench = common.createBenchmark(main, {
+  n: [100],
+  streams: [2],
+  size: [4 * 1024 * 1024],
+  // Use the HTTP/2 protocol default.
+  window: [65535],
+}, {
+  test: { size: 128 * 1024, window: 65535 },
+});
+
+function main({ n, streams, size, window }) {
+  const http2 = require('http2');
+  const payload = Buffer.alloc(size);
+  const server = http2.createSecureServer({
+    key: fixtures.readKey('agent1-key.pem'),
+    cert: fixtures.readKey('agent1-cert.pem'),
+    settings: { initialWindowSize: window },
+  });
+
+  let completed = 0;
+  let batches = 0;
+
+  function onTransferComplete() {
+    if (++completed !== streams * 2)
+      return;
+
+    if (++batches === n) {
+      // Report combined upload and download throughput in MiB/s.
+      bench.end(n * streams * size * 2 / (1024 * 1024));
+      client.close();
+      server.close();
+      return;
+    }
+
+    startBatch();
+  }
+
+  server.on('stream', (stream) => {
+    stream.resume();
+    stream.on('end', onTransferComplete);
+    stream.respond();
+    stream.end(payload);
+  });
+
+  let client;
+  function startBatch() {
+    completed = 0;
+    for (let i = 0; i < streams; i++) {
+      const request = client.request({ ':method': 'POST' });
+      request.resume();
+      request.on('end', onTransferComplete);
+      request.end(payload);
+    }
+  }
+
+  server.listen(0, () => {
+    client = http2.connect(`https://localhost:${server.address().port}`, {
+      rejectUnauthorized: false,
+      settings: { initialWindowSize: window },
+    });
+    client.on('connect', () => {
+      bench.start();
+      startBatch();
+    });
+  });
+}
diff --git a/benchmark/module/module-require-source-map.js b/benchmark/module/module-require-source-map.js
new file mode 100644
index 000000000000..8353ab39fc82
--- /dev/null
+++ b/benchmark/module/module-require-source-map.js
@@ -0,0 +1,77 @@
+'use strict';
+
+// Loading modules that carry source maps, with source map support enabled.
+// This is the cost paid at startup by applications bundled or transpiled with
+// source maps; the maps are only consulted if a stack trace is generated.
+
+const fs = require('fs');
+const path = require('path');
+const common = require('../common.js');
+const tmpdir = require('../../test/common/tmpdir');
+const benchmarkDirectory = tmpdir.resolve('nodejs-benchmark-module-source-map');
+
+const bench = common.createBenchmark(main, {
+  sourceMap: ['none', 'inline', 'external'],
+  n: [1000],
+}, {
+  setup(configs) {
+    tmpdir.refresh();
+    const maxN = configs.reduce((max, c) => Math.max(max, c.n), 0);
+    createModules(maxN);
+  },
+});
+
+function moduleSource(i) {
+  const methods = [];
+  for (let m = 0; m < 40; m++) {
+    methods.push(`  method${m}(input) { return [].concat(input).map((item) => ({ item, m: ${m}, service: ${i} })); }`);
+  }
+  return `'use strict';
+class Service${i} {
+  constructor(options = {}) { this.options = { retries: 3, ...options }; }
+${methods.join('\n')}
+}
+function helper${i}(list) { return list.filter(Boolean).slice(0, ${i % 7}); }
+module.exports = { Service${i}, helper${i} };
+`;
+}
+
+function sourceMapFor(i, source) {
+  return JSON.stringify({
+    version: 3,
+    file: `${i}.js`,
+    sources: [`../src/${i}.ts`],
+    sourcesContent: [source],
+    names: [],
+    mappings: 'AAAA;' + 'AACA,MAAM;'.repeat(44),
+  });
+}
+
+function createModules(n) {
+  for (const kind of ['none', 'inline', 'external']) {
+    const dir = path.join(benchmarkDirectory, kind);
+    fs.mkdirSync(dir, { recursive: true });
+    for (let i = 0; i < n; i++) {
+      const source = moduleSource(i);
+      let trailer = '';
+      if (kind === 'inline') {
+        const data = Buffer.from(sourceMapFor(i, source)).toString('base64');
+        trailer = `//# sourceMappingURL=data:application/json;base64,${data}\n`;
+      } else if (kind === 'external') {
+        fs.writeFileSync(path.join(dir, `${i}.js.map`), sourceMapFor(i, source));
+        trailer = `//# sourceMappingURL=${i}.js.map\n`;
+      }
+      fs.writeFileSync(path.join(dir, `${i}.js`), source + trailer);
+    }
+  }
+}
+
+function main({ sourceMap, n }) {
+  process.setSourceMapsEnabled(true);
+  const dir = path.join(benchmarkDirectory, sourceMap);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    require(path.join(dir, `${i}.js`));
+  }
+  bench.end(n);
+}
diff --git a/benchmark/net/tcp-raw-c2s.js b/benchmark/net/tcp-raw-c2s.js
index 5b174f50e81c..24e35906c925 100644
--- a/benchmark/net/tcp-raw-c2s.js
+++ b/benchmark/net/tcp-raw-c2s.js
@@ -23,7 +23,11 @@ function main({ dur, len, type }) {
     TCPConnectWrap,
     constants: TCPConstants,
   } = common.binding('tcp_wrap');
-  const { WriteWrap } = common.binding('stream_wrap');
+  const {
+    WriteWrap,
+    kReadBytesOrError,
+    streamBaseState,
+  } = common.binding('stream_wrap');
   const PORT = common.PORT;
 
   const serverHandle = new TCP(TCPConstants.SERVER);
@@ -55,9 +59,7 @@ function main({ dur, len, type }) {
       if (!buffer)
         fail('read');
 
-      // Don't slice the buffer. The point of this is to isolate, not
-      // simulate real traffic.
-      bytes += buffer.byteLength;
+      bytes += streamBaseState[kReadBytesOrError];
     };
 
     clientHandle.readStart();
diff --git a/benchmark/net/tcp-raw-pipe.js b/benchmark/net/tcp-raw-pipe.js
index fbaa21b5a309..36ddb822e04e 100644
--- a/benchmark/net/tcp-raw-pipe.js
+++ b/benchmark/net/tcp-raw-pipe.js
@@ -23,7 +23,12 @@ function main({ dur, len, type }) {
     TCPConnectWrap,
     constants: TCPConstants,
   } = common.binding('tcp_wrap');
-  const { WriteWrap } = common.binding('stream_wrap');
+  const {
+    WriteWrap,
+    kReadBytesOrError,
+    kArrayBufferOffset,
+    streamBaseState,
+  } = common.binding('stream_wrap');
   const PORT = common.PORT;
 
   function fail(err, syscall) {
@@ -50,9 +55,11 @@ function main({ dur, len, type }) {
       if (!buffer)
         fail('read');
 
+      const nread = streamBaseState[kReadBytesOrError];
+      const offset = streamBaseState[kArrayBufferOffset];
       const writeReq = new WriteWrap();
       writeReq.async = false;
-      err = clientHandle.writeBuffer(writeReq, Buffer.from(buffer));
+      err = clientHandle.writeBuffer(writeReq, Buffer.from(buffer, offset, nread));
 
       if (err)
         fail(err, 'write');
@@ -94,7 +101,7 @@ function main({ dur, len, type }) {
     if (!buffer)
       fail('read');
 
-    bytes += buffer.byteLength;
+    bytes += streamBaseState[kReadBytesOrError];
   };
 
   connectReq.oncomplete = function(err) {
diff --git a/benchmark/net/tcp-raw-s2c.js b/benchmark/net/tcp-raw-s2c.js
index 3ca03529fcea..a847b8c28dcd 100644
--- a/benchmark/net/tcp-raw-s2c.js
+++ b/benchmark/net/tcp-raw-s2c.js
@@ -23,7 +23,11 @@ function main({ dur, len, type }) {
     TCPConnectWrap,
     constants: TCPConstants,
   } = common.binding('tcp_wrap');
-  const { WriteWrap } = common.binding('stream_wrap');
+  const {
+    WriteWrap,
+    kReadBytesOrError,
+    streamBaseState,
+  } = common.binding('stream_wrap');
   const PORT = common.PORT;
 
   const serverHandle = new TCP(TCPConstants.SERVER);
@@ -116,9 +120,7 @@ function main({ dur, len, type }) {
         if (!buffer)
           fail('read');
 
-        // Don't slice the buffer. The point of this is to isolate, not
-        // simulate real traffic.
-        bytes += buffer.byteLength;
+        bytes += streamBaseState[kReadBytesOrError];
       };
 
       clientHandle.readStart();
diff --git a/benchmark/perf_hooks/histogram-qrde.js b/benchmark/perf_hooks/histogram-qrde.js
new file mode 100644
index 000000000000..b23abd485316
--- /dev/null
+++ b/benchmark/perf_hooks/histogram-qrde.js
@@ -0,0 +1,37 @@
+'use strict';
+
+const common = require('../common.js');
+const { createHistogram } = require('perf_hooks');
+
+const bench = common.createBenchmark(main, {
+  n: [5],
+  bins: [100, 1000],
+  samples: [1e6],
+  unique: [100, 1000, 10000],
+  dequantize: ['none', 'hdr', 'all'],
+}, {
+  test: {
+    n: 1,
+    bins: 10,
+    samples: 100,
+    unique: 10,
+  },
+});
+
+async function main({ n, bins, samples, unique, dequantize }) {
+  const histogram = createHistogram();
+  const maximum = 1e12;
+
+  for (let i = 0; i < samples; i++) {
+    const index = i % unique;
+    const rank = unique === 1 ? 0 : index / (unique - 1);
+    histogram.record(Math.max(1, Math.round(maximum ** rank)));
+  }
+
+  await histogram.qrde({ bins, dequantize });
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    await histogram.qrde({ bins, dequantize });
+  }
+  bench.end(n);
+}
diff --git a/benchmark/perf_hooks/histogram-sliding-window-record.js b/benchmark/perf_hooks/histogram-sliding-window-record.js
new file mode 100644
index 000000000000..192a1f0cc5f7
--- /dev/null
+++ b/benchmark/perf_hooks/histogram-sliding-window-record.js
@@ -0,0 +1,24 @@
+'use strict';
+
+const assert = require('assert');
+const common = require('../common.js');
+const { createSlidingWindowHistogram } = require('perf_hooks');
+
+const bench = common.createBenchmark(main, {
+  n: [1e6],
+  mode: ['count', 'time'],
+  chunks: [6],
+});
+
+function main({ n, mode, chunks }) {
+  const options = mode === 'count' ?
+    { chunks, recordsPerChunk: 1000 } :
+    { chunks, chunkDuration: 1 };
+  const histogram = createSlidingWindowHistogram(options);
+
+  bench.start();
+  for (let i = 0; i < n; i++) histogram.record((i % 1000) + 1);
+  bench.end(n);
+
+  assert.ok(histogram.snapshot().count > 0);
+}
diff --git a/benchmark/perf_hooks/histogram-sliding-window-snapshot.js b/benchmark/perf_hooks/histogram-sliding-window-snapshot.js
new file mode 100644
index 000000000000..9bdc907054a8
--- /dev/null
+++ b/benchmark/perf_hooks/histogram-sliding-window-snapshot.js
@@ -0,0 +1,29 @@
+'use strict';
+
+const assert = require('assert');
+const common = require('../common.js');
+const { createSlidingWindowHistogram } = require('perf_hooks');
+
+const bench = common.createBenchmark(main, {
+  n: [100],
+  chunks: [2, 8],
+  recordsPerChunk: [1000],
+});
+
+let snapshot;
+
+function main({ n, chunks, recordsPerChunk }) {
+  const histogram = createSlidingWindowHistogram({
+    chunks,
+    recordsPerChunk,
+  });
+  for (let i = 0; i < chunks * recordsPerChunk; i++) {
+    histogram.record((i % 1000) + 1);
+  }
+
+  bench.start();
+  for (let i = 0; i < n; i++) snapshot = histogram.snapshot();
+  bench.end(n);
+
+  assert.strictEqual(snapshot.count, chunks * recordsPerChunk);
+}
diff --git a/benchmark/scatter.js b/benchmark/scatter.js
index 858169d7d68c..cb1df965b70f 100644
--- a/benchmark/scatter.js
+++ b/benchmark/scatter.js
@@ -1,62 +1,167 @@
 'use strict';
 
-const fork = require('child_process').fork;
+const { spawn, fork } = require('node:child_process');
+const { createHistogram } = require('node:perf_hooks');
+const { inspect } = require('util');
 const path = require('path');
 const CLI = require('./_cli.js');
+const BenchmarkProgress = require('./_benchmark_progress.js');
 
 //
 // Parse arguments
 //
 const cli = new CLI(`usage: ./node scatter.js [options] [--] <filename>
   Run the benchmark script <filename> many times and output the rate (ops/s)
-  together with the benchmark variables as a csv.
+  together with the benchmark variables as a csv, which can be processed using
+  for example 'scatter.R'. Use --analyze to summarize the results directly
+  without R.
 
   --runs 30              number of samples
   --set  variable=value  set benchmark variable (can be repeated)
-`, { arrayArgs: ['set'] });
+  --no-progress          don't show benchmark progress indicator
+  --analyze              print a statistical summary (mean rate and confidence
+                         interval per group) instead of csv output
+  --xaxis     variable   variable to group by when using --analyze (required
+                         by --analyze)
+  --category  variable   additional variable to group by when using --analyze
+  --no-chart             don't print the bar chart when using --analyze
+
+  Examples:
+    --set CPUSET=0            Runs benchmarks on CPU core 0.
+    --set CPUSET=0-2          Specifies that benchmarks should run on CPU cores 0 to 2.
+
+  Note: The CPUSET format should match the specifications of the 'taskset' command
+`, {
+  arrayArgs: ['set'],
+  boolArgs: ['no-progress', 'analyze', 'no-chart'],
+});
 
 if (cli.items.length !== 1) {
   cli.abort(cli.usage);
 }
 
-// Create queue from the benchmarks list such both node versions are tested
-// `runs` amount of times each.
 const filepath = path.resolve(cli.items[0]);
-const name = filepath.slice(__dirname.length + 1);
+const name = path.relative(__dirname, filepath);
 const runs = cli.optional.runs ? parseInt(cli.optional.runs, 10) : 30;
+const analyze = !!cli.optional.analyze;
+const showChart = !cli.optional['no-chart'];
+const xAxis = cli.optional.xaxis;
+const category = cli.optional.category;
+
+// Grouping is what makes the summary meaningful, so --analyze needs to know
+// which variable is the independent one. There is no sensible default: the
+// answer depends entirely on what is being measured.
+if (analyze && !xAxis) {
+  cli.abort(
+    `--analyze requires --xaxis <variable>
+
+  --xaxis names the benchmark variable to summarize against; --category
+  optionally breaks each point down by a second variable. Both must be
+  configuration variables of this benchmark -- the keys passed to
+  createBenchmark() at the top of the benchmark file. Nearly every
+  benchmark defines 'n'; parameter sweeps add a size or mode variable
+  such as 'len', 'size' or 'encoding'.
+
+  Example:
+    ./node benchmark/scatter.js --analyze --xaxis n ${name}
+`,
+  );
+}
+
+// When --analyze is set, collect results rather than streaming csv.
+const samples = analyze ? [] : null;
 
 let printHeader = true;
 
 function csvEncodeValue(value) {
-  if (typeof value === 'number') {
+  // Benchmark configuration values are numbers, booleans or strings
+  // (see the config parsing in common.js). Only strings need quoting,
+  // but anything unexpected is stringified rather than crashing the run.
+  if (typeof value === 'number' || typeof value === 'boolean') {
     return value.toString();
   }
-  return `"${value.replace(/"/g, '""')}"`;
+  return `"${String(value).replace(/"/g, '""')}"`;
+}
+
+// Note: BenchmarkProgress reports progress per file; scatter.js only ever
+// runs one file, so every queue entry shares the same filename.
+const queue = [];
+for (let iter = 0; iter < runs; iter++) {
+  queue.push({ filename: name, iter });
+}
+
+const kStartOfQueue = 0;
+
+const showProgress = !cli.optional['no-progress'];
+let progress;
+if (showProgress) {
+  progress = new BenchmarkProgress(queue, [name], { analyze });
+  progress.startQueue(kStartOfQueue);
 }
 
 (function recursive(i) {
-  const child = fork(path.resolve(__dirname, filepath), cli.optional.set);
+  const cpuCore = cli.getCpuCoreSetting();
+  let child;
+  if (cpuCore !== null) {
+    const spawnArgs = ['-c', cpuCore, process.execPath, filepath, ...cli.optional.set];
+    child = spawn('taskset', spawnArgs, {
+      env: process.env,
+      stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
+    });
+  } else {
+    child = fork(filepath, cli.optional.set);
+  }
 
   child.on('message', (data) => {
-    if (data.type !== 'report') {
+    if (data.type === 'config') {
+      if (showProgress) {
+        progress.startSubqueue(data, i);
+      }
       return;
     }
 
-    // print csv header
-    if (printHeader) {
-      const confHeader = Object.keys(data.conf)
-        .map(csvEncodeValue)
-        .join(', ');
-      console.log(`"filename", ${confHeader}, "rate", "time"`);
-      printHeader = false;
+    if (data.type !== 'report') {
+      return;
     }
 
-    // print data row
-    const confData = Object.keys(data.conf)
-      .map((key) => csvEncodeValue(data.conf[key]))
-      .join(', ');
+    if (analyze) {
+      // Validate the grouping variables against the first result rather than
+      // at the end. A typo in --xaxis is otherwise not reported until the
+      // whole run has finished, which can be many minutes of wasted work.
+      if (samples.length === 0) {
+        const confKeys = Object.keys(data.conf);
+        for (const key of [xAxis, category]) {
+          if (key !== undefined && !confKeys.includes(key)) {
+            child.kill();
+            cli.abort(
+              `The variable "${key}" is not a configuration of ${name}.\n` +
+              `Available variables: ${confKeys.join(', ')}`,
+            );
+          }
+        }
+      }
+      samples.push(data);
+    } else {
+      // print csv header
+      if (printHeader) {
+        const confHeader = Object.keys(data.conf)
+          .map(csvEncodeValue)
+          .join(',');
+        console.log(`"filename",${confHeader},"rate","time"`);
+        printHeader = false;
+      }
+
+      // print data row
+      const confData = Object.keys(data.conf)
+        .map((key) => csvEncodeValue(data.conf[key]))
+        .join(',');
 
-    console.log(`"${name}", ${confData}, ${data.rate}, ${data.time}`);
+      console.log(`"${name}",${confData},${data.rate},${data.time}`);
+    }
+
+    if (showProgress) {
+      progress.completeConfig(data);
+    }
   });
 
   child.once('close', (code) => {
@@ -64,10 +169,768 @@ function csvEncodeValue(value) {
       process.exit(code);
       return;
     }
+    if (showProgress) {
+      progress.completeRun(queue[i]);
+    }
 
     // If there are more benchmarks execute the next
     if (i + 1 < runs) {
       recursive(i + 1);
+    } else if (analyze) {
+      printAnalysis(samples, xAxis, category);
     }
   });
-})(0);
+})(kStartOfQueue);
+
+//
+// Statistics
+//
+// scatter.R obtains the t quantile from R's qt(); without R it has to be
+// computed here. The Student's t tail probability is an incomplete beta
+// function, which is evaluated directly, and the quantile is recovered by
+// bisecting it. Bisection rather than an inverse-beta routine because the
+// cost is irrelevant at this scale and the error bound is explicit.
+//
+
+// Lanczos approximation, g=7, n=9.
+function logGamma(x) {
+  const g = [
+    676.5203681218851, -1259.1392167224028, 771.32342877765313,
+    -176.61502916214059, 12.507343278686905, -0.13857109526572012,
+    9.9843695780195716e-6, 1.5056327351493116e-7,
+  ];
+  if (x < 0.5) {
+    // Reflection formula.
+    return Math.log(Math.PI / Math.sin(Math.PI * x)) - logGamma(1 - x);
+  }
+  x -= 1;
+  let a = 0.99999999999980993;
+  const t = x + 7.5;
+  for (let i = 0; i < g.length; i++) {
+    a += g[i] / (x + i + 1);
+  }
+  return 0.5 * Math.log(2 * Math.PI) + (x + 0.5) * Math.log(t) - t + Math.log(a);
+}
+
+// Continued fraction for the incomplete beta function (Lentz's algorithm).
+function betaContinuedFraction(x, a, b) {
+  const tiny = 1e-30;
+  const qab = a + b;
+  const qap = a + 1;
+  const qam = a - 1;
+  let c = 1;
+  let d = 1 - qab * x / qap;
+  if (Math.abs(d) < tiny) d = tiny;
+  d = 1 / d;
+  let h = d;
+  for (let m = 1; m <= 300; m++) {
+    const m2 = 2 * m;
+    let aa = m * (b - m) * x / ((qam + m2) * (a + m2));
+    d = 1 + aa * d;
+    if (Math.abs(d) < tiny) d = tiny;
+    c = 1 + aa / c;
+    if (Math.abs(c) < tiny) c = tiny;
+    d = 1 / d;
+    h *= d * c;
+    aa = -(a + m) * (qab + m) * x / ((a + m2) * (qap + m2));
+    d = 1 + aa * d;
+    if (Math.abs(d) < tiny) d = tiny;
+    c = 1 + aa / c;
+    if (Math.abs(c) < tiny) c = tiny;
+    d = 1 / d;
+    const del = d * c;
+    h *= del;
+    if (Math.abs(del - 1) < 1e-14) break;
+  }
+  return h;
+}
+
+// Regularized incomplete beta function I_x(a, b).
+function incompleteBeta(x, a, b) {
+  if (x <= 0) return 0;
+  if (x >= 1) return 1;
+  const lbeta = logGamma(a + b) - logGamma(a) - logGamma(b);
+  // Use the continued fraction on whichever side converges quickly.
+  if (x < (a + 1) / (a + b + 2)) {
+    return Math.exp(lbeta + a * Math.log(x) + b * Math.log(1 - x)) *
+           betaContinuedFraction(x, a, b) / a;
+  }
+  return 1 - Math.exp(lbeta + b * Math.log(1 - x) + a * Math.log(x)) *
+             betaContinuedFraction(1 - x, b, a) / b;
+}
+
+// Two-tailed probability P(|T| > t) for Student's t with v degrees of freedom.
+function tTailProbability(t, v) {
+  return incompleteBeta(v / (v + t * t), v / 2, 0.5);
+}
+
+// Quantile of Student's t: the value q with P(T <= q) = p, for p > 0.5.
+// Equivalent to R's qt(p, v). Accurate to ~1e-6 over the range used here.
+function tQuantile(p, v) {
+  const alpha = 2 * (1 - p);
+  let lo = 0;
+  let hi = 1e3;
+  for (let i = 0; i < 200; i++) {
+    const mid = (lo + hi) / 2;
+    if (tTailProbability(mid, v) > alpha) {
+      lo = mid;
+    } else {
+      hi = mid;
+    }
+  }
+  return (lo + hi) / 2;
+}
+
+function printAnalysis(samples, xAxis, category) {
+  if (samples.length === 0) {
+    console.error('No benchmark results were reported.');
+    process.exitCode = 1;
+    return;
+  }
+
+  // The grouping variables were already validated against the first result.
+  const confKeys = Object.keys(samples[0].conf);
+
+  // Every variable that is neither a grouping variable nor constant across
+  // the run is averaged over. Report them: an aggregated variable can hide a
+  // real effect, and the reader has no other way to know it happened.
+  const aggregated = confKeys.filter((key) => {
+    if (key === xAxis || key === category) return false;
+    const first = samples[0].conf[key];
+    return samples.some((s) => s.conf[key] !== first);
+  });
+
+  // Group by the grouping variables. The full sample is retained, not just
+  // the rate, so the aggregated variables can be accounted for below.
+  const groups = new Map();
+  for (const sample of samples) {
+    const xValue = sample.conf[xAxis];
+    const catValue = category === undefined ? undefined : sample.conf[category];
+    const key = `${String(xValue)}\u0000${String(catValue)}`;
+    let group = groups.get(key);
+    if (group === undefined) {
+      group = { xValue, catValue, rates: [], members: [] };
+      groups.set(key, group);
+    }
+    group.rates.push(sample.rate);
+    group.members.push(sample);
+  }
+
+  // Naming an aggregated variable is not enough: if it drives most of the
+  // spread within a group, every interval below is reporting that variable
+  // rather than the benchmark's noise, and no number of --runs will shrink
+  // it. Quantify the share so the reader can tell those cases apart.
+  const contamination = new Map();
+  for (const variable of aggregated) {
+    contamination.set(variable, varianceShare([...groups.values()], variable));
+  }
+
+  for (const variable of aggregated) {
+    const share = contamination.get(variable);
+    // Rounding 99.7% up to "100%" would claim the residual noise is zero.
+    const percent = share === 1 ?
+      '100' :
+      (share >= 0.995 ? '>99' : (share * 100).toFixed(0));
+    const suffix = Number.isNaN(share) ?
+      '' :
+      ` (explains ${percent}% of within-group variance)`;
+    console.log(`aggregating variable: ${variable}${suffix}`);
+  }
+
+  // Aggregation that dominates the spread is the single most common reason
+  // for uselessly wide intervals, and the usual reaction -- raising --runs --
+  // cannot help, because the spread is a real effect of a variable that has
+  // been averaged over rather than sampling noise.
+  const dominant = aggregated.filter((v) => contamination.get(v) > 0.5);
+  if (dominant.length > 0) {
+    console.log('');
+    const one = dominant.length === 1;
+    printWrapped(
+      `Note: ${dominant.join(', ')} ${one ? 'explains' : 'explain'} most of ` +
+      `the spread within each group, so the intervals below describe ` +
+      `${one ? 'that variable' : 'those variables'} rather than the ` +
+      `benchmark's own noise, and more --runs will not narrow them. Pin ` +
+      `${one ? 'it' : 'them'} with --set ${dominant[0]}=<value>, or pass as ` +
+      `--category, for intervals that can be acted on.`,
+    );
+  }
+
+  if (aggregated.length > 0) {
+    console.log('');
+  }
+
+  const compare = (a, b) => {
+    if (typeof a === 'number' && typeof b === 'number') return a - b;
+    return String(a).localeCompare(String(b));
+  };
+
+  const scale = histogramScale(samples.map((s) => s.rate));
+
+  const rows = [...groups.values()]
+    .sort((a, b) => compare(a.xValue, b.xValue) ||
+                    compare(a.catValue, b.catValue))
+    .map((group) => {
+      const rates = group.rates;
+      const n = rates.length;
+      const mean = rates.reduce((a, b) => a + b, 0) / n;
+
+      // Confidence interval of the mean, matching scatter.R: the sample
+      // standard error scaled by the t quantile at 97.5%. Computed from the
+      // raw samples rather than the histogram, which stores bucketed values.
+      // Undefined for a single sample, where there is no spread to estimate.
+      let ci = NaN;
+      if (n > 1) {
+        const variance =
+          rates.reduce((sum, r) => sum + (r - mean) ** 2, 0) / (n - 1);
+        ci = Math.sqrt(variance / n) * tQuantile(0.975, n - 1);
+      }
+
+      // The histogram supplies the statistics that have no closed form here:
+      // an exact-binomial interval on the median, and the shape measures used
+      // to decide whether the mean is worth trusting.
+      const histogram = createHistogram({ figures: 5 });
+      for (const rate of rates) {
+        histogram.record(Math.max(1, Math.round(rate * scale)));
+      }
+
+      const medianCI = histogram.percentileCI(50);
+      const median = medianCI.value / scale;
+      const skewness = n > 1 ? histogram.skewness : NaN;
+
+      // A summary is suspect when the two estimates of the centre disagree by
+      // more than the uncertainty claimed for one of them, or when the sample
+      // is badly asymmetric. Either way the mean is being moved by the tail
+      // rather than describing the bulk of the runs.
+      const skewed = n > 1 &&
+        (Math.abs(skewness) > 1 || Math.abs(median - mean) > ci);
+
+      return {
+        ...group,
+        n,
+        mean,
+        ci,
+        histogram,
+        median,
+        medianLower: medianCI.lower / scale,
+        medianUpper: medianCI.upper / scale,
+        skewness,
+        skewed,
+      };
+    });
+
+  // Values are rendered through short labels so that long or non-printable
+  // configuration values cannot break the layout.
+  const legend = assignLabels(rows, 'xValue', 'xLabel');
+  if (category !== undefined) {
+    legend.push(...assignLabels(rows, 'catValue', 'catLabel'));
+  }
+
+  printTable(rows, xAxis, category);
+
+  if (showChart) {
+    printChart(rows, xAxis, category);
+  }
+
+  printComparisons(rows, xAxis, category);
+  printLegend(legend);
+
+  const singleSample = rows.filter((r) => r.n < 2).length;
+  if (singleSample > 0) {
+    console.log('');
+    printWrapped(
+      `Note: ${singleSample} group${singleSample === 1 ? ' has' : 's have'} ` +
+      `only one sample, so no confidence interval could be estimated. ` +
+      `Use --runs 2 or higher.`,
+    );
+  }
+
+  if (rows.some((r) => r.skewed)) {
+    console.log('');
+    printWrapped(
+      `(!) marks groups where the median falls outside the mean's confidence ` +
+      `interval, or the sample is strongly skewed (|skewness| > 1). For those ` +
+      `rows the mean is being pulled by a few slow or fast runs, so the ` +
+      `median and its interval describe the typical run better. This is ` +
+      `usually GC or JIT tiering; more --runs will not necessarily make it ` +
+      `go away.`,
+    );
+  }
+}
+
+// HdrHistogram records positive integers with a fixed number of significant
+// figures, so precision is relative and large rates need no scaling at all.
+// Small rates do: without scaling, anything below 1 op/s rounds to the same
+// bucket and the group collapses to a single value. Scale up until the
+// smallest rate carries enough digits for rounding to be irrelevant.
+function histogramScale(rates) {
+  let min = Infinity;
+  let max = 0;
+  for (const rate of rates) {
+    if (rate > 0 && rate < min) min = rate;
+    if (rate > max) max = rate;
+  }
+  if (!Number.isFinite(min) || max === 0) return 1;
+
+  let scale = 1;
+  while (min * scale < 1e6 && max * scale < 1e15) {
+    scale *= 10;
+  }
+  return scale;
+}
+
+// Share of the within-group variance attributable to one aggregated
+// variable, pooled over groups. This is a one-way eta squared: the spread
+// between that variable's levels divided by the total spread inside the
+// group. Computed per variable and independently, so when two aggregated
+// variables are correlated their shares overlap and do not sum to one.
+function varianceShare(groups, variable) {
+  let between = 0;
+  let total = 0;
+
+  for (const group of groups) {
+    const members = group.members;
+    if (members.length < 2) continue;
+
+    const groupMean =
+      members.reduce((sum, s) => sum + s.rate, 0) / members.length;
+
+    // Partition the group by the level of this variable.
+    const levels = new Map();
+    for (const sample of members) {
+      const key = String(sample.conf[variable]);
+      let level = levels.get(key);
+      if (level === undefined) {
+        level = { sum: 0, count: 0 };
+        levels.set(key, level);
+      }
+      level.sum += sample.rate;
+      level.count++;
+    }
+
+    // A variable with a single level inside this group explains nothing
+    // here, but the group still contributes to the total spread.
+    for (const level of levels.values()) {
+      const levelMean = level.sum / level.count;
+      between += level.count * (levelMean - groupMean) ** 2;
+    }
+    for (const sample of members) {
+      total += (sample.rate - groupMean) ** 2;
+    }
+  }
+
+  if (total === 0) return NaN;
+  return Math.min(1, between / total);
+}
+
+// The smallest p-value the Mann-Whitney implementation can return for these
+// sample sizes, found by giving it perfectly separated groups. Below a
+// certain size that floor sits above 0.05, meaning no effect of any
+// magnitude can be reported as significant; a non-significant result then
+// says nothing at all. Derived from the implementation rather than the exact
+// combinatorial bound because it uses a normal approximation.
+const mannWhitneyFloors = new Map();
+function mannWhitneyFloor(nA, nB) {
+  const key = `${nA},${nB}`;
+  let floor = mannWhitneyFloors.get(key);
+  if (floor === undefined) {
+    // Values must stay distinct after the histogram's 5-significant-figure
+    // rounding, or they collapse into ties and the tie correction reports a
+    // floor lower than the test can actually reach. The 10000 range is exact
+    // at that precision, and the two runs cannot overlap.
+    const low = createHistogram({ figures: 5 });
+    const high = createHistogram({ figures: 5 });
+    for (let i = 0; i < nA; i++) low.record(10000 + i);
+    for (let i = 0; i < nB; i++) high.record(10000 + nA + i);
+    floor = high.mannWhitneyTest(low).pValue;
+    mannWhitneyFloors.set(key, floor);
+  }
+  return floor;
+}
+
+// Cliff's delta magnitude thresholds (Romano et al.), the conventional
+// reading of the statistic.
+function effectSizeLabel(delta) {
+  const d = Math.abs(delta);
+  if (d < 0.147) return 'negligible';
+  if (d < 0.33) return 'small';
+  if (d < 0.474) return 'medium';
+  return 'large';
+}
+
+// The question scatter.js exists to answer is whether a parameter changes the
+// rate, which the per-group table only hints at through overlapping intervals.
+// Compare consecutive x-axis values directly, holding the category fixed.
+// Mann-Whitney rather than a t-test because a parameter sweep routinely
+// changes the shape and spread of the distribution, not just its centre.
+function printComparisons(rows, xAxis, category) {
+  const usable = rows.filter((row) => row.n > 1);
+  if (usable.length < 2) return;
+
+  // Partition by category so each series is a sweep over the x-axis alone.
+  const series = new Map();
+  for (const row of usable) {
+    const key = String(row.catValue);
+    if (!series.has(key)) series.set(key, []);
+    series.get(key).push(row);
+  }
+
+  const lines = [];
+  let floor = 0;
+  for (const group of series.values()) {
+    if (group.length < 2) continue;
+
+    const entries = [];
+    for (let i = 1; i < group.length; i++) {
+      const previous = group[i - 1];
+      const current = group[i];
+      const { pValue } = current.histogram.mannWhitneyTest(previous.histogram);
+      const delta = current.histogram.cliffsD(previous.histogram);
+      const change = ((current.mean - previous.mean) / previous.mean) * 100;
+
+      floor = Math.max(floor, mannWhitneyFloor(previous.n, current.n));
+
+      // How the rate scales with the parameter over this step, which is the
+      // complexity question these sweeps are usually run to answer. Reported
+      // per step rather than as one fit across the whole sweep: a single
+      // exponent spanning a curve that changes regime describes neither.
+      let ratio = '';
+      let exponent = '';
+      if (typeof previous.xValue === 'number' &&
+          typeof current.xValue === 'number' &&
+          previous.xValue > 0 && current.xValue > 0 &&
+          previous.xValue !== current.xValue &&
+          previous.mean > 0 && current.mean > 0) {
+        const xRatio = current.xValue / previous.xValue;
+        const value = Math.log(current.mean / previous.mean) /
+                      Math.log(xRatio);
+        ratio = `${xRatio.toFixed(1)}x`;
+        exponent = `${value >= 0 ? '+' : ''}${value.toFixed(2)}`;
+      }
+
+      entries.push({
+        transition: `${previous.xLabel} -> ${current.xLabel}`,
+        change: `${change >= 0 ? '+' : ''}${change.toFixed(2)}%`,
+        ratio,
+        exponent,
+        pValue: pValue < 1e-4 ? pValue.toExponential(1) : pValue.toFixed(4),
+        delta: `${delta >= 0 ? '+' : ''}${delta.toFixed(3)}`,
+        label: effectSizeLabel(delta),
+      });
+    }
+
+    if (entries.length > 0) {
+      lines.push({
+        heading: category === undefined ?
+          null :
+          `${category}=${group[0].catLabel}`,
+        entries,
+      });
+    }
+  }
+
+  if (lines.length === 0) return;
+
+  const all = lines.flatMap((l) => l.entries);
+  const widths = {
+    transition: Math.max(...all.map((e) => displayWidth(e.transition))),
+    change: Math.max(...all.map((e) => displayWidth(e.change))),
+    ratio: Math.max(...all.map((e) => displayWidth(e.ratio))),
+    exponent: Math.max(...all.map((e) => displayWidth(e.exponent))),
+    pValue: Math.max(...all.map((e) => displayWidth(e.pValue))),
+    delta: Math.max(...all.map((e) => displayWidth(e.delta))),
+  };
+  const rpad = (s, n) => padTo(s, n, true);
+  const pad = (s, n) => padTo(s, n, false);
+
+  console.log('');
+  console.log(`Change between consecutive ${xAxis} values ` +
+              `(Mann-Whitney U, Cliff's delta):`);
+
+  for (const { heading, entries } of lines) {
+    console.log('');
+    if (heading !== null) {
+      console.log(`  ${heading}`);
+    }
+    for (const entry of entries) {
+      console.log(
+        `    ${pad(entry.transition, widths.transition)}` +
+        `  ${rpad(entry.change, widths.change)}` +
+        (widths.exponent > 0 ?
+          `  ${rpad(entry.ratio, widths.ratio)}` +
+          `  exponent=${rpad(entry.exponent, widths.exponent)}` :
+          '') +
+        `  p=${rpad(entry.pValue, widths.pValue)}` +
+        `  delta=${rpad(entry.delta, widths.delta)} (${entry.label})`,
+      );
+    }
+  }
+
+  // A p-value has to be read against what the test could have produced. Below
+  // a certain sample size the floor sits above the threshold, and "not
+  // significant" then carries no information whatsoever.
+  if (floor >= 0.05) {
+    console.log('');
+    printWrapped(
+      `Warning: at this sample size the smallest p-value this test can ` +
+      `produce is ${floor.toFixed(4)}, so no comparison above can reach ` +
+      `significance however large the real effect is. Treat every p-value ` +
+      `here as uninformative and raise --runs.`,
+    );
+  } else if (floor >= 0.005) {
+    console.log('');
+    printWrapped(
+      `Note: at this sample size the smallest p-value this test can produce ` +
+      `is ${floor.toFixed(4)}. A non-significant result above is therefore ` +
+      `weak evidence of no change rather than evidence of none; raise ` +
+      `--runs to strengthen it.`,
+    );
+  }
+}
+
+function formatRate(rate) {
+  return rate.toLocaleString('en-US', {
+    minimumFractionDigits: 1,
+    maximumFractionDigits: 1,
+  });
+}
+
+// Widest a single variable value may be before it is abbreviated. Benchmark
+// values are usually short (`16`, `'ascii'`), but some are long enough to
+// destroy the layout on their own, so there has to be a ceiling.
+const kMaxValueWidth = 24;
+
+// Widest a composed chart label may be, since it can hold two values.
+const kMaxChartLabelWidth = 44;
+
+// Widths are measured in code points, not UTF-16 code units: several
+// benchmarks use emoji and CJK in their configurations, and counting those
+// as two would misalign every column to their right.
+function displayWidth(text) {
+  return [...text].length;
+}
+
+function padTo(text, width, alignRight) {
+  const padding = ' '.repeat(Math.max(0, width - displayWidth(text)));
+  return alignRight ? padding + text : text + padding;
+}
+
+// Drop out the middle rather than the tail: benchmark values that share a
+// long prefix are common, and a head-only truncation would render them
+// identical. Slicing by code point rather than by index so that an astral
+// character cannot be cut in half into a lone surrogate.
+function truncateMiddle(text, maxWidth) {
+  const chars = [...text];
+  if (chars.length <= maxWidth) return text;
+  const keep = maxWidth - 3;
+  const head = Math.ceil(keep / 2);
+  const tail = Math.floor(keep / 2);
+  return `${chars.slice(0, head).join('')}...` +
+         `${chars.slice(chars.length - tail).join('')}`;
+}
+
+// Configuration values are not guaranteed to be printable: strings may carry
+// newlines or tabs (see benchmark/mime/mimetype-instantiation.js), which
+// would otherwise split a table row across several lines. inspect() escapes
+// them and quotes strings, matching how compare.js renders configurations.
+function displayValue(value) {
+  const text = typeof value === 'string' ? inspect(value) : String(value);
+  return { text: truncateMiddle(text, kMaxValueWidth), full: text };
+}
+
+// Assigns a short, unique, printable label to every distinct value of one
+// grouping variable, and collects the abbreviated ones for a legend so the
+// full value is still recoverable from the output.
+function assignLabels(rows, valueField, labelField) {
+  const assigned = new Map();
+  const used = new Map();
+  const legend = [];
+
+  for (const row of rows) {
+    const key = String(row[valueField]);
+    let label = assigned.get(key);
+
+    if (label === undefined) {
+      const { text, full } = displayValue(row[valueField]);
+      // Two different values can abbreviate to the same text; keep them
+      // distinguishable so the table cannot show one group twice.
+      const collisions = used.get(text) ?? 0;
+      used.set(text, collisions + 1);
+      label = collisions === 0 ? text : `${text}~${collisions + 1}`;
+      assigned.set(key, label);
+      if (text !== full) legend.push({ label, full });
+    }
+
+    row[labelField] = label;
+  }
+
+  return legend;
+}
+
+// Notes interpolate variable names and sample sizes, so their length is not
+// known when they are written. Wrapping here rather than hand-placing
+// newlines, which overflow as soon as an interpolated value is longer than
+// the author guessed.
+function printWrapped(text, width = 76) {
+  let line = '';
+  for (const word of text.split(/\s+/)) {
+    if (line === '') {
+      line = word;
+    } else if (displayWidth(line) + 1 + displayWidth(word) <= width) {
+      line += ` ${word}`;
+    } else {
+      console.log(line);
+      line = word;
+    }
+  }
+  if (line !== '') console.log(line);
+}
+
+function printLegend(legend) {
+  if (legend.length === 0) return;
+  console.log('');
+  console.log('Abbreviated values:');
+  for (const { label, full } of legend) {
+    console.log(`  ${label}`);
+    console.log(`    = ${full}`);
+  }
+}
+
+function printTable(rows, xAxis, category) {
+  const header = [xAxis];
+  if (category !== undefined) header.push(category);
+  header.push('samples', 'rate', 'confidence.interval',
+              'median', 'median.interval', '');
+
+  // Numbers line up on the right, text reads better on the left. The grouping
+  // columns can be either, so they follow the type of the underlying value.
+  const alignRight = [typeof rows[0].xValue === 'number'];
+  if (category !== undefined) {
+    alignRight.push(typeof rows[0].catValue === 'number');
+  }
+  alignRight.push(true, true, true, true, true, false);
+
+  const body = rows.map((row) => {
+    const cells = [row.xLabel];
+    if (category !== undefined) cells.push(row.catLabel);
+
+    // The median interval is asymmetric, so it is shown as a relative range
+    // rather than a single half-width.
+    const medianInterval = row.n > 1 ?
+      `[${(((row.medianLower - row.median) / row.median) * 100).toFixed(2)}%, ` +
+      `+${(((row.medianUpper - row.median) / row.median) * 100).toFixed(2)}%]` :
+      'NA';
+
+    cells.push(
+      String(row.n),
+      formatRate(row.mean),
+      // Absolute for parity with scatter.R, relative because that is what
+      // tells you whether the rate beside it is worth reading. Kept in one
+      // column so every column has a header of its own.
+      Number.isNaN(row.ci) ?
+        'NA' :
+        `${formatRate(row.ci)} (±${((row.ci / row.mean) * 100).toFixed(2)}%)`,
+      formatRate(row.median),
+      medianInterval,
+      row.skewed ? '(!)' : '',
+    );
+    return cells;
+  });
+
+  const widths = header.map((_, col) => Math.max(
+    displayWidth(header[col]),
+    ...body.map((cells) => displayWidth(cells[col])),
+  ));
+
+  const line = (cells) => cells
+    .map((cell, col) => padTo(cell, widths[col], alignRight[col]))
+    .join('  ')
+    .trimEnd();
+
+  console.log(line(header));
+  for (const cells of body) {
+    console.log(line(cells));
+  }
+}
+
+function printChart(rows, xAxis, category) {
+  if (rows.length === 0) return;
+
+  const barWidth = 40;
+  // Bars are drawn from zero so that the visual length is proportional to the
+  // rate. A truncated axis would exaggerate small differences.
+  let maxRate = 0;
+  for (const row of rows) {
+    const extent = row.mean + (Number.isNaN(row.ci) ? 0 : row.ci);
+    if (extent > maxRate) maxRate = extent;
+  }
+  if (maxRate === 0) return;
+
+  const labels = rows.map((row) => {
+    const parts = [`${xAxis}=${row.xLabel}`];
+    if (category !== undefined) parts.push(`${category}=${row.catLabel}`);
+    return truncateMiddle(parts.join(' '), kMaxChartLabelWidth);
+  });
+  const labelWidth = Math.max(...labels.map(displayWidth));
+  const rateWidth = Math.max(
+    ...rows.map((r) => displayWidth(formatRate(r.mean))));
+
+  const pad = (s, n) => padTo(s, n, false);
+  const rpad = (s, n) => padTo(s, n, true);
+
+  const axisRight = formatRate(maxRate);
+  const indent = ' '.repeat(labelWidth + 2);
+
+  console.log('');
+  console.log('Rate in operations/second; longer is faster. \u2502 marks the ' +
+              'mean and the');
+  console.log('shaded band (\u2591) is its 95% confidence interval, so bars ' +
+              'whose bands');
+  console.log('overlap are not clearly different.');
+  console.log('');
+  console.log(
+    `${indent}0` +
+    `${' '.repeat(Math.max(1, barWidth - 1 - displayWidth(axisRight)))}` +
+    `${axisRight}`,
+  );
+  console.log(`${indent}+${'-'.repeat(Math.max(0, barWidth - 2))}+`);
+
+  let previousX;
+  for (let i = 0; i < rows.length; i++) {
+    const row = rows[i];
+
+    // A blank line between x-axis values, so the categories being compared at
+    // each point stay visually grouped.
+    if (previousX !== undefined && row.xValue !== previousX) {
+      console.log('');
+    }
+    previousX = row.xValue;
+
+    const barEnd = (row.mean / maxRate) * barWidth;
+    const ci = Number.isNaN(row.ci) ? 0 : row.ci;
+    const ciLeft = ((row.mean - ci) / maxRate) * barWidth;
+    const ciRight = ((row.mean + ci) / maxRate) * barWidth;
+
+    // Without an explicit marker the mean is invisible, because the shaded
+    // interval is drawn over the solid bar and straddles it.
+    const meanCell = Math.min(barWidth - 1, Math.floor(barEnd));
+
+    let bar = '';
+    for (let x = 0; x < barWidth; x++) {
+      const pos = x + 0.5; // Center of this character cell.
+      if (x === meanCell) {
+        bar += '\u2502'; // The mean itself.
+      } else if (pos >= ciLeft && pos <= ciRight) {
+        bar += '\u2591'; // Light shade marks the confidence interval.
+      } else if (pos <= barEnd) {
+        bar += '\u2588';
+      } else {
+        bar += ' ';
+      }
+    }
+
+    console.log(
+      `${pad(labels[i], labelWidth)}  ${bar}  ` +
+      `${rpad(formatRate(row.mean), rateWidth)}`,
+    );
+  }
+}
diff --git a/benchmark/sqlite/sqlite-diagnostic-channel.js b/benchmark/sqlite/sqlite-diagnostic-channel.js
new file mode 100644
index 000000000000..0610839653df
--- /dev/null
+++ b/benchmark/sqlite/sqlite-diagnostic-channel.js
@@ -0,0 +1,42 @@
+'use strict';
+const common = require('../common.js');
+const sqlite = require('node:sqlite');
+const dc = require('node:diagnostics_channel');
+const assert = require('node:assert');
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  mode: ['none', 'subscribed', 'unsubscribed'],
+});
+
+function main(conf) {
+  const { n, mode } = conf;
+
+  const db = new sqlite.DatabaseSync(':memory:');
+  db.exec('CREATE TABLE t (x INTEGER)');
+  const insert = db.prepare('INSERT INTO t VALUES (?)');
+
+  let subscriber;
+  if (mode === 'subscribed') {
+    subscriber = () => {};
+    dc.subscribe('sqlite.db.query', subscriber);
+  } else if (mode === 'unsubscribed') {
+    subscriber = () => {};
+    dc.subscribe('sqlite.db.query', subscriber);
+    dc.unsubscribe('sqlite.db.query', subscriber);
+  }
+  // mode === 'none': no subscription ever made
+
+  let result;
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    result = insert.run(i);
+  }
+  bench.end(n);
+
+  if (mode === 'subscribed') {
+    dc.unsubscribe('sqlite.db.query', subscriber);
+  }
+
+  assert.ok(result !== undefined);
+}
diff --git a/benchmark/streams/writable-buffered-drain.js b/benchmark/streams/writable-buffered-drain.js
new file mode 100644
index 000000000000..5ebed16624ea
--- /dev/null
+++ b/benchmark/streams/writable-buffered-drain.js
@@ -0,0 +1,25 @@
+'use strict';
+
+const common = require('../common');
+const { Writable } = require('stream');
+
+const bench = common.createBenchmark(main, {
+  count: [1024, 16384, 65536],
+  n: [100],
+});
+
+function main({ count, n }) {
+  const chunk = {};
+  let callback;
+  const stream = new Writable({
+    objectMode: true,
+    write(chunk, encoding, cb) { callback = cb; },
+  });
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    for (let j = 0; j < count; j++) stream.write(chunk);
+    for (let j = 0; j < count; j++) callback();
+  }
+  bench.end(n);
+}
diff --git a/benchmark/webstreams/adapters.js b/benchmark/webstreams/adapters.js
new file mode 100644
index 000000000000..ae97e4928f88
--- /dev/null
+++ b/benchmark/webstreams/adapters.js
@@ -0,0 +1,106 @@
+'use strict';
+const common = require('../common.js');
+const {
+  Readable,
+  Writable,
+} = require('node:stream');
+const {
+  ReadableStream,
+  WritableStream,
+} = require('node:stream/web');
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  kind: [
+    'readable-to-web',
+    'readable-from-web',
+    'writable-to-web',
+    'writable-from-web',
+  ],
+});
+
+async function readableToWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  let i = 0;
+  const streamReadable = new Readable({
+    read() {
+      if (i++ < n)
+        this.push(chunk);
+      else
+        this.push(null);
+    },
+  });
+  const reader = Readable.toWeb(streamReadable).getReader();
+  bench.start();
+  while (!(await reader.read()).done);
+  bench.end(n);
+}
+
+function readableFromWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  let i = 0;
+  const readableStream = new ReadableStream({
+    pull(controller) {
+      if (i++ < n)
+        controller.enqueue(chunk);
+      else
+        controller.close();
+    },
+  });
+  const streamReadable = Readable.fromWeb(readableStream);
+  bench.start();
+  streamReadable.on('data', () => {});
+  streamReadable.on('end', () => bench.end(n));
+}
+
+async function writableToWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  const streamWritable = new Writable({
+    write(chunk, encoding, callback) {
+      callback();
+    },
+  });
+  const writer = Writable.toWeb(streamWritable).getWriter();
+  bench.start();
+  for (let i = 0; i < n; i++)
+    await writer.write(chunk);
+  await writer.close();
+  bench.end(n);
+}
+
+function writableFromWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  const writableStream = new WritableStream({
+    write() {},
+  });
+  const streamWritable = Writable.fromWeb(writableStream);
+  bench.start();
+  let i = 0;
+  function writeLoop() {
+    while (i++ < n) {
+      if (!streamWritable.write(chunk)) {
+        streamWritable.once('drain', writeLoop);
+        return;
+      }
+    }
+    streamWritable.end(() => bench.end(n));
+  }
+  writeLoop();
+}
+
+function main({ n, kind }) {
+  switch (kind) {
+    case 'readable-to-web':
+      readableToWeb(n);
+      break;
+    case 'readable-from-web':
+      readableFromWeb(n);
+      break;
+    case 'writable-to-web':
+      writableToWeb(n);
+      break;
+    case 'writable-from-web':
+      writableFromWeb(n);
+      break;
+  }
+}
diff --git a/benchmark/webstreams/lifecycle.js b/benchmark/webstreams/lifecycle.js
new file mode 100644
index 000000000000..421538e4bfd8
--- /dev/null
+++ b/benchmark/webstreams/lifecycle.js
@@ -0,0 +1,76 @@
+'use strict';
+const common = require('../common.js');
+const assert = require('assert');
+const {
+  ReadableStream,
+  WritableStream,
+  TransformStream,
+} = require('node:stream/web');
+
+const bench = common.createBenchmark(main, {
+  n: [5e4],
+  kind: ['readable', 'pipe-to', 'pipe-through'],
+});
+
+const chunk = Buffer.alloc(1024);
+
+function makeSource() {
+  let i = 0;
+  return {
+    pull(controller) {
+      if (i++ < 4)
+        controller.enqueue(chunk);
+      else
+        controller.close();
+    },
+  };
+}
+
+async function readable(n) {
+  let chunks = 0;
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    const reader = new ReadableStream(makeSource()).getReader();
+    while (!(await reader.read()).done) chunks++;
+  }
+  bench.end(n);
+  assert.strictEqual(chunks, n * 4);
+}
+
+async function pipeTo(n) {
+  let chunks = 0;
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    await new ReadableStream(makeSource())
+      .pipeTo(new WritableStream({ write() { chunks++; } }));
+  }
+  bench.end(n);
+  assert.strictEqual(chunks, n * 4);
+}
+
+async function pipeThrough(n) {
+  let chunks = 0;
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    const reader = new ReadableStream(makeSource())
+      .pipeThrough(new TransformStream())
+      .getReader();
+    while (!(await reader.read()).done) chunks++;
+  }
+  bench.end(n);
+  assert.strictEqual(chunks, n * 4);
+}
+
+function main({ n, kind }) {
+  switch (kind) {
+    case 'readable':
+      readable(n);
+      break;
+    case 'pipe-to':
+      pipeTo(n);
+      break;
+    case 'pipe-through':
+      pipeThrough(n);
+      break;
+  }
+}
diff --git a/common.gypi b/common.gypi
index 83e0691d4a2d..bc690955d3da 100644
--- a/common.gypi
+++ b/common.gypi
@@ -42,7 +42,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.53',
+    'v8_embedder_string': '-node.57',
 
     ##### V8 defaults for Node.js #####
 
@@ -75,6 +75,9 @@
     # Disable v8 hugepage by default.
     'v8_enable_hugepage%': 0,
 
+    # Disabled by configure --v8-lite-mode.
+    'v8_enable_webassembly%': 1,
+
     # This is more of a V8 dev setting
     # https://github.com/nodejs/node/pull/22920/files#r222779926
     'v8_enable_fast_mksnapshot': 0,
@@ -509,6 +512,9 @@
       ['v8_enable_v8_checks == 1', {
         'defines': ['V8_ENABLE_CHECKS'],
       }],
+      ['v8_enable_webassembly == 1', {
+        'defines': ['V8_ENABLE_WEBASSEMBLY'],
+      }],
       ['v8_enable_pointer_compression == 1', {
         'defines': ['V8_COMPRESS_POINTERS'],
       }],
@@ -616,6 +622,10 @@
                 'cflags': [ '-m64', '-march=z196' ],
                 'ldflags': [ '-m64', '-march=z196' ],
               }],
+              [ 'host_arch=="riscv64" and OS=="linux"', {
+                'cflags': [ '-march=rv64gc' ],
+                'ldflags': [ '-march=rv64gc' ],
+              }],
             ],
           }],
           ['_toolset=="target"', {
@@ -641,6 +651,10 @@
                 'cflags': [ '-m64', '-march=z196' ],
                 'ldflags': [ '-m64', '-march=z196' ],
               }],
+              [ 'target_arch=="riscv64" and OS=="linux"', {
+                'cflags': [ '-march=rv64gc' ],
+                'ldflags': [ '-march=rv64gc' ],
+              }],
             ],
           }],
         ],
diff --git a/configure.py b/configure.py
index 3c3b5a34925b..b826e24e3f47 100755
--- a/configure.py
+++ b/configure.py
@@ -318,12 +318,6 @@
     dest='shared_hdr_histogram_libpath',
     help='a directory to search for the shared HdrHistogram DLL')
 
-parser.add_argument('--experimental-http-parser',
-    action='store_true',
-    dest='experimental_http_parser',
-    default=None,
-    help='(no-op)')
-
 shared_optgroup.add_argument('--shared-http-parser',
     action='store_true',
     dest='shared_http_parser',
@@ -760,7 +754,7 @@
     action='store_true',
     dest='pointer_compression_shared_cage',
     default=None,
-    help='[Experimental] Use V8 pointer compression with shared cage (requires --experimental-enable-pointer-compression)')
+    help='[Experimental] Use V8 pointer compression with a shared cage and enable the V8 sandbox (requires --experimental-enable-pointer-compression)')
 
 parser.add_argument('--v8-options',
     action='store',
@@ -942,33 +936,12 @@
     default=None,
     help='enable Control Flow Guard (CFG)')
 
-# Dummy option for backwards compatibility
-parser.add_argument('--without-report',
-    action='store_true',
-    dest='unused_without_report',
-    default=None,
-    help=argparse.SUPPRESS)
-
-parser.add_argument('--with-snapshot',
-    action='store_true',
-    dest='unused_with_snapshot',
-    default=None,
-    help=argparse.SUPPRESS)
-
-parser.add_argument('--without-snapshot',
-    action='store_true',
-    dest='unused_without_snapshot',
-    default=None,
-    help=argparse.SUPPRESS)
-
 parser.add_argument('--without-siphash',
     action='store_true',
     dest='without_siphash',
     default=None,
     help=argparse.SUPPRESS)
 
-# End dummy list.
-
 parser.add_argument('--without-ssl',
     action='store_true',
     dest='without_ssl',
@@ -1696,8 +1669,6 @@ def configure_node(o):
                      else target_arch != host_arch)
   if cross_compiling:
     os.environ['GYP_CROSSCOMPILE'] = "1"
-  if options.unused_without_snapshot:
-    warn('building --without-snapshot is no longer possible')
 
   o['variables']['want_separate_host_toolset'] = int(cross_compiling)
 
@@ -1981,16 +1952,10 @@ def configure_v8(o, configs):
   o['variables']['v8_enable_maglev'] = B(not options.v8_disable_maglev and
                                          o['variables']['target_arch'] in maglev_enabled_architectures)
   o['variables']['v8_enable_pointer_compression'] = 1 if options.enable_pointer_compression else 0
-  # Using the sandbox requires always allocating array buffer backing stores in the sandbox.
-  # We currently have many backing stores tied to pointers from C++ land that are not
-  # even necessarily dynamic (e.g. in static storage) for fast communication between JS and C++.
-  # Until we manage to get rid of all those, v8_enable_sandbox cannot be used.
-  # Note that enabling pointer compression without enabling sandbox is unsupported by V8,
-  # so this can be broken at any time.
-  o['variables']['v8_enable_sandbox'] = 0
-  # We set v8_enable_pointer_compression_shared_cage to 0 always, even when
-  # pointer compression is enabled so that we don't accidentally enable shared
-  # cage mode when pointer compression is on.
+  # Like V8's own default, the sandbox goes with the shared pointer compression
+  # cage. Multi-cage builds give every IsolateGroup its own sandbox, which the
+  # array buffer allocator does not know about yet.
+  o['variables']['v8_enable_sandbox'] = 1 if options.pointer_compression_shared_cage else 0
   o['variables']['v8_enable_pointer_compression_shared_cage'] = 1 if options.pointer_compression_shared_cage else 0
   o['variables']['v8_enable_external_code_space'] = 1 if options.enable_pointer_compression else 0
   o['variables']['v8_enable_31bit_smis_on_64bit_arch'] = 1 if options.enable_pointer_compression else 0
diff --git a/deps/brotli/unofficial.gni b/deps/brotli/unofficial.gni
index 91001fa43ea4..0c6a7bd8c450 100644
--- a/deps/brotli/unofficial.gni
+++ b/deps/brotli/unofficial.gni
@@ -4,36 +4,49 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("brotli_gn_build") {
-  config("brotli_config") {
-    include_dirs = [ "c/include" ]
-  }
+import("../../node.gni")
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("brotli.gyp") ],
-                            "scope",
-                            [ "brotli.gyp" ])
-
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":brotli_config" ]
-    sources = gypi_values.brotli_sources
-    if (is_linux) {
-      defines = [ "OS_LINUX" ]
-    } else if (is_mac) {
-      defines = [ "OS_MACOSX" ]
-    } else if (target_os == "freebsd") {
-      defines = [ "OS_FREEBSD" ]
+template("brotli_gn_build") {
+  if (node_shared_brotli) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("brotli_config") {
+      packages = [ "libbrotlidec", "libbrotlienc" ]
     }
-    if (is_linux) {
-      libs = [ "m" ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":brotli_config" ]
     }
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        "-Wno-unreachable-code",
-        "-Wno-unreachable-code-return",
-      ]
+  } else {
+    config("brotli_config") {
+      include_dirs = [ "c/include" ]
+    }
+
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("brotli.gyp") ],
+                              "scope",
+                              [ "brotli.gyp" ])
+
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":brotli_config" ]
+      sources = gypi_values.brotli_sources
+      if (is_linux) {
+        defines = [ "OS_LINUX" ]
+      } else if (is_mac) {
+        defines = [ "OS_MACOSX" ]
+      } else if (target_os == "freebsd") {
+        defines = [ "OS_FREEBSD" ]
+      }
+      if (is_linux) {
+        libs = [ "m" ]
+      }
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          "-Wno-unreachable-code",
+          "-Wno-unreachable-code-return",
+        ]
+      }
     }
   }
 }
diff --git a/deps/cares/unofficial.gni b/deps/cares/unofficial.gni
index e02d7f425194..364df1f312e2 100644
--- a/deps/cares/unofficial.gni
+++ b/deps/cares/unofficial.gni
@@ -4,78 +4,91 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("cares_gn_build") {
-  config("cares_config") {
-    include_dirs = [ "include" ]
-    if (!is_component_build) {
-      defines = [ "CARES_STATICLIB" ]
-    }
-  }
-
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("cares.gyp") ],
-                            "scope",
-                            [ "cares.gyp" ])
+import("../../node.gni")
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":cares_config" ]
-    if (is_component_build) {
-      defines = [ "CARES_BUILDING_LIBRARY" ]
-    } else {
-      defines = []
+template("cares_gn_build") {
+  if (node_shared_cares) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("cares_config") {
+      packages = [ "libcares" ]
     }
-    if (is_win) {
-      defines += [ "CARES_PULL_WS2TCPIP_H=1" ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":cares_config" ]
     }
-    if (is_posix) {
-      defines += [
-        "_DARWIN_USE_64_BIT_INODE=1",
-        "_LARGEFILE_SOURCE",
-        "_FILE_OFFSET_BITS=64",
-        "_GNU_SOURCE",
-        "HAVE_CONFIG_H",
-      ]
+  } else {
+    config("cares_config") {
+      include_dirs = [ "include" ]
+      if (!is_component_build) {
+        defines = [ "CARES_STATICLIB" ]
+      }
     }
 
-    include_dirs = [
-      "src/lib",
-      "src/lib/include",
-    ]
-    if (is_win) {
-      include_dirs += [ "config/win32" ]
-    } else if (is_linux) {
-      include_dirs += [ "config/linux" ]
-    } else if (is_mac) {
-      include_dirs += [ "config/darwin" ]
-    }
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("cares.gyp") ],
+                              "scope",
+                              [ "cares.gyp" ])
 
-    if (is_win) {
-      libs = [
-        "ws2_32.lib",
-        "iphlpapi.lib",
-      ]
-    }
+    component(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":cares_config" ]
+      if (is_component_build) {
+        defines = [ "CARES_BUILDING_LIBRARY" ]
+      } else {
+        defines = []
+      }
+      if (is_win) {
+        defines += [ "CARES_PULL_WS2TCPIP_H=1" ]
+      }
+      if (is_posix) {
+        defines += [
+          "_DARWIN_USE_64_BIT_INODE=1",
+          "_LARGEFILE_SOURCE",
+          "_FILE_OFFSET_BITS=64",
+          "_GNU_SOURCE",
+          "HAVE_CONFIG_H",
+        ]
+      }
 
-    sources = gypi_values.cares_sources_common
-    if (is_linux) {
-      sources += [ "config/linux/ares_config.h" ]
-    }
-    if (is_mac) {
-      sources += gypi_values.cares_sources_mac
-    }
+      include_dirs = [
+        "src/lib",
+        "src/lib/include",
+      ]
+      if (is_win) {
+        include_dirs += [ "config/win32" ]
+      } else if (is_linux) {
+        include_dirs += [ "config/linux" ]
+      } else if (is_mac) {
+        include_dirs += [ "config/darwin" ]
+      }
 
-    if (is_clang) {
       if (is_win) {
-        cflags_c = [
-          "-Wno-macro-redefined",
-        ]
-      } else {
-        cflags_c = [
-          "-Wno-implicit-fallthrough",
-          "-Wno-unreachable-code",
+        libs = [
+          "ws2_32.lib",
+          "iphlpapi.lib",
         ]
       }
+
+      sources = gypi_values.cares_sources_common
+      if (is_linux) {
+        sources += [ "config/linux/ares_config.h" ]
+      }
+      if (is_mac) {
+        sources += gypi_values.cares_sources_mac
+      }
+
+      if (is_clang) {
+        if (is_win) {
+          cflags_c = [
+            "-Wno-macro-redefined",
+          ]
+        } else {
+          cflags_c = [
+            "-Wno-implicit-fallthrough",
+            "-Wno-unreachable-code",
+          ]
+        }
+      }
     }
   }
 }
diff --git a/deps/googletest/include/gtest/gtest-assertion-result.h b/deps/googletest/include/gtest/gtest-assertion-result.h
index a72ac939102e..882e9849353a 100644
--- a/deps/googletest/include/gtest/gtest-assertion-result.h
+++ b/deps/googletest/include/gtest/gtest-assertion-result.h
@@ -143,13 +143,9 @@ class GTEST_API_ [[nodiscard]] AssertionResult {
   // Used in EXPECT_TRUE/FALSE(assertion_result).
   AssertionResult(const AssertionResult& other);
 
-// C4800 is a level 3 warning in Visual Studio 2015 and earlier.
-// This warning is not emitted in Visual Studio 2017.
-// This warning is off by default starting in Visual Studio 2019 but can be
-// enabled with command-line options.
-#if defined(_MSC_VER) && (_MSC_VER < 1910 || _MSC_VER >= 1920)
+  // C4800 is off by default starting in Visual Studio 2019 but can be
+  // enabled with command-line options.
   GTEST_DISABLE_MSC_WARNINGS_PUSH_(4800 /* forcing value to bool */)
-#endif
 
   // Used in the EXPECT_TRUE/FALSE(bool_expression).
   //
@@ -171,9 +167,7 @@ class GTEST_API_ [[nodiscard]] AssertionResult {
                              int> = 0>
   explicit AssertionResult(const T& success) : success_(success) {}
 
-#if defined(_MSC_VER) && (_MSC_VER < 1910 || _MSC_VER >= 1920)
   GTEST_DISABLE_MSC_WARNINGS_POP_()
-#endif
 
   // Assignment operator.
   AssertionResult& operator=(AssertionResult other) {
diff --git a/deps/googletest/include/gtest/gtest-death-test.h b/deps/googletest/include/gtest/gtest-death-test.h
index afd7b3a4685a..337313ea2093 100644
--- a/deps/googletest/include/gtest/gtest-death-test.h
+++ b/deps/googletest/include/gtest/gtest-death-test.h
@@ -105,54 +105,10 @@ GTEST_API_ bool InDeathTestChild();
 //
 // On the regular expressions used in death tests:
 //
-//   On POSIX-compliant systems (*nix), we use the <regex.h> library,
-//   which uses the POSIX extended regex syntax.
-//
-//   On other platforms (e.g. Windows or Mac), we only support a simple regex
-//   syntax implemented as part of Google Test.  This limited
-//   implementation should be enough most of the time when writing
-//   death tests; though it lacks many features you can find in PCRE
-//   or POSIX extended regex syntax.  For example, we don't support
-//   union ("x|y"), grouping ("(xy)"), brackets ("[xy]"), and
-//   repetition count ("x{5,7}"), among others.
-//
-//   Below is the syntax that we do support.  We chose it to be a
-//   subset of both PCRE and POSIX extended regex, so it's easy to
-//   learn wherever you come from.  In the following: 'A' denotes a
-//   literal character, period (.), or a single \\ escape sequence;
-//   'x' and 'y' denote regular expressions; 'm' and 'n' are for
-//   natural numbers.
-//
-//     c     matches any literal character c
-//     \\d   matches any decimal digit
-//     \\D   matches any character that's not a decimal digit
-//     \\f   matches \f
-//     \\n   matches \n
-//     \\r   matches \r
-//     \\s   matches any ASCII whitespace, including \n
-//     \\S   matches any character that's not a whitespace
-//     \\t   matches \t
-//     \\v   matches \v
-//     \\w   matches any letter, _, or decimal digit
-//     \\W   matches any character that \\w doesn't match
-//     \\c   matches any literal character c, which must be a punctuation
-//     .     matches any single character except \n
-//     A?    matches 0 or 1 occurrences of A
-//     A*    matches 0 or many occurrences of A
-//     A+    matches 1 or many occurrences of A
-//     ^     matches the beginning of a string (not that of each line)
-//     $     matches the end of a string (not that of each line)
-//     xy    matches x followed by y
-//
-//   If you accidentally use PCRE or POSIX extended regex features
-//   not implemented by us, you will get a run-time failure.  In that
-//   case, please try to rewrite your regular expression within the
-//   above syntax.
-//
-//   This implementation is *not* meant to be as highly tuned or robust
-//   as a compiled regex library, but should perform well enough for a
-//   death test, which already incurs significant overhead by launching
-//   a child process.
+//   Depending on the platform, this may use RE2, the POSIX <regex.h> library,
+//   the C++11 standard library's <regex> engine with ECMAScript syntax, or
+//   another similar engine. Regular expressions should be simple and portable
+//   enough to work across the engines of interest.
 //
 // Known caveats:
 //
diff --git a/deps/googletest/include/gtest/gtest-matchers.h b/deps/googletest/include/gtest/gtest-matchers.h
index b5950425cc69..4d7a541d0f1f 100644
--- a/deps/googletest/include/gtest/gtest-matchers.h
+++ b/deps/googletest/include/gtest/gtest-matchers.h
@@ -52,16 +52,9 @@
 #include "gtest/internal/gtest-internal.h"
 #include "gtest/internal/gtest-port.h"
 
-// MSVC warning C5046 is new as of VS2017 version 15.8.
-#if defined(_MSC_VER) && _MSC_VER >= 1915
-#define GTEST_MAYBE_5046_ 5046
-#else
-#define GTEST_MAYBE_5046_
-#endif
-
 GTEST_DISABLE_MSC_WARNINGS_PUSH_(
-    4251 GTEST_MAYBE_5046_ /* class A needs to have dll-interface to be used by
-                              clients of class B */
+    // class A needs to have dll-interface to be used by clients of class B
+    4251 5046
     /* Symbol involving type with internal linkage not defined */)
 
 namespace testing {
diff --git a/deps/googletest/include/gtest/gtest-param-test.h b/deps/googletest/include/gtest/gtest-param-test.h
index 9e023f96dc60..64c60da8ac40 100644
--- a/deps/googletest/include/gtest/gtest-param-test.h
+++ b/deps/googletest/include/gtest/gtest-param-test.h
@@ -552,7 +552,7 @@ auto ConvertGenerator(Gen&& gen, Func&& f) {
 
 #define INSTANTIATE_TEST_SUITE_P(prefix, test_suite_name, ...)                \
   static ::testing::internal::ParamGenerator<test_suite_name::ParamType>      \
-      gtest_##prefix##test_suite_name##_EvalGenerator_() {                    \
+  gtest_##prefix##test_suite_name##_EvalGenerator_() {                        \
     return GTEST_EXPAND_(GTEST_GET_FIRST_(__VA_ARGS__, DUMMY_PARAM_));        \
   }                                                                           \
   static ::std::string gtest_##prefix##test_suite_name##_EvalGenerateName_(   \
@@ -562,7 +562,7 @@ auto ConvertGenerator(Gen&& gen, Func&& f) {
           __VA_ARGS__,                                                        \
           ::testing::internal::DefaultParamName<test_suite_name::ParamType>,  \
           DUMMY_PARAM_)));                                                    \
-      auto t = std::make_tuple(__VA_ARGS__);                                  \
+      const auto t = std::make_tuple(__VA_ARGS__);                            \
       static_assert(std::tuple_size<decltype(t)>::value <= 2,                 \
                     "Too Many Args!");                                        \
     }                                                                         \
diff --git a/deps/googletest/include/gtest/gtest-printers.h b/deps/googletest/include/gtest/gtest-printers.h
index 69c9fec3ca95..1288313b99ff 100644
--- a/deps/googletest/include/gtest/gtest-printers.h
+++ b/deps/googletest/include/gtest/gtest-printers.h
@@ -104,6 +104,8 @@
 #ifndef GOOGLETEST_INCLUDE_GTEST_GTEST_PRINTERS_H_
 #define GOOGLETEST_INCLUDE_GTEST_GTEST_PRINTERS_H_
 
+#include <stdint.h>
+
 #include <any>
 #include <functional>
 #include <memory>
@@ -279,15 +281,13 @@ struct ProtobufPrinter {
 
 struct ConvertibleToIntegerPrinter {
   // Since T has no << operator or PrintTo() but can be implicitly
-  // converted to BiggestInt, we print it as a BiggestInt.
+  // converted to intmax_t, we print it as an intmax_t.
   //
   // Most likely T is an enum type (either named or unnamed), in which
   // case printing it as an integer is the desired behavior.  In case
   // T is not an enum, printing it as an integer is the best we can do
   // given that it has no user-defined printer.
-  static void PrintValue(internal::BiggestInt value, ::std::ostream* os) {
-    *os << value;
-  }
+  static void PrintValue(intmax_t value, ::std::ostream* os) { *os << value; }
 };
 
 struct ConvertibleToStringViewPrinter {
@@ -347,7 +347,7 @@ struct FindFirstPrinter<
 //  - Print object pointers.
 //  - Print protocol buffers.
 //  - Use the stream operator, if available.
-//  - Print types convertible to BiggestInt.
+//  - Print types convertible to intmax_t.
 //  - Print types convertible to StringView, if available.
 //  - Fallback to printing the raw bytes of the object.
 template <typename T>
@@ -522,17 +522,14 @@ inline void PrintTo(bool x, ::std::ostream* os) {
 GTEST_API_ void PrintTo(wchar_t wc, ::std::ostream* os);
 
 GTEST_API_ void PrintTo(char32_t c, ::std::ostream* os);
-inline void PrintTo(char16_t c, ::std::ostream* os) {
-  // TODO(b/418738869): Incorrect for values not representing valid codepoints.
-  // Also see https://github.com/google/googletest/issues/4762.
-  PrintTo(static_cast<char32_t>(c), os);
-}
+
+// Overloads for the UTF-8 and UTF-16 code unit types.  A code unit that
+// encodes a code point all by itself is printed with the U+XXXX notation;
+// one that does not (any non-ASCII char8_t, and the UTF-16 surrogates) is
+// printed as a code unit instead, the way wchar_t is.
+GTEST_API_ void PrintTo(char16_t c, ::std::ostream* os);
 #ifdef __cpp_lib_char8_t
-inline void PrintTo(char8_t c, ::std::ostream* os) {
-  // TODO(b/418738869): Incorrect for values not representing valid codepoints.
-  // Also see https://github.com/google/googletest/issues/4762.
-  PrintTo(static_cast<char32_t>(c), os);
-}
+GTEST_API_ void PrintTo(char8_t c, ::std::ostream* os);
 #endif
 
 // gcc/clang __{u,}int128_t
@@ -674,12 +671,12 @@ inline void PrintTo(char32_t* s, ::std::ostream* os) {
   PrintTo(ImplicitCast_<const char32_t*>(s), os);
 }
 
-// MSVC can be configured to define wchar_t as a typedef of unsigned
-// short.  It defines _NATIVE_WCHAR_T_DEFINED when wchar_t is a native
-// type.  When wchar_t is a typedef, defining an overload for const
-// wchar_t* would cause unsigned short* be printed as a wide string,
-// possibly causing invalid memory accesses.
-#if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED)
+// Only add an overload for printing wchar_t* if:
+// 1. Wide string support is enabled.
+// 2. wchar_t is a distinct native type. (If it's a typedef, the overload could
+//    cause a pointer to the underlying type to be mistakenly treated as a
+//    string.)
+#if GTEST_HAS_STD_WSTRING && GTEST_HAS_NATIVE_WCHAR
 // Overloads for wide C strings
 GTEST_API_ void PrintTo(const wchar_t* s, ::std::ostream* os);
 inline void PrintTo(wchar_t* s, ::std::ostream* os) {
diff --git a/deps/googletest/include/gtest/gtest.h b/deps/googletest/include/gtest/gtest.h
index 089b10e9f7a9..7c003c5d60e3 100644
--- a/deps/googletest/include/gtest/gtest.h
+++ b/deps/googletest/include/gtest/gtest.h
@@ -71,7 +71,7 @@
 #include "gtest/gtest-typed-test.h"  // IWYU pragma: export
 #include "gtest/gtest_pred_impl.h"  // IWYU pragma: export
 #include "gtest/gtest_prod.h"  // IWYU pragma: export
-#include "gtest/internal/gtest-internal.h"
+#include "gtest/internal/gtest-internal.h"  // IWYU pragma: export
 #include "gtest/internal/gtest-string.h"
 
 GTEST_DISABLE_MSC_WARNINGS_PUSH_(4251 \
@@ -1419,14 +1419,14 @@ class [[nodiscard]] EqHelper {
   }
 
   // With this overloaded version, we allow anonymous enums to be used
-  // in {ASSERT|EXPECT}_EQ when compiled with gcc 4, as anonymous
-  // enums can be implicitly cast to BiggestInt.
+  // in {ASSERT|EXPECT}_EQ when compiled with gcc 4, as anonymous enums can be
+  // implicitly cast to intmax_t.
   //
   // Even though its body looks the same as the above version, we
   // cannot merge the two, as it will make anonymous enums unhappy.
   static AssertionResult Compare(const char* lhs_expression,
-                                 const char* rhs_expression, BiggestInt lhs,
-                                 BiggestInt rhs) {
+                                 const char* rhs_expression, intmax_t lhs,
+                                 intmax_t rhs) {
     return CmpHelperEQ(lhs_expression, rhs_expression, lhs, rhs);
   }
 
@@ -1514,6 +1514,8 @@ GTEST_API_ AssertionResult CmpHelperSTRCASENE(const char* s1_expression,
                                               const char* s2_expression,
                                               const char* s1, const char* s2);
 
+#if GTEST_HAS_STD_WSTRING
+
 // Helper function for *_STREQ on wide strings.
 //
 // INTERNAL IMPLEMENTATION - DO NOT USE IN A USER PROGRAM.
@@ -1528,6 +1530,8 @@ GTEST_API_ AssertionResult CmpHelperSTRNE(const char* s1_expression,
                                           const char* s2_expression,
                                           const wchar_t* s1, const wchar_t* s2);
 
+#endif  // GTEST_HAS_STD_WSTRING
+
 }  // namespace internal
 
 // IsSubstring() and IsNotSubstring() are intended to be used as the
@@ -1542,18 +1546,10 @@ GTEST_API_ AssertionResult IsSubstring(const char* needle_expr,
                                        const char* haystack_expr,
                                        const char* needle,
                                        const char* haystack);
-GTEST_API_ AssertionResult IsSubstring(const char* needle_expr,
-                                       const char* haystack_expr,
-                                       const wchar_t* needle,
-                                       const wchar_t* haystack);
 GTEST_API_ AssertionResult IsNotSubstring(const char* needle_expr,
                                           const char* haystack_expr,
                                           const char* needle,
                                           const char* haystack);
-GTEST_API_ AssertionResult IsNotSubstring(const char* needle_expr,
-                                          const char* haystack_expr,
-                                          const wchar_t* needle,
-                                          const wchar_t* haystack);
 GTEST_API_ AssertionResult IsSubstring(const char* needle_expr,
                                        const char* haystack_expr,
                                        const ::std::string& needle,
@@ -1564,6 +1560,14 @@ GTEST_API_ AssertionResult IsNotSubstring(const char* needle_expr,
                                           const ::std::string& haystack);
 
 #if GTEST_HAS_STD_WSTRING
+GTEST_API_ AssertionResult IsSubstring(const char* needle_expr,
+                                       const char* haystack_expr,
+                                       const wchar_t* needle,
+                                       const wchar_t* haystack);
+GTEST_API_ AssertionResult IsNotSubstring(const char* needle_expr,
+                                          const char* haystack_expr,
+                                          const wchar_t* needle,
+                                          const wchar_t* haystack);
 GTEST_API_ AssertionResult IsSubstring(const char* needle_expr,
                                        const char* haystack_expr,
                                        const ::std::wstring& needle,
diff --git a/deps/googletest/include/gtest/internal/gtest-internal.h b/deps/googletest/include/gtest/internal/gtest-internal.h
index 55e9966720bf..f845ffed298e 100644
--- a/deps/googletest/include/gtest/internal/gtest-internal.h
+++ b/deps/googletest/include/gtest/internal/gtest-internal.h
@@ -39,7 +39,7 @@
 #ifndef GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_INTERNAL_H_
 #define GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_INTERNAL_H_
 
-#include "gtest/internal/gtest-port.h"
+#include "gtest/internal/gtest-port.h"  // IWYU pragma: export
 
 #ifdef GTEST_OS_LINUX
 #include <stdlib.h>
@@ -1516,8 +1516,9 @@ class [[nodiscard]] NeverThrown {
               parent_class>::GetSetUpCaseOrSuite(__FILE__, __LINE__),          \
           ::testing::internal::SuiteApiResolver<                               \
               parent_class>::GetTearDownCaseOrSuite(__FILE__, __LINE__),       \
-          new ::testing::internal::TestFactoryImpl<GTEST_TEST_CLASS_NAME_(     \
-              test_suite_name, test_name)>);                                   \
+          ::std::make_unique<::testing::internal::TestFactoryImpl<             \
+              GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)>>()           \
+              .release());                                                     \
   void GTEST_TEST_CLASS_NAME_(test_suite_name, test_name)::TestBody()
 
 #endif  // GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_INTERNAL_H_
diff --git a/deps/googletest/include/gtest/internal/gtest-port.h b/deps/googletest/include/gtest/internal/gtest-port.h
index 051228553449..3b2947b852e7 100644
--- a/deps/googletest/include/gtest/internal/gtest-port.h
+++ b/deps/googletest/include/gtest/internal/gtest-port.h
@@ -176,7 +176,7 @@
 //   GTEST_USES_POSIX_RE    - enhanced POSIX regex is used. Do not confuse with
 //                            GTEST_HAS_POSIX_RE (see above) which users can
 //                            define themselves.
-//   GTEST_USES_SIMPLE_RE   - our own simple regex is used;
+//   GTEST_USES_STD_RE      - std::regex from the C++ standard library is used;
 //                            the above RE\b(s) are mutually exclusive.
 //   GTEST_HAS_ABSL         - Google Test is compiled with Abseil.
 
@@ -236,7 +236,6 @@
 // Integer types:
 //   TypeWithSize   - maps an integer to a int type.
 //   TimeInMillis   - integers of known sizes.
-//   BiggestInt     - the biggest signed integer type.
 //
 // Command-line utilities:
 //   GetInjectableArgvs() - returns the command line as a vector of strings.
@@ -342,13 +341,6 @@
 #define GTEST_INIT_GOOGLE_TEST_NAME_ "testing::InitGoogleTest"
 #endif  // !defined(GTEST_INIT_GOOGLE_TEST_NAME_)
 
-// Determines the version of gcc that is used to compile this.
-#ifdef __GNUC__
-// 40302 means version 4.3.2.
-#define GTEST_GCC_VER_ \
-  (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
-#endif  // __GNUC__
-
 // Macros for disabling Microsoft Visual C++ warnings.
 //
 //   GTEST_DISABLE_MSC_WARNINGS_PUSH_(4800 4385)
@@ -446,8 +438,9 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #include <regex.h>  // NOLINT
 #define GTEST_USES_POSIX_RE 1
 #else
-// Use our own simple regex implementation.
-#define GTEST_USES_SIMPLE_RE 1
+// Use std::regex from the C++ standard library.
+#include <regex>  // NOLINT
+#define GTEST_USES_STD_RE 1
 #endif
 
 #ifndef GTEST_HAS_EXCEPTIONS
@@ -456,14 +449,6 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #if defined(_MSC_VER) && defined(_CPPUNWIND)
 // MSVC defines _CPPUNWIND to 1 if and only if exceptions are enabled.
 #define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__BORLANDC__)
-// C++Builder's implementation of the STL uses the _HAS_EXCEPTIONS
-// macro to enable exceptions, so we'll do the same.
-// Assumes that exceptions are enabled by default.
-#ifndef _HAS_EXCEPTIONS
-#define _HAS_EXCEPTIONS 1
-#endif  // _HAS_EXCEPTIONS
-#define GTEST_HAS_EXCEPTIONS _HAS_EXCEPTIONS
 #elif defined(__clang__)
 // clang defines __EXCEPTIONS if and only if exceptions are enabled before clang
 // 220714, but if and only if cleanups are enabled after that. In Obj-C++ files,
@@ -481,25 +466,24 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #elif defined(__GNUC__) && defined(__EXCEPTIONS) && __EXCEPTIONS
 // gcc defines __EXCEPTIONS to 1 if and only if exceptions are enabled.
 #define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__SUNPRO_CC)
-// Sun Pro CC supports exceptions.  However, there is no compile-time way of
-// detecting whether they are enabled or not.  Therefore, we assume that
-// they are enabled unless the user tells us otherwise.
-#define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__IBMCPP__) && defined(__EXCEPTIONS) && __EXCEPTIONS
-// xlC defines __EXCEPTIONS to 1 if and only if exceptions are enabled.
-#define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__HP_aCC)
-// Exception handling is in effect by default in HP aCC compiler. It has to
-// be turned of by +noeh compiler option if desired.
-#define GTEST_HAS_EXCEPTIONS 1
 #else
 // For other compilers, we assume exceptions are disabled to be
 // conservative.
 #define GTEST_HAS_EXCEPTIONS 0
-#endif  // defined(_MSC_VER) || defined(__BORLANDC__)
+#endif  // defined(_MSC_VER) && defined(_CPPUNWIND)
 #endif  // GTEST_HAS_EXCEPTIONS
 
+// MSVC either defines wchar_t as a typedef of unsigned short, or as a native
+// type (in which case, it defines _NATIVE_WCHAR_T_DEFINED). When wchar_t is a
+// typedef, defining an overload for const wchar_t* would cause unsigned short*
+// be printed as a wide string, possibly causing invalid memory accesses, so we
+// omit wchar_t overloads in that case.
+#if defined(_MSC_VER) && !defined(_NATIVE_WCHAR_T_DEFINED)
+#define GTEST_HAS_NATIVE_WCHAR 0
+#else
+#define GTEST_HAS_NATIVE_WCHAR 1
+#endif
+
 // 1. Calculate default GTEST_HAS_STD_WSTRING values based on STL capabilities.
 #if defined(_MSVC_STL_VERSION)
 // Microsoft's STL implementation always supports ::std::wstring.
@@ -610,16 +594,6 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 
 #define GTEST_HAS_RTTI __has_feature(cxx_rtti)
 
-// Starting with version 9.0 IBM Visual Age defines __RTTI_ALL__ to 1 if
-// both the typeid and dynamic_cast features are present.
-#elif defined(__IBMCPP__) && (__IBMCPP__ >= 900)
-
-#ifdef __RTTI_ALL__
-#define GTEST_HAS_RTTI 1
-#else
-#define GTEST_HAS_RTTI 0
-#endif
-
 #else
 
 // For all other compilers, we assume RTTI is enabled.
@@ -741,8 +715,7 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 
 // Typed tests need <typeinfo> and variadic macros, which GCC, VC++ 8.0,
 // Sun Pro CC, IBM Visual Age, and HP aCC support.
-#if defined(__GNUC__) || defined(_MSC_VER) || defined(__SUNPRO_CC) || \
-    defined(__IBMCPP__) || defined(__HP_aCC)
+#if defined(__GNUC__) || defined(_MSC_VER)
 #define GTEST_HAS_TYPED_TEST 1
 #define GTEST_HAS_TYPED_TEST_P 1
 #endif
@@ -856,8 +829,7 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #ifndef GTEST_HAS_SEH
 // The user didn't tell us, so we need to figure it out.
 
-#if defined(_MSC_VER) || defined(__BORLANDC__)
-// These two compilers are known to support SEH.
+#ifdef _MSC_VER
 #define GTEST_HAS_SEH 1
 #else
 // Assume no SEH.
@@ -1021,12 +993,11 @@ class GTEST_API_ [[nodiscard]] RE {
   RE2 regex_;
 };
 
-#elif defined(GTEST_USES_POSIX_RE) || defined(GTEST_USES_SIMPLE_RE)
+#elif defined(GTEST_USES_POSIX_RE) || defined(GTEST_USES_STD_RE)
 GTEST_DISABLE_MSC_WARNINGS_PUSH_(4251 \
 /* class A needs to have dll-interface to be used by clients of class B */)
 
-// A simple C++ wrapper for <regex.h>.  It uses the POSIX Extended
-// Regular Expression syntax.
+// A simple C++ wrapper for <regex.h> or <regex>.
 class GTEST_API_ [[nodiscard]] RE {
  public:
   // A copy constructor is required by the Standard to initialize object
@@ -1066,9 +1037,9 @@ class GTEST_API_ [[nodiscard]] RE {
   regex_t full_regex_;     // For FullMatch().
   regex_t partial_regex_;  // For PartialMatch().
 
-#else  // GTEST_USES_SIMPLE_RE
+#else  // GTEST_USES_STD_RE
 
-  std::string full_pattern_;  // For FullMatch();
+  std::regex regex_;
 
 #endif
 };
@@ -1784,14 +1755,16 @@ class [[nodiscard]] MutexBase {
 #define GTEST_DECLARE_STATIC_MUTEX_(mutex) \
   extern ::testing::internal::MutexBase mutex
 
+#if defined(PTHREAD_NULL)
+#define GTEST_INTERNAL_PTHREAD_NULL PTHREAD_NULL
+#else
+#define GTEST_INTERNAL_PTHREAD_NULL (pthread_t{})
+#endif
+
 // Defines and statically (i.e. at link time) initializes a static mutex.
-// The initialization list here does not explicitly initialize each field,
-// instead relying on default initialization for the unspecified fields. In
-// particular, the owner_ field (a pthread_t) is not explicitly initialized.
-// This allows initialization to work whether pthread_t is a scalar or struct.
-// The flag -Wmissing-field-initializers must not be specified for this to work.
-#define GTEST_DEFINE_STATIC_MUTEX_(mutex) \
-  ::testing::internal::MutexBase mutex = {PTHREAD_MUTEX_INITIALIZER, false, 0}
+#define GTEST_DEFINE_STATIC_MUTEX_(mutex)                                   \
+  ::testing::internal::MutexBase mutex = {PTHREAD_MUTEX_INITIALIZER, false, \
+                                          GTEST_INTERNAL_PTHREAD_NULL}
 
 // The Mutex class can only be used for mutexes created at runtime. It
 // shares its API with MutexBase otherwise.
@@ -2135,12 +2108,6 @@ inline bool IsDir(const StatStruct& st) { return S_ISDIR(st.st_mode); }
 
 #ifdef GTEST_OS_WINDOWS
 
-#ifdef __BORLANDC__
-inline int DoIsATTY(int fd) { return isatty(fd); }
-inline int StrCaseCmp(const char* s1, const char* s2) {
-  return stricmp(s1, s2);
-}
-#else  // !__BORLANDC__
 #if defined(GTEST_OS_WINDOWS_MOBILE) || defined(GTEST_OS_ZOS) || \
     defined(GTEST_OS_IOS) || defined(GTEST_OS_WINDOWS_PHONE) ||  \
     defined(GTEST_OS_WINDOWS_RT) || defined(ESP_PLATFORM)
@@ -2151,7 +2118,6 @@ inline int DoIsATTY(int fd) { return _isatty(fd); }
 inline int StrCaseCmp(const char* s1, const char* s2) {
   return _stricmp(s1, s2);
 }
-#endif  // __BORLANDC__
 
 #else
 
@@ -2185,7 +2151,13 @@ GTEST_DISABLE_DEPRECATED_PUSH_()
     !defined(GTEST_OS_WINDOWS_RT) && !defined(GTEST_OS_WINDOWS_GAMES) &&     \
     !defined(GTEST_OS_ESP8266) && !defined(GTEST_OS_XTENSA) &&               \
     !defined(GTEST_OS_QURT)
-inline int ChDir(const char* dir) { return chdir(dir); }
+inline int ChDir(const char* dir) {
+#ifdef GTEST_OS_WINDOWS
+  return _chdir(dir);
+#else
+  return chdir(dir);
+#endif
+}
 #endif
 inline FILE* FOpen(const char* path, const char* mode) {
 #if defined(GTEST_OS_WINDOWS) && !defined(GTEST_OS_WINDOWS_MINGW)
@@ -2202,17 +2174,37 @@ inline FILE* FOpen(const char* path, const char* mode) {
 inline FILE* FReopen(const char* path, const char* mode, FILE* stream) {
   return freopen(path, mode, stream);
 }
-inline FILE* FDOpen(int fd, const char* mode) { return fdopen(fd, mode); }
+inline FILE* FDOpen(int fd, const char* mode) {
+#ifdef GTEST_OS_WINDOWS
+  return _fdopen(fd, mode);
+#else
+  return fdopen(fd, mode);
+#endif
+}
 #endif  // !GTEST_OS_WINDOWS_MOBILE && !GTEST_OS_QURT
 inline int FClose(FILE* fp) { return fclose(fp); }
 #if !defined(GTEST_OS_WINDOWS_MOBILE) && !defined(GTEST_OS_QURT)
 inline int Read(int fd, void* buf, unsigned int count) {
+#ifdef GTEST_OS_WINDOWS
+  return static_cast<int>(_read(fd, buf, count));
+#else
   return static_cast<int>(read(fd, buf, count));
+#endif
 }
 inline int Write(int fd, const void* buf, unsigned int count) {
+#ifdef GTEST_OS_WINDOWS
+  return static_cast<int>(_write(fd, buf, count));
+#else
   return static_cast<int>(write(fd, buf, count));
+#endif
+}
+inline int Close(int fd) {
+#ifdef GTEST_OS_WINDOWS
+  return _close(fd);
+#else
+  return close(fd);
+#endif
 }
-inline int Close(int fd) { return close(fd); }
 #endif  // !GTEST_OS_WINDOWS_MOBILE && !GTEST_OS_QURT
 #endif  // GTEST_HAS_FILE_SYSTEM
 
@@ -2227,11 +2219,6 @@ inline const char* GetEnv(const char* name) {
   // We are on an embedded platform, which has no environment variables.
   static_cast<void>(name);  // To prevent 'unused argument' warning.
   return nullptr;
-#elif defined(__BORLANDC__) || defined(__SunOS_5_8) || defined(__SunOS_5_9)
-  // Environment variables which we programmatically clear will be set to the
-  // empty string rather than unset (NULL).  Handle that case.
-  const char* const env = getenv(name);
-  return (env != nullptr && env[0] != '\0') ? env : nullptr;
 #else
   return getenv(name);
 #endif
@@ -2266,14 +2253,6 @@ GTEST_DISABLE_DEPRECATED_POP_()
 #define GTEST_SNPRINTF_ snprintf
 #endif
 
-// The biggest signed integer type the compiler supports.
-//
-// long long is guaranteed to be at least 64-bits in C++11.
-using BiggestInt = long long;  // NOLINT
-
-// The maximum number a BiggestInt can represent.
-constexpr BiggestInt kMaxBiggestInt = (std::numeric_limits<BiggestInt>::max)();
-
 // This template class serves as a compile-time function from size to
 // type.  It maps a size in bytes to a primitive type with that
 // size. e.g.
diff --git a/deps/googletest/include/gtest/internal/gtest-string.h b/deps/googletest/include/gtest/internal/gtest-string.h
index 2363034fc0db..d0652c13c68e 100644
--- a/deps/googletest/include/gtest/internal/gtest-string.h
+++ b/deps/googletest/include/gtest/internal/gtest-string.h
@@ -43,11 +43,6 @@
 #ifndef GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_
 #define GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_
 
-#ifdef __BORLANDC__
-// string.h is not guaranteed to provide strcpy on C++ Builder.
-#include <mem.h>
-#endif
-
 #include <string.h>
 
 #include <cstdint>
diff --git a/deps/googletest/include/gtest/internal/gtest-type-util.h b/deps/googletest/include/gtest/internal/gtest-type-util.h
index 78da05316d6b..fb4d6823744e 100644
--- a/deps/googletest/include/gtest/internal/gtest-type-util.h
+++ b/deps/googletest/include/gtest/internal/gtest-type-util.h
@@ -47,8 +47,6 @@
 // libstdc++ (which is where cxxabi.h comes from).
 #if GTEST_HAS_CXXABI_H_
 #include <cxxabi.h>
-#elif defined(__HP_aCC)
-#include <acxx_demangle.h>
 #endif  // GTEST_HASH_CXXABI_H_
 
 namespace testing {
@@ -90,13 +88,11 @@ inline std::string CanonicalizeForStdLibVersioning(std::string s) {
 // GetTypeName(const std::type_info&) returns a human-readable name of type T.
 inline std::string GetTypeName(const std::type_info& type) {
   const char* const name = type.name();
-#if GTEST_HAS_CXXABI_H_ || defined(__HP_aCC)
+#if GTEST_HAS_CXXABI_H_
   int status = 0;
   // gcc's implementation of typeid(T).name() mangles the type name,
   // so we have to demangle it.
-#if GTEST_HAS_CXXABI_H_
   using abi::__cxa_demangle;
-#endif  // GTEST_HAS_CXXABI_H_
   char* const readable_name = __cxa_demangle(name, nullptr, nullptr, &status);
   const std::string name_str(status == 0 ? readable_name : name);
   free(readable_name);
@@ -117,7 +113,7 @@ inline std::string GetTypeName(const std::type_info& type) {
   return s;
 #else
   return name;
-#endif  // GTEST_HAS_CXXABI_H_ || __HP_aCC
+#endif  // GTEST_HAS_CXXABI_H_
 }
 #endif  // GTEST_HAS_RTTI
 
diff --git a/deps/googletest/src/gtest-internal-inl.h b/deps/googletest/src/gtest-internal-inl.h
index 4bebca1bc656..5a6332a755ae 100644
--- a/deps/googletest/src/gtest-internal-inl.h
+++ b/deps/googletest/src/gtest-internal-inl.h
@@ -980,26 +980,7 @@ inline UnitTestImpl* GetUnitTestImpl() {
   return UnitTest::GetInstance()->impl();
 }
 
-#ifdef GTEST_USES_SIMPLE_RE
-
-// Internal helper functions for implementing the simple regular
-// expression matcher.
-GTEST_API_ bool IsInSet(char ch, const char* str);
-GTEST_API_ bool IsAsciiDigit(char ch);
-GTEST_API_ bool IsAsciiPunct(char ch);
-GTEST_API_ bool IsRepeat(char ch);
-GTEST_API_ bool IsAsciiWhiteSpace(char ch);
-GTEST_API_ bool IsAsciiWordChar(char ch);
-GTEST_API_ bool IsValidEscape(char ch);
-GTEST_API_ bool AtomMatchesChar(bool escaped, char pattern, char ch);
-GTEST_API_ bool ValidateRegex(const char* regex);
-GTEST_API_ bool MatchRegexAtHead(const char* regex, const char* str);
-GTEST_API_ bool MatchRepetitionAndRegexAtHead(bool escaped, char ch,
-                                              char repeat, const char* regex,
-                                              const char* str);
-GTEST_API_ bool MatchRegexAnywhere(const char* regex, const char* str);
-
-#endif  // GTEST_USES_SIMPLE_RE
+
 
 // Parses the command line for Google Test flags, without initializing
 // other parts of Google Test.
diff --git a/deps/googletest/src/gtest-port.cc b/deps/googletest/src/gtest-port.cc
index 433586f3b711..68f77f71247b 100644
--- a/deps/googletest/src/gtest-port.cc
+++ b/deps/googletest/src/gtest-port.cc
@@ -766,249 +766,46 @@ void RE::Init(const char* regex) {
   delete[] full_pattern;
 }
 
-#elif defined(GTEST_USES_SIMPLE_RE)
-
-// Returns true if and only if ch appears anywhere in str (excluding the
-// terminating '\0' character).
-bool IsInSet(char ch, const char* str) {
-  return ch != '\0' && strchr(str, ch) != nullptr;
-}
-
-// Returns true if and only if ch belongs to the given classification.
-// Unlike similar functions in <ctype.h>, these aren't affected by the
-// current locale.
-bool IsAsciiDigit(char ch) { return '0' <= ch && ch <= '9'; }
-bool IsAsciiPunct(char ch) {
-  return IsInSet(ch, "^-!\"#$%&'()*+,./:;<=>?@[\\]_`{|}~");
-}
-bool IsRepeat(char ch) { return IsInSet(ch, "?*+"); }
-bool IsAsciiWhiteSpace(char ch) { return IsInSet(ch, " \f\n\r\t\v"); }
-bool IsAsciiWordChar(char ch) {
-  return ('a' <= ch && ch <= 'z') || ('A' <= ch && ch <= 'Z') ||
-         ('0' <= ch && ch <= '9') || ch == '_';
-}
-
-// Returns true if and only if "\\c" is a supported escape sequence.
-bool IsValidEscape(char c) {
-  return (IsAsciiPunct(c) || IsInSet(c, "dDfnrsStvwW"));
-}
-
-// Returns true if and only if the given atom (specified by escaped and
-// pattern) matches ch.  The result is undefined if the atom is invalid.
-bool AtomMatchesChar(bool escaped, char pattern_char, char ch) {
-  if (escaped) {  // "\\p" where p is pattern_char.
-    switch (pattern_char) {
-      case 'd':
-        return IsAsciiDigit(ch);
-      case 'D':
-        return !IsAsciiDigit(ch);
-      case 'f':
-        return ch == '\f';
-      case 'n':
-        return ch == '\n';
-      case 'r':
-        return ch == '\r';
-      case 's':
-        return IsAsciiWhiteSpace(ch);
-      case 'S':
-        return !IsAsciiWhiteSpace(ch);
-      case 't':
-        return ch == '\t';
-      case 'v':
-        return ch == '\v';
-      case 'w':
-        return IsAsciiWordChar(ch);
-      case 'W':
-        return !IsAsciiWordChar(ch);
-    }
-    return IsAsciiPunct(pattern_char) && pattern_char == ch;
-  }
-
-  return (pattern_char == '.' && ch != '\n') || pattern_char == ch;
-}
-
-// Helper function used by ValidateRegex() to format error messages.
-static std::string FormatRegexSyntaxError(const char* regex, int index) {
-  return (Message() << "Syntax error at index " << index
-                    << " in simple regular expression \"" << regex << "\": ")
-      .GetString();
-}
-
-// Generates non-fatal failures and returns false if regex is invalid;
-// otherwise returns true.
-bool ValidateRegex(const char* regex) {
-  if (regex == nullptr) {
-    ADD_FAILURE() << "NULL is not a valid simple regular expression.";
-    return false;
-  }
-
-  bool is_valid = true;
-
-  // True if and only if ?, *, or + can follow the previous atom.
-  bool prev_repeatable = false;
-  for (int i = 0; regex[i]; i++) {
-    if (regex[i] == '\\') {  // An escape sequence
-      i++;
-      if (regex[i] == '\0') {
-        ADD_FAILURE() << FormatRegexSyntaxError(regex, i - 1)
-                      << "'\\' cannot appear at the end.";
-        return false;
-      }
-
-      if (!IsValidEscape(regex[i])) {
-        ADD_FAILURE() << FormatRegexSyntaxError(regex, i - 1)
-                      << "invalid escape sequence \"\\" << regex[i] << "\".";
-        is_valid = false;
-      }
-      prev_repeatable = true;
-    } else {  // Not an escape sequence.
-      const char ch = regex[i];
-
-      if (ch == '^' && i > 0) {
-        ADD_FAILURE() << FormatRegexSyntaxError(regex, i)
-                      << "'^' can only appear at the beginning.";
-        is_valid = false;
-      } else if (ch == '$' && regex[i + 1] != '\0') {
-        ADD_FAILURE() << FormatRegexSyntaxError(regex, i)
-                      << "'$' can only appear at the end.";
-        is_valid = false;
-      } else if (IsInSet(ch, "()[]{}|")) {
-        ADD_FAILURE() << FormatRegexSyntaxError(regex, i) << "'" << ch
-                      << "' is unsupported.";
-        is_valid = false;
-      } else if (IsRepeat(ch) && !prev_repeatable) {
-        ADD_FAILURE() << FormatRegexSyntaxError(regex, i) << "'" << ch
-                      << "' can only follow a repeatable token.";
-        is_valid = false;
-      }
-
-      prev_repeatable = !IsInSet(ch, "^$?*+");
-    }
-  }
-
-  return is_valid;
-}
-
-// Matches a repeated regex atom followed by a valid simple regular
-// expression.  The regex atom is defined as c if escaped is false,
-// or \c otherwise.  repeat is the repetition meta character (?, *,
-// or +).  The behavior is undefined if str contains too many
-// characters to be indexable by size_t, in which case the test will
-// probably time out anyway.  We are fine with this limitation as
-// std::string has it too.
-bool MatchRepetitionAndRegexAtHead(bool escaped, char c, char repeat,
-                                   const char* regex, const char* str) {
-  const size_t min_count = (repeat == '+') ? 1 : 0;
-  const size_t max_count = (repeat == '?') ? 1 : static_cast<size_t>(-1) - 1;
-  // We cannot call numeric_limits::max() as it conflicts with the
-  // max() macro on Windows.
-
-  for (size_t i = 0; i <= max_count; ++i) {
-    // We know that the atom matches each of the first i characters in str.
-    if (i >= min_count && MatchRegexAtHead(regex, str + i)) {
-      // We have enough matches at the head, and the tail matches too.
-      // Since we only care about *whether* the pattern matches str
-      // (as opposed to *how* it matches), there is no need to find a
-      // greedy match.
-      return true;
-    }
-    if (str[i] == '\0' || !AtomMatchesChar(escaped, c, str[i])) return false;
-  }
-  return false;
-}
-
-// Returns true if and only if regex matches a prefix of str. regex must
-// be a valid simple regular expression and not start with "^", or the
-// result is undefined.
-bool MatchRegexAtHead(const char* regex, const char* str) {
-  if (*regex == '\0')  // An empty regex matches a prefix of anything.
-    return true;
-
-  // "$" only matches the end of a string.  Note that regex being
-  // valid guarantees that there's nothing after "$" in it.
-  if (*regex == '$') return *str == '\0';
-
-  // Is the first thing in regex an escape sequence?
-  const bool escaped = *regex == '\\';
-  if (escaped) ++regex;
-  if (IsRepeat(regex[1])) {
-    // MatchRepetitionAndRegexAtHead() calls MatchRegexAtHead(), so
-    // here's an indirect recursion.  It terminates as the regex gets
-    // shorter in each recursion.
-    return MatchRepetitionAndRegexAtHead(escaped, regex[0], regex[1], regex + 2,
-                                         str);
-  } else {
-    // regex isn't empty, isn't "$", and doesn't start with a
-    // repetition.  We match the first atom of regex with the first
-    // character of str and recurse.
-    return (*str != '\0') && AtomMatchesChar(escaped, *regex, *str) &&
-           MatchRegexAtHead(regex + 1, str + 1);
-  }
-}
-
-// Returns true if and only if regex matches any substring of str.  regex must
-// be a valid simple regular expression, or the result is undefined.
-//
-// The algorithm is recursive, but the recursion depth doesn't exceed
-// the regex length, so we won't need to worry about running out of
-// stack space normally.  In rare cases the time complexity can be
-// exponential with respect to the regex length + the string length,
-// but usually it's must faster (often close to linear).
-bool MatchRegexAnywhere(const char* regex, const char* str) {
-  if (regex == nullptr || str == nullptr) return false;
-
-  if (*regex == '^') return MatchRegexAtHead(regex + 1, str);
-
-  // A successful match can be anywhere in str.
-  do {
-    if (MatchRegexAtHead(regex, str)) return true;
-  } while (*str++ != '\0');
-  return false;
-}
-
-// Implements the RE class.
+#elif defined(GTEST_USES_STD_RE)
 
 RE::~RE() = default;
 
 // Returns true if and only if regular expression re matches the entire str.
 bool RE::FullMatch(const char* str, const RE& re) {
-  return re.is_valid_ && MatchRegexAnywhere(re.full_pattern_.c_str(), str);
+  if (!re.is_valid_ || str == nullptr) return false;
+  return std::regex_match(str, re.regex_);
 }
 
 // Returns true if and only if regular expression re matches a substring of
 // str (including str itself).
 bool RE::PartialMatch(const char* str, const RE& re) {
-  return re.is_valid_ && MatchRegexAnywhere(re.pattern_.c_str(), str);
+  if (!re.is_valid_ || str == nullptr) return false;
+  return std::regex_search(str, re.regex_);
 }
 
 // Initializes an RE from its string representation.
 void RE::Init(const char* regex) {
-  full_pattern_.clear();
-  pattern_.clear();
+  pattern_ = regex == nullptr ? "" : regex;
+  is_valid_ = false;
 
-  if (regex != nullptr) {
-    pattern_ = regex;
-  }
-
-  is_valid_ = ValidateRegex(regex);
-  if (!is_valid_) {
-    // No need to calculate the full pattern when the regex is invalid.
+  if (regex == nullptr) {
+    ADD_FAILURE() << "NULL is not a valid regular expression.";
     return;
   }
 
-  // Reserves enough bytes to hold the regular expression used for a
-  // full match: we need space to prepend a '^' and append a '$'.
-  full_pattern_.reserve(pattern_.size() + 2);
-
-  if (pattern_.empty() || pattern_.front() != '^') {
-    full_pattern_.push_back('^');  // Makes sure full_pattern_ starts with '^'.
+#if GTEST_HAS_EXCEPTIONS
+  try {
+    regex_ = std::regex(regex, std::regex_constants::ECMAScript);
+  } catch (const std::regex_error& e) {
+    ADD_FAILURE() << "Regular expression \"" << regex
+                  << "\" is not a valid regular expression: " << e.what();
+    return;
   }
+#else
+  regex_ = std::regex(regex, std::regex_constants::ECMAScript);
+#endif
 
-  full_pattern_.append(pattern_);
-
-  if (pattern_.empty() || pattern_.back() != '$') {
-    full_pattern_.push_back('$');  // Makes sure full_pattern_ ends with '$'.
-  }
+  is_valid_ = true;
 }
 
 #endif  // GTEST_USES_POSIX_RE
@@ -1085,7 +882,14 @@ bool EndsWithPathSeparator(const std::string& path) {
 class CapturedStream {
  public:
   // The ctor redirects the stream to a temporary file.
-  explicit CapturedStream(int fd) : fd_(fd), uncaptured_fd_(dup(fd)) {
+  explicit CapturedStream(int fd)
+      : fd_(fd),
+#ifdef GTEST_OS_WINDOWS
+        uncaptured_fd_(_dup(fd))
+#else
+        uncaptured_fd_(dup(fd))
+#endif
+  {
 #ifdef GTEST_OS_WINDOWS
     char temp_dir_path[MAX_PATH + 1] = {'\0'};   // NOLINT
     char temp_file_path[MAX_PATH + 1] = {'\0'};  // NOLINT
@@ -1097,7 +901,7 @@ class CapturedStream {
     GTEST_CHECK_(success != 0)
         << "Failed to create temporary file in " << temp_dir_path
         << " with error " << ::GetLastError();
-    const int captured_fd = creat(temp_file_path, _S_IREAD | _S_IWRITE);
+    const int captured_fd = _creat(temp_file_path, _S_IREAD | _S_IWRITE);
     GTEST_CHECK_(captured_fd != -1)
         << "Failed to open temporary file " << temp_file_path << " with error "
         << ::GetLastError();
@@ -1167,8 +971,12 @@ class CapturedStream {
     filename_ = std::move(name_template);
 #endif  // GTEST_OS_WINDOWS
     fflush(nullptr);
+#ifdef GTEST_OS_WINDOWS
+    _dup2(captured_fd, fd_);
+#else
     dup2(captured_fd, fd_);
-    close(captured_fd);
+#endif
+    posix::Close(captured_fd);
   }
 
   ~CapturedStream() { remove(filename_.c_str()); }
@@ -1177,8 +985,12 @@ class CapturedStream {
     if (uncaptured_fd_ != -1) {
       // Restores the original stream.
       fflush(nullptr);
+#ifdef GTEST_OS_WINDOWS
+      _dup2(uncaptured_fd_, fd_);
+#else
       dup2(uncaptured_fd_, fd_);
-      close(uncaptured_fd_);
+#endif
+      posix::Close(uncaptured_fd_);
       uncaptured_fd_ = -1;
     }
 
@@ -1227,14 +1039,14 @@ static std::string GetCapturedStream(CapturedStream** captured_stream) {
   return content;
 }
 
-#if defined(_MSC_VER) || defined(__BORLANDC__)
-// MSVC and C++Builder do not provide a definition of STDERR_FILENO.
+#if defined(_MSC_VER)
+// MSVC does not provide a definition of STDERR_FILENO.
 const int kStdOutFileno = 1;
 const int kStdErrFileno = 2;
 #else
 const int kStdOutFileno = STDOUT_FILENO;
 const int kStdErrFileno = STDERR_FILENO;
-#endif  // defined(_MSC_VER) || defined(__BORLANDC__)
+#endif  // defined(_MSC_VER)
 
 // Starts capturing stdout.
 void CaptureStdout() {
diff --git a/deps/googletest/src/gtest-printers.cc b/deps/googletest/src/gtest-printers.cc
index 975ebb829876..17ac19f691c5 100644
--- a/deps/googletest/src/gtest-printers.cc
+++ b/deps/googletest/src/gtest-printers.cc
@@ -286,6 +286,28 @@ void PrintTo(char32_t c, ::std::ostream* os) {
       << static_cast<uint32_t>(c);
 }
 
+// char8_t and char16_t hold code units, not code points, so the U+XXXX
+// notation only applies to the values that encode a code point on their own.
+// The rest -- non-ASCII char8_t, which are always part of a multi-unit UTF-8
+// sequence, and the UTF-16 surrogates -- are printed as code units.
+void PrintTo(char16_t c, ::std::ostream* os) {
+  if (c >= 0xD800 && c <= 0xDFFF) {
+    PrintCharAndCodeTo(c, os);
+  } else {
+    PrintTo(static_cast<char32_t>(c), os);
+  }
+}
+
+#ifdef __cpp_lib_char8_t
+void PrintTo(char8_t c, ::std::ostream* os) {
+  if (c >= 0x80) {
+    PrintCharAndCodeTo(c, os);
+  } else {
+    PrintTo(static_cast<char32_t>(c), os);
+  }
+}
+#endif
+
 // gcc/clang __{u,}int128_t
 #if defined(__SIZEOF_INT128__)
 void PrintTo(__uint128_t v, ::std::ostream* os) {
@@ -468,16 +490,9 @@ void PrintTo(const char16_t* s, ostream* os) { PrintCStringTo(s, os); }
 
 void PrintTo(const char32_t* s, ostream* os) { PrintCStringTo(s, os); }
 
-// MSVC compiler can be configured to define whar_t as a typedef
-// of unsigned short. Defining an overload for const wchar_t* in that case
-// would cause pointers to unsigned shorts be printed as wide strings,
-// possibly accessing more memory than intended and causing invalid
-// memory accesses. MSVC defines _NATIVE_WCHAR_T_DEFINED symbol when
-// wchar_t is implemented as a native type.
-#if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED)
-// Prints the given wide C string to the ostream.
+#if GTEST_HAS_STD_WSTRING && GTEST_HAS_NATIVE_WCHAR
 void PrintTo(const wchar_t* s, ostream* os) { PrintCStringTo(s, os); }
-#endif  // wchar_t is native
+#endif
 
 namespace {
 
diff --git a/deps/googletest/src/gtest.cc b/deps/googletest/src/gtest.cc
index 3c855468268f..3772f18552dc 100644
--- a/deps/googletest/src/gtest.cc
+++ b/deps/googletest/src/gtest.cc
@@ -1876,11 +1876,13 @@ bool IsSubstringPred(const char* needle, const char* haystack) {
   return strstr(haystack, needle) != nullptr;
 }
 
+#if GTEST_HAS_STD_WSTRING
 bool IsSubstringPred(const wchar_t* needle, const wchar_t* haystack) {
   if (needle == nullptr || haystack == nullptr) return needle == haystack;
 
   return wcsstr(haystack, needle) != nullptr;
 }
+#endif  // GTEST_HAS_STD_WSTRING
 
 // StringType here can be either ::std::string or ::std::wstring.
 template <typename StringType>
@@ -1922,23 +1924,12 @@ AssertionResult IsSubstring(const char* needle_expr, const char* haystack_expr,
   return IsSubstringImpl(true, needle_expr, haystack_expr, needle, haystack);
 }
 
-AssertionResult IsSubstring(const char* needle_expr, const char* haystack_expr,
-                            const wchar_t* needle, const wchar_t* haystack) {
-  return IsSubstringImpl(true, needle_expr, haystack_expr, needle, haystack);
-}
-
 AssertionResult IsNotSubstring(const char* needle_expr,
                                const char* haystack_expr, const char* needle,
                                const char* haystack) {
   return IsSubstringImpl(false, needle_expr, haystack_expr, needle, haystack);
 }
 
-AssertionResult IsNotSubstring(const char* needle_expr,
-                               const char* haystack_expr, const wchar_t* needle,
-                               const wchar_t* haystack) {
-  return IsSubstringImpl(false, needle_expr, haystack_expr, needle, haystack);
-}
-
 AssertionResult IsSubstring(const char* needle_expr, const char* haystack_expr,
                             const ::std::string& needle,
                             const ::std::string& haystack) {
@@ -1953,6 +1944,17 @@ AssertionResult IsNotSubstring(const char* needle_expr,
 }
 
 #if GTEST_HAS_STD_WSTRING
+AssertionResult IsSubstring(const char* needle_expr, const char* haystack_expr,
+                            const wchar_t* needle, const wchar_t* haystack) {
+  return IsSubstringImpl(true, needle_expr, haystack_expr, needle, haystack);
+}
+
+AssertionResult IsNotSubstring(const char* needle_expr,
+                               const char* haystack_expr, const wchar_t* needle,
+                               const wchar_t* haystack) {
+  return IsSubstringImpl(false, needle_expr, haystack_expr, needle, haystack);
+}
+
 AssertionResult IsSubstring(const char* needle_expr, const char* haystack_expr,
                             const ::std::wstring& needle,
                             const ::std::wstring& haystack) {
@@ -2182,6 +2184,7 @@ bool String::WideCStringEquals(const wchar_t* lhs, const wchar_t* rhs) {
   return wcscmp(lhs, rhs) == 0;
 }
 
+#if GTEST_HAS_STD_WSTRING
 // Helper function for *_STREQ on wide strings.
 AssertionResult CmpHelperSTREQ(const char* lhs_expression,
                                const char* rhs_expression, const wchar_t* lhs,
@@ -2206,6 +2209,7 @@ AssertionResult CmpHelperSTRNE(const char* s1_expression,
          << "Expected: (" << s1_expression << ") != (" << s2_expression
          << "), actual: " << PrintToString(s1) << " vs " << PrintToString(s2);
 }
+#endif  // GTEST_HAS_STD_WSTRING
 
 // Compares two C strings, ignoring case.  Returns true if and only if they have
 // the same content.
@@ -4644,7 +4648,7 @@ std::string JsonUnitTestResultPrinter::EscapeJson(const std::string& str) {
         m << "\\r";
         break;
       default:
-        if (ch < ' ') {
+        if (static_cast<unsigned char>(ch) < ' ' || ch == '\x7F') {
           m << "\\u00" << String::FormatByte(static_cast<unsigned char>(ch));
         } else {
           m << ch;
@@ -5285,17 +5289,8 @@ void TestEventListeners::SuppressEventForwarding(bool suppress) {
 // call this before main() starts, from which point on the return
 // value will never change.
 UnitTest* UnitTest::GetInstance() {
-  // CodeGear C++Builder insists on a public destructor for the
-  // default implementation.  Use this implementation to keep good OO
-  // design with private destructor.
-
-#if defined(__BORLANDC__)
-  static UnitTest* const instance = new UnitTest;
-  return instance;
-#else
   static UnitTest instance;
   return &instance;
-#endif  // defined(__BORLANDC__)
 }
 
 // Gets the number of successful test suites.
diff --git a/deps/histogram/unofficial.gni b/deps/histogram/unofficial.gni
index 1173ab298ae7..fd8c3a276bcb 100644
--- a/deps/histogram/unofficial.gni
+++ b/deps/histogram/unofficial.gni
@@ -4,29 +4,42 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("histogram_gn_build") {
-  config("histogram_config") {
-    include_dirs = [ "include" ]
-  }
+  if (node_shared_hdr_histogram) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("histogram_config") {
+      packages = [ "hdr_histogram" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":histogram_config" ]
+    }
+  } else {
+    config("histogram_config") {
+      include_dirs = [ "include" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("histogram.gyp") ],
-                            "scope",
-                            [ "histogram.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("histogram.gyp") ],
+                              "scope",
+                              [ "histogram.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":histogram_config" ]
-    sources = gypi_values.histogram_sources
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-atomic-alignment",
-        "-Wno-incompatible-pointer-types",
-        "-Wno-unused-function",
-      ]
-    }
-    if (is_linux) {
-      libs = [ "atomic" ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":histogram_config" ]
+      sources = gypi_values.histogram_sources
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-atomic-alignment",
+          "-Wno-incompatible-pointer-types",
+          "-Wno-unused-function",
+        ]
+      }
+      if (is_linux) {
+        libs = [ "atomic" ]
+      }
     }
   }
 }
diff --git a/deps/llhttp/unofficial.gni b/deps/llhttp/unofficial.gni
index fdce32e59764..28257dcb33ae 100644
--- a/deps/llhttp/unofficial.gni
+++ b/deps/llhttp/unofficial.gni
@@ -4,26 +4,39 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("llhttp_gn_build") {
-  config("llhttp_config") {
-    include_dirs = [ "include" ]
-  }
+  if (node_shared_http_parser) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("llhttp_config") {
+      packages = [ "libllhttp" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":llhttp_config" ]
+    }
+  } else {
+    config("llhttp_config") {
+      include_dirs = [ "include" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("llhttp.gyp") ],
-                            "scope",
-                            [ "llhttp.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("llhttp.gyp") ],
+                              "scope",
+                              [ "llhttp.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":llhttp_config" ]
-    include_dirs = [ "include" ]
-    sources = gypi_values.llhttp_sources
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        "-Wno-unreachable-code",
-      ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":llhttp_config" ]
+      include_dirs = [ "include" ]
+      sources = gypi_values.llhttp_sources
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          "-Wno-unreachable-code",
+        ]
+      }
     }
   }
 }
diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index b7bbaccfc3a5..c2b2f8757cbc 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -8,12 +8,16 @@
 #include <openssl/pkcs12.h>
 #include <openssl/rand.h>
 #include <openssl/x509v3.h>
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#include <openssl/decoder.h>
+#endif
 #if NCRYPTO_USE_BORINGSSL_EVP_DO_ALL_FALLBACK
 #include <openssl/bytestring.h>
 #include <openssl/cipher.h>
 #endif
 #include <algorithm>
 #include <array>
+#include <atomic>
 #include <climits>
 #include <cstring>
 #include <string_view>
@@ -28,40 +32,6 @@
 #include <openssl/thread.h>
 #endif
 #endif
-#if OPENSSL_WITH_PQC
-struct PQCMapping {
-  const char* name;
-  int nid;
-};
-
-constexpr static PQCMapping pqc_mappings[] = {
-    {"ML-DSA-44", EVP_PKEY_ML_DSA_44},
-    {"ML-DSA-65", EVP_PKEY_ML_DSA_65},
-    {"ML-DSA-87", EVP_PKEY_ML_DSA_87},
-    {"ML-KEM-768", EVP_PKEY_ML_KEM_768},
-    {"ML-KEM-1024", EVP_PKEY_ML_KEM_1024},
-
-#if OPENSSL_WITH_PQC_ML_KEM_512
-    {"ML-KEM-512", EVP_PKEY_ML_KEM_512},
-#endif
-#if OPENSSL_WITH_PQC_SLH_DSA
-    {"SLH-DSA-SHA2-128f", EVP_PKEY_SLH_DSA_SHA2_128F},
-    {"SLH-DSA-SHA2-128s", EVP_PKEY_SLH_DSA_SHA2_128S},
-    {"SLH-DSA-SHA2-192f", EVP_PKEY_SLH_DSA_SHA2_192F},
-    {"SLH-DSA-SHA2-192s", EVP_PKEY_SLH_DSA_SHA2_192S},
-    {"SLH-DSA-SHA2-256f", EVP_PKEY_SLH_DSA_SHA2_256F},
-    {"SLH-DSA-SHA2-256s", EVP_PKEY_SLH_DSA_SHA2_256S},
-    {"SLH-DSA-SHAKE-128f", EVP_PKEY_SLH_DSA_SHAKE_128F},
-    {"SLH-DSA-SHAKE-128s", EVP_PKEY_SLH_DSA_SHAKE_128S},
-    {"SLH-DSA-SHAKE-192f", EVP_PKEY_SLH_DSA_SHAKE_192F},
-    {"SLH-DSA-SHAKE-192s", EVP_PKEY_SLH_DSA_SHAKE_192S},
-    {"SLH-DSA-SHAKE-256f", EVP_PKEY_SLH_DSA_SHAKE_256F},
-    {"SLH-DSA-SHAKE-256s", EVP_PKEY_SLH_DSA_SHAKE_256S},
-#endif
-};
-
-#endif
-
 // EVP_PKEY_CTX_set_dsa_paramgen_q_bits was added in OpenSSL 1.1.1e.
 #if OPENSSL_VERSION_NUMBER < 0x1010105fL
 #define EVP_PKEY_CTX_set_dsa_paramgen_q_bits(ctx, qbits)                       \
@@ -130,6 +100,31 @@ struct OpenSSLBufferDeleter {
 };
 using OpenSSLBufferPointer =
     std::unique_ptr<unsigned char, OpenSSLBufferDeleter>;
+
+struct RsaOtherPrimeParamNames {
+  const char* factor;
+  const char* exponent;
+  const char* coefficient;
+};
+
+#define RSA_OTHER_PRIME_PARAM_NAMES(prime, coefficient)                        \
+  {                                                                            \
+    OSSL_PKEY_PARAM_RSA_FACTOR #prime, OSSL_PKEY_PARAM_RSA_EXPONENT #prime,    \
+        OSSL_PKEY_PARAM_RSA_COEFFICIENT #coefficient                           \
+  }
+
+constexpr std::array<RsaOtherPrimeParamNames, 8> kRsaOtherPrimeParamNames = {{
+    RSA_OTHER_PRIME_PARAM_NAMES(3, 2),
+    RSA_OTHER_PRIME_PARAM_NAMES(4, 3),
+    RSA_OTHER_PRIME_PARAM_NAMES(5, 4),
+    RSA_OTHER_PRIME_PARAM_NAMES(6, 5),
+    RSA_OTHER_PRIME_PARAM_NAMES(7, 6),
+    RSA_OTHER_PRIME_PARAM_NAMES(8, 7),
+    RSA_OTHER_PRIME_PARAM_NAMES(9, 8),
+    RSA_OTHER_PRIME_PARAM_NAMES(10, 9),
+}};
+
+#undef RSA_OTHER_PRIME_PARAM_NAMES
 #endif
 
 static constexpr int kX509NameFlagsRFC2253WithinUtf8JSON =
@@ -199,8 +194,10 @@ bool GetOptionalPKeyBnParam(const EVP_PKEY* pkey,
   return true;
 }
 
-EVPKeyPointer NewPKeyFromData(int id, int selection, OSSL_PARAM* params) {
-  auto ctx = EVPKeyCtxPointer::NewFromID(id);
+EVPKeyPointer NewPKeyFromData(const KeyAlgorithm& algorithm,
+                              int selection,
+                              OSSL_PARAM* params) {
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(algorithm);
   if (!ctx || EVP_PKEY_fromdata_init(ctx.get()) != 1) return {};
 
   EVP_PKEY* pkey = nullptr;
@@ -240,7 +237,7 @@ EVPKeyPointer NewDhPKey(const BIGNUM* p,
 
   OSSLParamPointer params(OSSL_PARAM_BLD_to_param(bld.get()));
   if (!params) return {};
-  return NewPKeyFromData(EVP_PKEY_DH, selection, params.get());
+  return NewPKeyFromData(KeyAlgorithm::DH, selection, params.get());
 }
 
 EVPKeyPointer NewDhPKey(const char* group_name,
@@ -249,7 +246,7 @@ EVPKeyPointer NewDhPKey(const char* group_name,
   if (group_name == nullptr) return {};
 
   if (pub == nullptr && priv == nullptr) {
-    EVPKeyCtxPointer ctx(EVP_PKEY_CTX_new_from_name(nullptr, "DH", nullptr));
+    auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::DH);
     OSSL_PARAM params[] = {
         OSSL_PARAM_construct_utf8_string(
             OSSL_PKEY_PARAM_GROUP_NAME, const_cast<char*>(group_name), 0),
@@ -285,7 +282,7 @@ EVPKeyPointer NewDhPKey(const char* group_name,
 
   OSSLParamPointer params(OSSL_PARAM_BLD_to_param(bld.get()));
   if (!params) return {};
-  return NewPKeyFromData(EVP_PKEY_DH, selection, params.get());
+  return NewPKeyFromData(KeyAlgorithm::DH, selection, params.get());
 }
 
 bool GetDhParams(const EVP_PKEY* pkey,
@@ -508,23 +505,43 @@ DataPointer DataPointer::resize(size_t len) {
 }
 
 // ============================================================================
-bool isFipsEnabled() {
-  ClearErrorOnReturn clear_error_on_return;
+namespace {
+// This generation only coordinates cache invalidation. It does not make
+// OpenSSL default property changes safe to race with crypto operations.
+std::atomic<uint64_t> fips_state_generation{0};
+
+bool isFipsEnabledRaw() {
 #if OPENSSL_VERSION_MAJOR >= 3
   return EVP_default_properties_is_fips_enabled(nullptr) == 1;
 #else
   return FIPS_mode() == 1;
 #endif
 }
+}  // namespace
+
+bool isFipsEnabled() {
+  ClearErrorOnReturn clear_error_on_return;
+  return isFipsEnabledRaw();
+}
 
 bool setFipsEnabled(bool enable, CryptoErrorList* errors) {
-  if (isFipsEnabled() == enable) return true;
+  const bool was_enabled = isFipsEnabled();
+  if (was_enabled == enable) return true;
   ClearErrorOnReturn clearErrorOnReturn(errors);
 #if OPENSSL_VERSION_MAJOR >= 3
-  return EVP_default_properties_enable_fips(nullptr, enable ? 1 : 0) == 1;
+  const bool success =
+      EVP_default_properties_enable_fips(nullptr, enable ? 1 : 0) == 1;
 #else
-  return FIPS_mode_set(enable ? 1 : 0) == 1;
+  const bool success = FIPS_mode_set(enable ? 1 : 0) == 1;
 #endif
+  if (success && isFipsEnabledRaw() != was_enabled) {
+    fips_state_generation.fetch_add(1, std::memory_order_release);
+  }
+  return success;
+}
+
+uint64_t getFipsStateGeneration() {
+  return fips_state_generation.load(std::memory_order_acquire);
 }
 
 bool testFipsEnabled() {
@@ -1635,8 +1652,7 @@ bool X509View::enumUsages(UsageCallback callback) const {
 bool X509View::ifRsa(KeyCallback<Rsa> callback) const {
   if (cert_ == nullptr) return true;
   OSSL3_CONST EVP_PKEY* pkey = X509_get0_pubkey(cert_);
-  auto id = EVP_PKEY_id(pkey);
-  if (id == EVP_PKEY_RSA || id == EVP_PKEY_RSA2 || id == EVP_PKEY_RSA_PSS) {
+  if (EVPKeyPointer::isRsaVariant(pkey)) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
     Rsa rsa(pkey);
 #else
@@ -1652,8 +1668,7 @@ bool X509View::ifRsa(KeyCallback<Rsa> callback) const {
 bool X509View::ifEc(KeyCallback<Ec> callback) const {
   if (cert_ == nullptr) return true;
   OSSL3_CONST EVP_PKEY* pkey = X509_get0_pubkey(cert_);
-  auto id = EVP_PKEY_id(pkey);
-  if (id == EVP_PKEY_EC) {
+  if (EVPKeyPointer::isA(pkey, KeyAlgorithm::EC)) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
     Ec ec(pkey);
 #else
@@ -1814,25 +1829,18 @@ int BIOPointer::Write(BIOPointer* bio, std::string_view message) {
 // DHPointer
 
 namespace {
-bool EqualNoCase(const std::string_view a, const std::string_view b) {
-  if (a.size() != b.size()) return false;
-  return std::equal(a.begin(), a.end(), b.begin(), b.end(), [](char a, char b) {
-    return std::tolower(a) == std::tolower(b);
-  });
-}
-
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
 const char* GetOpenSSLDhGroupName(const std::string_view name,
                                   DHPointer::FindGroupOption option) {
   if (option != DHPointer::FindGroupOption::NO_SMALL_PRIMES &&
-      EqualNoCase(name, "modp5")) {
+      CaseInsensitiveNameEqual()(name, "modp5")) {
     return "modp_1536";
   }
-  if (EqualNoCase(name, "modp14")) return "modp_2048";
-  if (EqualNoCase(name, "modp15")) return "modp_3072";
-  if (EqualNoCase(name, "modp16")) return "modp_4096";
-  if (EqualNoCase(name, "modp17")) return "modp_6144";
-  if (EqualNoCase(name, "modp18")) return "modp_8192";
+  if (CaseInsensitiveNameEqual()(name, "modp14")) return "modp_2048";
+  if (CaseInsensitiveNameEqual()(name, "modp15")) return "modp_3072";
+  if (CaseInsensitiveNameEqual()(name, "modp16")) return "modp_4096";
+  if (CaseInsensitiveNameEqual()(name, "modp17")) return "modp_6144";
+  if (CaseInsensitiveNameEqual()(name, "modp18")) return "modp_8192";
   return nullptr;
 }
 
@@ -2066,7 +2074,7 @@ DH* DHPointer::release() {
 BignumPointer DHPointer::FindGroup(const std::string_view name,
                                    FindGroupOption option) {
 #define V(n, p)                                                                \
-  if (EqualNoCase(name, n)) return BignumPointer(p(nullptr));
+  if (CaseInsensitiveNameEqual()(name, n)) return BignumPointer(p(nullptr));
   if (option != FindGroupOption::NO_SMALL_PRIMES) {
 #ifndef OPENSSL_IS_BORINGSSL
     // Boringssl does not support the 768 and 1024 small primes
@@ -2134,7 +2142,7 @@ DHPointer DHPointer::New(BignumPointer&& p, BignumPointer&& g) {
 
 DHPointer DHPointer::New(size_t bits, unsigned int generator) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
-  auto param_ctx = EVPKeyCtxPointer::NewFromID(EVP_PKEY_DH);
+  auto param_ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::DH);
   if (!param_ctx.initForParamgen() ||
       !param_ctx.setDhParameters(bits, generator)) {
     return {};
@@ -2626,6 +2634,21 @@ DataPointer DHPointer::stateless(const EVPKeyPointer& ourKey,
 // ============================================================================
 // KDF
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+KDF::KDF(EVP_KDF* kdf) : kdf_(kdf) {}
+
+KDF KDF::Fetch(const char* algorithm, OSSL_LIB_CTX* libctx) {
+  return KDF(EVP_KDF_fetch(libctx, algorithm, nullptr));
+}
+
+bool KDF::derive(const Buffer<unsigned char>& out,
+                 const OSSL_PARAM* params) const {
+  if (!kdf_) return false;
+  DeleteFnPtr<EVP_KDF_CTX, EVP_KDF_CTX_free> ctx(EVP_KDF_CTX_new(kdf_.get()));
+  return ctx && EVP_KDF_derive(ctx.get(), out.data, out.len, params) == 1;
+}
+#endif
+
 const EVP_MD* getDigestByName(const char* name) {
   // Historically, "dss1" and "DSS1" were DSA aliases for SHA-1
   // exposed through the public API.
@@ -2635,10 +2658,6 @@ const EVP_MD* getDigestByName(const char* name) {
   return EVP_get_digestbyname(name);
 }
 
-const EVP_CIPHER* getCipherByName(const char* name) {
-  return EVP_get_cipherbyname(name);
-}
-
 bool checkHkdfLength(const Digest& md, size_t length) {
   // HKDF-Expand computes up to 255 HMAC blocks, each having as many bits as
   // the output of the hash function. 255 is a hard limit because HKDF appends
@@ -2659,16 +2678,6 @@ DataPointer hkdf(const Digest& md,
     return {};
   }
 
-  auto ctx = EVPKeyCtxPointer::NewFromID(EVP_PKEY_HKDF);
-  // OpenSSL < 3.0.0 accepted only a void* as the argument of
-  // EVP_PKEY_CTX_set_hkdf_md.
-  const EVP_MD* md_ptr = md;
-  if (!ctx || !EVP_PKEY_derive_init(ctx.get()) ||
-      !EVP_PKEY_CTX_set_hkdf_md(ctx.get(), md_ptr) ||
-      !EVP_PKEY_CTX_add1_hkdf_info(ctx.get(), info.data, info.len)) {
-    return {};
-  }
-
   std::string_view actual_salt;
   static const char default_salt[EVP_MAX_MD_SIZE] = {0};
   if (salt.len > 0) {
@@ -2677,12 +2686,9 @@ DataPointer hkdf(const Digest& md,
     actual_salt = {default_salt, static_cast<unsigned>(md.size())};
   }
 
-  // We do not use EVP_PKEY_HKDF_MODE_EXTRACT_AND_EXPAND because and instead
-  // implement the extraction step ourselves because EVP_PKEY_derive does not
-  // handle zero-length keys, which are required for Web Crypto.
-  // TODO(jasnell): Once OpenSSL 1.1.1 support is dropped completely, and once
-  // BoringSSL is confirmed to support it, wen can hopefully drop this and use
-  // EVP_KDF directly which does support zero length keys.
+  // Keep extraction as a one-shot HMAC. The legacy path requires it because
+  // EVP_PKEY_derive rejects the zero-length keys Web Crypto allows. Both
+  // backends expand a pseudorandom key of exactly one digest block.
   unsigned char pseudorandom_key[EVP_MAX_MD_SIZE];
   unsigned pseudorandom_key_len = sizeof(pseudorandom_key);
 
@@ -2695,26 +2701,112 @@ DataPointer hkdf(const Digest& md,
            &pseudorandom_key_len) == nullptr) {
     return {};
   }
-  if (!EVP_PKEY_CTX_hkdf_mode(ctx.get(), EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) ||
+
+  auto buf = DataPointer::Alloc(length);
+  if (!buf) return {};
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // Expand through EVP_KDF directly. The EVP_PKEY_HKDF interface reaches the
+  // same provider implementation, but only after allocating a second context
+  // and translating every parameter across the legacy bridge.
+  auto kdf = KDF::Fetch(OSSL_KDF_NAME_HKDF);
+  if (!kdf) return {};
+
+  const char* md_name = EVP_MD_get0_name(md);
+  if (md_name == nullptr) return {};
+
+  int mode = EVP_KDF_HKDF_MODE_EXPAND_ONLY;
+  std::array<OSSL_PARAM, 5> params;
+  size_t n = 0;
+  params[n++] = OSSL_PARAM_construct_int(OSSL_KDF_PARAM_MODE, &mode);
+  params[n++] = OSSL_PARAM_construct_utf8_string(
+      OSSL_KDF_PARAM_DIGEST, const_cast<char*>(md_name), 0);
+  params[n++] = OSSL_PARAM_construct_octet_string(
+      OSSL_KDF_PARAM_KEY, pseudorandom_key, pseudorandom_key_len);
+  if (info.len > 0) {
+    params[n++] = OSSL_PARAM_construct_octet_string(
+        OSSL_KDF_PARAM_INFO, const_cast<unsigned char*>(info.data), info.len);
+  }
+  params[n++] = OSSL_PARAM_construct_end();
+
+  if (!kdf.derive({buf.get<unsigned char>(), length}, params.data())) {
+    return {};
+  }
+#else
+  auto ctx = EVPKeyCtxPointer::NewFromName("HKDF");
+  // OpenSSL < 3.0.0 accepted only a void* as the argument of
+  // EVP_PKEY_CTX_set_hkdf_md.
+  const EVP_MD* md_ptr = md;
+  if (!ctx || !EVP_PKEY_derive_init(ctx.get()) ||
+      !EVP_PKEY_CTX_set_hkdf_md(ctx.get(), md_ptr) ||
+      !EVP_PKEY_CTX_add1_hkdf_info(ctx.get(), info.data, info.len) ||
+      !EVP_PKEY_CTX_hkdf_mode(ctx.get(), EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) ||
       !EVP_PKEY_CTX_set1_hkdf_key(
           ctx.get(), pseudorandom_key, pseudorandom_key_len)) {
     return {};
   }
 
-  auto buf = DataPointer::Alloc(length);
-  if (!buf) return {};
-
   if (EVP_PKEY_derive(
           ctx.get(), static_cast<unsigned char*>(buf.get()), &length) <= 0) {
     return {};
   }
+#endif
 
   return buf;
 }
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+namespace {
+bool ScryptDerive(const Buffer<const char>& pass,
+                  const Buffer<const unsigned char>& salt,
+                  uint64_t N,
+                  uint64_t r,
+                  uint64_t p,
+                  uint64_t maxmem,
+                  unsigned char* out,
+                  size_t length) {
+  // EVP_PBE_scrypt limits these parameters to the provider's declared width.
+  if (r > UINT32_MAX || p > UINT32_MAX) {
+    ERR_raise(ERR_LIB_EVP, EVP_R_PARAMETER_TOO_LARGE);
+    return false;
+  }
+
+  // Keep EVP_PBE_scrypt's 32 MiB default instead of the provider's default.
+  if (maxmem == 0) maxmem = 32 * 1024 * 1024;
+
+  auto kdf = KDF::Fetch(OSSL_KDF_NAME_SCRYPT);
+  if (!kdf) return false;
+
+  unsigned char empty_salt = 0;
+  OSSL_PARAM params[] = {
+      OSSL_PARAM_construct_octet_string(
+          OSSL_KDF_PARAM_PASSWORD,
+          const_cast<char*>(pass.data == nullptr ? "" : pass.data),
+          pass.data == nullptr ? 0 : pass.len),
+      OSSL_PARAM_construct_octet_string(
+          OSSL_KDF_PARAM_SALT,
+          salt.data == nullptr ? &empty_salt
+                               : const_cast<unsigned char*>(salt.data),
+          salt.data == nullptr ? 0 : salt.len),
+      OSSL_PARAM_construct_uint64(OSSL_KDF_PARAM_SCRYPT_N, &N),
+      OSSL_PARAM_construct_uint64(OSSL_KDF_PARAM_SCRYPT_R, &r),
+      OSSL_PARAM_construct_uint64(OSSL_KDF_PARAM_SCRYPT_P, &p),
+      OSSL_PARAM_construct_uint64(OSSL_KDF_PARAM_SCRYPT_MAXMEM, &maxmem),
+      OSSL_PARAM_END,
+  };
+  return kdf.derive({out, length}, params);
+}
+}  // namespace
+#endif
+
 bool checkScryptParams(uint64_t N, uint64_t r, uint64_t p, uint64_t maxmem) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // A null output validates the parameters without deriving a key.
+  return ScryptDerive({nullptr, 0}, {nullptr, 0}, N, r, p, maxmem, nullptr, 0);
+#else
   return EVP_PBE_scrypt(nullptr, 0, nullptr, 0, N, r, p, maxmem, nullptr, 0) ==
          1;
+#endif
 }
 
 DataPointer scrypt(const Buffer<const char>& pass,
@@ -2729,6 +2821,10 @@ DataPointer scrypt(const Buffer<const char>& pass,
   }
 
   auto dp = DataPointer::Alloc(length);
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (dp && ScryptDerive(
+                pass, salt, N, r, p, maxmem, dp.get<unsigned char>(), length)) {
+#else
   if (dp && EVP_PBE_scrypt(pass.data,
                            pass.len,
                            salt.data,
@@ -2739,6 +2835,7 @@ DataPointer scrypt(const Buffer<const char>& pass,
                            maxmem,
                            reinterpret_cast<unsigned char*>(dp.get()),
                            length)) {
+#endif
     return dp;
   }
 
@@ -2755,6 +2852,44 @@ DataPointer pbkdf2(const Digest& md,
   }
 
   auto dp = DataPointer::Alloc(length);
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (!dp) return {};
+  auto kdf = KDF::Fetch(OSSL_KDF_NAME_PBKDF2);
+  if (!kdf) return {};
+
+  const char* md_name = EVP_MD_get0_name(md);
+  if (md_name == nullptr) return {};
+
+#if OPENSSL_VERSION_MAJOR < 4
+  // Match PKCS5_PBKDF2_HMAC: OpenSSL 3 disables the provider's lower bounds,
+  // while OpenSSL 4 leaves them at their provider defaults.
+  int pkcs5 = 1;
+#endif
+  int iteration_count = static_cast<int>(iterations);
+  unsigned char empty_salt = 0;
+  OSSL_PARAM params[] = {
+    OSSL_PARAM_construct_octet_string(
+        OSSL_KDF_PARAM_PASSWORD,
+        const_cast<char*>(pass.data == nullptr ? "" : pass.data),
+        pass.data == nullptr ? 0 : pass.len),
+#if OPENSSL_VERSION_MAJOR < 4
+    OSSL_PARAM_construct_int(OSSL_KDF_PARAM_PKCS5, &pkcs5),
+#endif
+    OSSL_PARAM_construct_octet_string(
+        OSSL_KDF_PARAM_SALT,
+        salt.data == nullptr && salt.len == 0
+            ? &empty_salt
+            : const_cast<unsigned char*>(salt.data),
+        salt.len),
+    OSSL_PARAM_construct_int(OSSL_KDF_PARAM_ITER, &iteration_count),
+    OSSL_PARAM_construct_utf8_string(
+        OSSL_KDF_PARAM_DIGEST, const_cast<char*>(md_name), 0),
+    OSSL_PARAM_END,
+  };
+  if (kdf.derive({dp.get<unsigned char>(), length}, params)) {
+    return dp;
+  }
+#else
   const EVP_MD* md_ptr = md;
   if (dp && PKCS5_PBKDF2_HMAC(pass.data,
                               pass.len,
@@ -2766,6 +2901,7 @@ DataPointer pbkdf2(const Digest& md,
                               reinterpret_cast<unsigned char*>(dp.get()))) {
     return dp;
   }
+#endif
 
   return {};
 }
@@ -2802,8 +2938,7 @@ DataPointer argon2(const Buffer<const char>& pass,
   // against the default context, otherwise Argon2 works in FIPS mode.
   DeleteFnPtr<OSSL_LIB_CTX, OSSL_LIB_CTX_free> ctx;
   if (lanes > 1) {
-    if (!DeleteFnPtr<EVP_KDF, EVP_KDF_free>{
-            EVP_KDF_fetch(nullptr, algorithm.data(), nullptr)}) {
+    if (!KDF::Fetch(algorithm.data())) {
       return {};
     }
 
@@ -2817,18 +2952,11 @@ DataPointer argon2(const Buffer<const char>& pass,
     }
   }
 
-  auto kdf = DeleteFnPtr<EVP_KDF, EVP_KDF_free>{
-      EVP_KDF_fetch(ctx.get(), algorithm.data(), nullptr)};
+  auto kdf = KDF::Fetch(algorithm.data(), ctx.get());
   if (!kdf) {
     return {};
   }
 
-  auto kctx =
-      DeleteFnPtr<EVP_KDF_CTX, EVP_KDF_CTX_free>{EVP_KDF_CTX_new(kdf.get())};
-  if (!kctx) {
-    return {};
-  }
-
   std::vector<OSSL_PARAM> params;
   params.reserve(9);
 
@@ -2860,10 +2988,7 @@ DataPointer argon2(const Buffer<const char>& pass,
   params.push_back(OSSL_PARAM_construct_end());
 
   auto dp = DataPointer::Alloc(length);
-  if (dp && EVP_KDF_derive(kctx.get(),
-                           reinterpret_cast<unsigned char*>(dp.get()),
-                           length,
-                           params.data()) == 1) {
+  if (dp && kdf.derive({dp.get<unsigned char>(), length}, params.data())) {
     return dp;
   }
 
@@ -2898,120 +3023,278 @@ EVPKeyPointer::PrivateKeyEncodingConfig::operator=(
   return *new (this) PrivateKeyEncodingConfig(other);
 }
 
+// clang-format off
+// NOLINTBEGIN(whitespace/line_length)
+const KeyAlgorithm KeyAlgorithm::RSA("RSA", Family::Other);
+const KeyAlgorithm KeyAlgorithm::RSA_PSS("RSA-PSS", Family::Other);
+const KeyAlgorithm KeyAlgorithm::DSA("DSA", Family::Other);
+const KeyAlgorithm KeyAlgorithm::DH("DH", Family::Other);
+const KeyAlgorithm KeyAlgorithm::EC("EC", Family::Other);
+const KeyAlgorithm KeyAlgorithm::ED25519("Ed25519", Family::EdDSA);
+const KeyAlgorithm KeyAlgorithm::ED448("Ed448", Family::EdDSA);
+const KeyAlgorithm KeyAlgorithm::X25519("X25519", Family::XDH);
+const KeyAlgorithm KeyAlgorithm::X448("X448", Family::XDH);
+const KeyAlgorithm KeyAlgorithm::SM2("SM2", Family::Other, /* has_key_type */ false);
+const KeyAlgorithm KeyAlgorithm::ML_DSA_44("ML-DSA-44", Family::MLDSA);
+const KeyAlgorithm KeyAlgorithm::ML_DSA_65("ML-DSA-65", Family::MLDSA);
+const KeyAlgorithm KeyAlgorithm::ML_DSA_87("ML-DSA-87", Family::MLDSA);
+const KeyAlgorithm KeyAlgorithm::ML_KEM_512("ML-KEM-512", Family::MLKEM);
+const KeyAlgorithm KeyAlgorithm::ML_KEM_768("ML-KEM-768", Family::MLKEM);
+const KeyAlgorithm KeyAlgorithm::ML_KEM_1024("ML-KEM-1024", Family::MLKEM);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHA2_128F("SLH-DSA-SHA2-128f", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHA2_128S("SLH-DSA-SHA2-128s", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHA2_192F("SLH-DSA-SHA2-192f", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHA2_192S("SLH-DSA-SHA2-192s", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHA2_256F("SLH-DSA-SHA2-256f", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHA2_256S("SLH-DSA-SHA2-256s", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHAKE_128F("SLH-DSA-SHAKE-128f", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHAKE_128S("SLH-DSA-SHAKE-128s", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHAKE_192F("SLH-DSA-SHAKE-192f", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHAKE_192S("SLH-DSA-SHAKE-192s", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHAKE_256F("SLH-DSA-SHAKE-256f", Family::SLHDSA);
+const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHAKE_256S("SLH-DSA-SHAKE-256s", Family::SLHDSA);
+// NOLINTEND(whitespace/line_length)
+// clang-format on
+
+namespace {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+constexpr char kSignatureContextString[] = "context-string";
+constexpr char kSignatureInstance[] = "instance";
+#endif
+const KeyAlgorithm* const kKeyAlgorithms[] = {
+    &KeyAlgorithm::RSA,
+    &KeyAlgorithm::RSA_PSS,
+    &KeyAlgorithm::DSA,
+    &KeyAlgorithm::DH,
+    &KeyAlgorithm::EC,
+    &KeyAlgorithm::ED25519,
+    &KeyAlgorithm::ED448,
+    &KeyAlgorithm::X25519,
+    &KeyAlgorithm::X448,
+    &KeyAlgorithm::SM2,
+    &KeyAlgorithm::ML_DSA_44,
+    &KeyAlgorithm::ML_DSA_65,
+    &KeyAlgorithm::ML_DSA_87,
+    &KeyAlgorithm::ML_KEM_512,
+    &KeyAlgorithm::ML_KEM_768,
+    &KeyAlgorithm::ML_KEM_1024,
+    &KeyAlgorithm::SLH_DSA_SHA2_128F,
+    &KeyAlgorithm::SLH_DSA_SHA2_128S,
+    &KeyAlgorithm::SLH_DSA_SHA2_192F,
+    &KeyAlgorithm::SLH_DSA_SHA2_192S,
+    &KeyAlgorithm::SLH_DSA_SHA2_256F,
+    &KeyAlgorithm::SLH_DSA_SHA2_256S,
+    &KeyAlgorithm::SLH_DSA_SHAKE_128F,
+    &KeyAlgorithm::SLH_DSA_SHAKE_128S,
+    &KeyAlgorithm::SLH_DSA_SHAKE_192F,
+    &KeyAlgorithm::SLH_DSA_SHAKE_192S,
+    &KeyAlgorithm::SLH_DSA_SHAKE_256F,
+    &KeyAlgorithm::SLH_DSA_SHAKE_256S,
+};
+}  // namespace
+
+const KeyAlgorithm* KeyAlgorithm::FromName(const char* name) {
+  if (name == nullptr) return nullptr;
+  for (const auto* algorithm : kKeyAlgorithms) {
+    if (CaseInsensitiveNameEqual()(name, algorithm->name())) return algorithm;
+  }
+  return nullptr;
+}
+
+void KeyAlgorithm::ForEachPqc(Callback callback) {
+  for (const auto* algorithm : kKeyAlgorithms) {
+    if (algorithm->isPqc() && algorithm->isAvailable()) callback(*algorithm);
+  }
+}
+
+bool KeyAlgorithm::isRsa() const {
+  return this == &RSA || this == &RSA_PSS;
+}
+
+bool KeyAlgorithm::isPqc() const {
+  return family_ == Family::MLDSA || family_ == Family::MLKEM ||
+         family_ == Family::SLHDSA;
+}
+
+bool KeyAlgorithm::isOkp() const {
+  return family_ == Family::EdDSA || family_ == Family::XDH;
+}
+
+bool KeyAlgorithm::isOneShot() const {
+  return family_ == Family::EdDSA || family_ == Family::MLDSA ||
+         family_ == Family::SLHDSA;
+}
+
+bool KeyAlgorithm::supportsRawPublic() const {
+  return isOkp() || isPqc();
+}
+
+bool KeyAlgorithm::supportsRawPrivate() const {
+  return isOkp() || family_ == Family::SLHDSA;
+}
+
+size_t KeyAlgorithm::seedSize() const {
+  if (family_ == Family::MLDSA) return 32;
+  if (family_ == Family::MLKEM) return 64;
+  return 0;
+}
+
+namespace {
+#if !NCRYPTO_USE_OPENSSL3_PROVIDER
+struct LegacyKeyAlgorithm {
+  const char* name;
+  int id;
+#if NCRYPTO_USE_BORINGSSL
+  const EVP_PKEY_ALG* (*raw_key_algorithm)() = nullptr;
+#endif
+};
+
+// These backends require native key IDs. BoringSSL also uses EVP_PKEY_ALG
+// descriptors for raw keys; keep both adapters in the same table.
+// clang-format off
+// NOLINTBEGIN(whitespace/line_length)
+const LegacyKeyAlgorithm kLegacyKeyAlgorithms[] = {
+    {KeyAlgorithm::RSA.name(), EVP_PKEY_RSA},
+    {KeyAlgorithm::RSA_PSS.name(), EVP_PKEY_RSA_PSS},
+    {KeyAlgorithm::DSA.name(), EVP_PKEY_DSA},
+    {KeyAlgorithm::DH.name(), EVP_PKEY_DH},
+    {KeyAlgorithm::EC.name(), EVP_PKEY_EC},
+#if NCRYPTO_USE_BORINGSSL
+    {KeyAlgorithm::ED25519.name(), EVP_PKEY_ED25519, EVP_pkey_ed25519},
+    {KeyAlgorithm::X25519.name(), EVP_PKEY_X25519, EVP_pkey_x25519},
+#else
+    {KeyAlgorithm::ED25519.name(), EVP_PKEY_ED25519},
+    {KeyAlgorithm::X25519.name(), EVP_PKEY_X25519},
+#endif
+    {"HKDF", EVP_PKEY_HKDF},
+    {KeyAlgorithm::ED448.name(), EVP_PKEY_ED448},
+    {KeyAlgorithm::X448.name(), EVP_PKEY_X448},
+#ifndef OPENSSL_NO_SM2
+    {KeyAlgorithm::SM2.name(), EVP_PKEY_SM2},
+#endif
+#if NCRYPTO_USE_BORINGSSL
+    {KeyAlgorithm::ML_DSA_44.name(), EVP_PKEY_ML_DSA_44, EVP_pkey_ml_dsa_44},
+    {KeyAlgorithm::ML_DSA_65.name(), EVP_PKEY_ML_DSA_65, EVP_pkey_ml_dsa_65},
+    {KeyAlgorithm::ML_DSA_87.name(), EVP_PKEY_ML_DSA_87, EVP_pkey_ml_dsa_87},
+    {KeyAlgorithm::ML_KEM_768.name(), EVP_PKEY_ML_KEM_768, EVP_pkey_ml_kem_768},
+    {KeyAlgorithm::ML_KEM_1024.name(), EVP_PKEY_ML_KEM_1024, EVP_pkey_ml_kem_1024},
+#endif
+};
+// NOLINTEND(whitespace/line_length)
+// clang-format on
+
+const LegacyKeyAlgorithm* FindLegacyKeyAlgorithm(const char* name) {
+  if (name == nullptr) return nullptr;
+  for (const auto& algorithm : kLegacyKeyAlgorithms) {
+    if (CaseInsensitiveNameEqual()(name, algorithm.name)) return &algorithm;
+  }
+  return nullptr;
+}
+
+int GetLegacyKeyId(const char* name) {
+  const auto* algorithm = FindLegacyKeyAlgorithm(name);
+  return algorithm == nullptr ? NID_undef : algorithm->id;
+}
+
+#if NCRYPTO_USE_BORINGSSL
+const EVP_PKEY_ALG* GetBoringSSLKeyAlgorithm(const KeyAlgorithm& algorithm) {
+  const auto* entry = FindLegacyKeyAlgorithm(algorithm.name());
+  return entry != nullptr && entry->raw_key_algorithm != nullptr
+             ? entry->raw_key_algorithm()
+             : nullptr;
+}
+#endif
+#endif
+}  // namespace
+
+void ConfigurePqcEncoding() {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER && OPENSSL_VERSION_PREREQ(3, 5)
+  // Configure all loaded providers to prefer seed-only format for ML-KEM and
+  // ML-DSA private keys in PKCS#8 export, falling back to priv-only when a
+  // seed is not available. The provider encoder reads these parameters at
+  // encoding time via ossl_prov_ctx_get_param().
+  OSSL_PROVIDER_do_all(
+      nullptr,
+      [](OSSL_PROVIDER* provider, void*) -> int {
+        OSSL_PROVIDER_add_conf_parameter(
+            provider, "ml-kem.output_formats", "seed-only,priv-only");
+        OSSL_PROVIDER_add_conf_parameter(
+            provider, "ml-dsa.output_formats", "seed-only,priv-only");
+        return 1;
+      },
+      nullptr);
+#endif
+}
+
+bool KeyAlgorithm::isAvailable() const {
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+  return static_cast<bool>(EVPKeyCtxPointer::NewFromName(name_));
+}
+
 EVPKeyPointer EVPKeyPointer::New() {
   return EVPKeyPointer(EVP_PKEY_new());
 }
 
 EVPKeyPointer EVPKeyPointer::NewRawPublic(
-    int id, const Buffer<const unsigned char>& data) {
-  if (id == 0) return {};
+    const KeyAlgorithm& algorithm, const Buffer<const unsigned char>& data) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return EVPKeyPointer(EVP_PKEY_new_raw_public_key_ex(
+      nullptr, algorithm.name(), nullptr, data.data, data.len));
+#elif NCRYPTO_USE_BORINGSSL
+  const auto* alg = GetBoringSSLKeyAlgorithm(algorithm);
+  if (alg == nullptr) return {};
+  return EVPKeyPointer(EVP_PKEY_from_raw_public_key(alg, data.data, data.len));
+#else
+  const int id = GetLegacyKeyId(algorithm.name());
+  if (id == NID_undef) return {};
   return EVPKeyPointer(
       EVP_PKEY_new_raw_public_key(id, nullptr, data.data, data.len));
+#endif
 }
 
 EVPKeyPointer EVPKeyPointer::NewRawPrivate(
-    int id, const Buffer<const unsigned char>& data) {
-  if (id == 0) return {};
+    const KeyAlgorithm& algorithm, const Buffer<const unsigned char>& data) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return EVPKeyPointer(EVP_PKEY_new_raw_private_key_ex(
+      nullptr, algorithm.name(), nullptr, data.data, data.len));
+#elif NCRYPTO_USE_BORINGSSL
+  const auto* alg = GetBoringSSLKeyAlgorithm(algorithm);
+  if (alg == nullptr) return {};
+  return EVPKeyPointer(EVP_PKEY_from_raw_private_key(alg, data.data, data.len));
+#else
+  const int id = GetLegacyKeyId(algorithm.name());
+  if (id == NID_undef) return {};
   return EVPKeyPointer(
       EVP_PKEY_new_raw_private_key(id, nullptr, data.data, data.len));
-}
-
-#if OPENSSL_WITH_PQC
-namespace {
-constexpr size_t kPqcMlDsaSeedSize = 32;
-constexpr size_t kPqcMlKemSeedSize = 64;
-
-size_t GetPqcSeedSize(int id) {
-  switch (id) {
-    case EVP_PKEY_ML_DSA_44:
-    case EVP_PKEY_ML_DSA_65:
-    case EVP_PKEY_ML_DSA_87:
-      return kPqcMlDsaSeedSize;
-#if OPENSSL_WITH_PQC_ML_KEM_512
-    case EVP_PKEY_ML_KEM_512:
-#endif
-    case EVP_PKEY_ML_KEM_768:
-    case EVP_PKEY_ML_KEM_1024:
-      return kPqcMlKemSeedSize;
-    default:
-      unreachable();
-  }
-}
-
-#if OPENSSL_WITH_BORINGSSL_PQC
-const EVP_PKEY_ALG* GetPqcSeedAlg(int id) {
-  switch (id) {
-    case EVP_PKEY_ML_DSA_44:
-      return EVP_pkey_ml_dsa_44();
-    case EVP_PKEY_ML_DSA_65:
-      return EVP_pkey_ml_dsa_65();
-    case EVP_PKEY_ML_DSA_87:
-      return EVP_pkey_ml_dsa_87();
-    case EVP_PKEY_ML_KEM_768:
-      return EVP_pkey_ml_kem_768();
-    case EVP_PKEY_ML_KEM_1024:
-      return EVP_pkey_ml_kem_1024();
-    default:
-      unreachable();
-  }
-}
-#else
-const char* GetPqcSeedParamName(int id) {
-  switch (id) {
-    case EVP_PKEY_ML_DSA_44:
-    case EVP_PKEY_ML_DSA_65:
-    case EVP_PKEY_ML_DSA_87:
-      return OSSL_PKEY_PARAM_ML_DSA_SEED;
-    case EVP_PKEY_ML_KEM_512:
-    case EVP_PKEY_ML_KEM_768:
-    case EVP_PKEY_ML_KEM_1024:
-      return OSSL_PKEY_PARAM_ML_KEM_SEED;
-    default:
-      unreachable();
-  }
-}
 #endif
+}
 
-EVPKeyPointer NewPqcKeyFromSeed(int id,
-                                const Buffer<const unsigned char>& data) {
-#if OPENSSL_WITH_BORINGSSL_PQC
+EVPKeyPointer EVPKeyPointer::NewRawSeed(
+    const KeyAlgorithm& algorithm, const Buffer<const unsigned char>& data) {
+  if (algorithm.seedSize() == 0) return {};
+#if NCRYPTO_USE_BORINGSSL
+  const auto* seed_alg = GetBoringSSLKeyAlgorithm(algorithm);
+  if (seed_alg == nullptr) return {};
   return EVPKeyPointer(
-      EVP_PKEY_from_private_seed(GetPqcSeedAlg(id), data.data, data.len));
-#else
+      EVP_PKEY_from_private_seed(seed_alg, data.data, data.len));
+#elif NCRYPTO_USE_OPENSSL3_PROVIDER
+  // ML-DSA and ML-KEM both use the provider parameter "seed".
   OSSL_PARAM params[] = {
-      OSSL_PARAM_construct_octet_string(GetPqcSeedParamName(id),
-                                        const_cast<unsigned char*>(data.data),
-                                        data.len),
+      OSSL_PARAM_construct_octet_string(
+          "seed", const_cast<unsigned char*>(data.data), data.len),
       OSSL_PARAM_END};
-
-  auto ctx = EVPKeyCtxPointer::NewFromID(id);
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(algorithm);
   if (!ctx) return {};
-
   EVP_PKEY* pkey = nullptr;
   if (EVP_PKEY_fromdata_init(ctx.get()) <= 0 ||
       EVP_PKEY_fromdata(ctx.get(), &pkey, EVP_PKEY_KEYPAIR, params) <= 0) {
     return {};
   }
   return EVPKeyPointer(pkey);
-#endif
-}
-
-bool GetPqcSeed(EVP_PKEY* pkey, int id, const Buffer<unsigned char>& out) {
-  size_t len = out.len;
-#if OPENSSL_WITH_BORINGSSL_PQC
-  return EVP_PKEY_get_private_seed(pkey, out.data, &len) == 1;
 #else
-  return EVP_PKEY_get_octet_string_param(
-             pkey, GetPqcSeedParamName(id), out.data, out.len, &len) == 1;
+  return {};
 #endif
 }
-}  // namespace
-
-EVPKeyPointer EVPKeyPointer::NewRawSeed(
-    int id, const Buffer<const unsigned char>& data) {
-  return NewPqcKeyFromSeed(id, data);
-}
-#endif
 
 EVPKeyPointer EVPKeyPointer::NewDH(DHPointer&& dh) {
   if (!dh) return {};
@@ -3061,12 +3344,25 @@ EVPKeyPointer EVPKeyPointer::NewRSA(const Rsa& rsa) {
             bld.get(), OSSL_PKEY_PARAM_RSA_COEFFICIENT1, private_key.qi) != 1) {
       return {};
     }
+
+    const auto other_prime_infos = rsa.getOtherPrimeInfos();
+    if (other_prime_infos.size() > kRsaOtherPrimeParamNames.size()) return {};
+    for (size_t i = 0; i < other_prime_infos.size(); i++) {
+      const auto& info = other_prime_infos[i];
+      const auto& names = kRsaOtherPrimeParamNames[i];
+      if (info.r == nullptr || info.d == nullptr || info.t == nullptr ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.factor, info.r) != 1 ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.exponent, info.d) != 1 ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.coefficient, info.t) != 1) {
+        return {};
+      }
+    }
     selection = EVP_PKEY_KEYPAIR;
   }
 
   OSSLParamPointer params(OSSL_PARAM_BLD_to_param(bld.get()));
   if (!params) return {};
-  return NewPKeyFromData(EVP_PKEY_RSA, selection, params.get());
+  return NewPKeyFromData(KeyAlgorithm::RSA, selection, params.get());
 }
 #else
 EVPKeyPointer EVPKeyPointer::NewRSA(RSAPointer&& rsa) {
@@ -3103,74 +3399,288 @@ EVP_PKEY* EVPKeyPointer::release() {
   return pkey_.release();
 }
 
-int EVPKeyPointer::id(const EVP_PKEY* key) {
-  if (key == nullptr) return 0;
-  int type = EVP_PKEY_id(key);
-#if OPENSSL_WITH_OPENSSL_PQC
-  // EVP_PKEY_id returns -1 when EVP_PKEY_* is only implemented in a provider
-  // which is the case for all post-quantum NIST algorithms
-  // one suggested way would be to use a chain of `EVP_PKEY_is_a`
-  // https://github.com/openssl/openssl/issues/27738#issuecomment-3013215870
-  // or, this way there are less calls to the OpenSSL provider, just
-  // getting the name once
-  if (type == -1) {
-    const char* type_name = EVP_PKEY_get0_type_name(key);
-    if (type_name == nullptr) return -1;
-
-    for (const auto& mapping : pqc_mappings) {
-      if (strcmp(type_name, mapping.name) == 0) {
-        return mapping.nid;
-      }
-    }
+bool EVPKeyPointer::isA(const EVP_PKEY* key, const char* name) {
+  if (key == nullptr || name == nullptr) return false;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // EVP_PKEY_is_a() can match an untyped key to an unknown legacy name.
+  return EVP_PKEY_get0_type_name(key) != nullptr &&
+         EVP_PKEY_is_a(key, name) == 1;
+#else
+  const int id = GetLegacyKeyId(name);
+  return id != NID_undef && EVP_PKEY_id(key) == id;
+#endif
+}
+
+// Returns true unless the key is known not to be SM2, so that a key whose curve
+// cannot be determined opts out of the prehashed fallback rather than into it.
+bool EVPKeyPointer::mayBeSM2() const {
+#ifdef OPENSSL_NO_SM2
+  return false;
+#else
+  if (isA(KeyAlgorithm::SM2)) return true;
+  if (!isA(KeyAlgorithm::EC)) return false;
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // An ECKeyPointer would also need the public point, which a provider-backed
+  // key need not expose.
+  char group_name[64];
+  size_t group_name_len = 0;
+  if (EVP_PKEY_get_utf8_string_param(get(),
+                                     OSSL_PKEY_PARAM_GROUP_NAME,
+                                     group_name,
+                                     sizeof(group_name),
+                                     &group_name_len) != 1) {
+    return true;
   }
+  return OBJ_sn2nid(group_name) == NID_sm2 ||
+         EC_curve_nist2nid(group_name) == NID_sm2;
+#else
+  ECKeyPointer ec(*this);
+  if (!ec) return true;
+
+  const EC_GROUP* group = ec.getGroup();
+  if (group == nullptr) return true;
+  return EC_GROUP_get_curve_name(group) == NID_sm2;
+#endif
 #endif
-  return type;
 }
 
-int EVPKeyPointer::base_id(const EVP_PKEY* key) {
-  if (key == nullptr) return 0;
-  return EVP_PKEY_base_id(key);
+bool EVPKeyPointer::isA(const char* name) const {
+  return isA(get(), name);
 }
 
-int EVPKeyPointer::id() const {
-  return id(get());
+bool EVPKeyPointer::isA(const EVP_PKEY* key, const KeyAlgorithm& algorithm) {
+  return isA(key, algorithm.name());
 }
 
-int EVPKeyPointer::base_id() const {
-  return base_id(get());
+bool EVPKeyPointer::isA(const KeyAlgorithm& algorithm) const {
+  return isA(get(), algorithm);
 }
 
-int EVPKeyPointer::bits() const {
-  if (get() == nullptr) return 0;
-  return EVP_PKEY_bits(get());
+const KeyAlgorithm* EVPKeyPointer::getAlgorithm() const {
+  if (!pkey_) return nullptr;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // Provider primary names identify algorithms. Legacy ASN.1 methods can
+  // share names (for example, SM2 uses EC), so resolve those through isA().
+  // The fallback also handles providers with a noncanonical primary alias.
+  if (EVP_PKEY_get0_provider(get()) != nullptr) {
+    if (const auto* algorithm =
+            KeyAlgorithm::FromName(EVP_PKEY_get0_type_name(get()))) {
+      return algorithm;
+    }
+  }
+  for (const auto* algorithm : kKeyAlgorithms) {
+    if (isA(*algorithm)) return algorithm;
+  }
+#else
+  const int id = EVP_PKEY_id(get());
+  for (const auto& algorithm : kLegacyKeyAlgorithms) {
+    if (id == algorithm.id) return KeyAlgorithm::FromName(algorithm.name);
+  }
+#endif
+  return nullptr;
 }
 
-size_t EVPKeyPointer::size() const {
-  if (get() == nullptr) return 0;
-  return EVP_PKEY_size(get());
+const char* EVPKeyPointer::getKeyTypeName() const {
+  const auto* algorithm = getAlgorithm();
+  return algorithm == nullptr ? nullptr : algorithm->keyTypeName();
 }
 
-EVPKeyCtxPointer EVPKeyPointer::newCtx() const {
-  if (!pkey_) return {};
-  return EVPKeyCtxPointer::New(*this);
+bool EVPKeyPointer::supportsRawPublic() const {
+  const auto* algorithm = getAlgorithm();
+  return algorithm != nullptr && algorithm->supportsRawPublic();
 }
 
-size_t EVPKeyPointer::rawPublicKeySize() const {
-  if (!pkey_) return 0;
-  size_t len = 0;
-  if (EVP_PKEY_get_raw_public_key(get(), nullptr, &len) == 1) return len;
-  return 0;
+bool EVPKeyPointer::supportsRawPrivate() const {
+  const auto* algorithm = getAlgorithm();
+  return algorithm != nullptr && algorithm->supportsRawPrivate();
 }
 
-size_t EVPKeyPointer::rawPrivateKeySize() const {
-  if (!pkey_) return 0;
-  size_t len = 0;
-  if (EVP_PKEY_get_raw_private_key(get(), nullptr, &len) == 1) return len;
-  return 0;
+bool EVPKeyPointer::supportsContextString() const {
+  const auto* algorithm = getAlgorithm();
+  if (algorithm == nullptr || !algorithm->isOneShot()) return false;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+  DeleteFnPtr<EVP_SIGNATURE, EVP_SIGNATURE_free> signature(
+      EVP_SIGNATURE_fetch(nullptr, EVP_PKEY_get0_type_name(get()), nullptr));
+  if (!signature) return false;
+  const OSSL_PARAM* params = EVP_SIGNATURE_settable_ctx_params(signature.get());
+  return params != nullptr &&
+         OSSL_PARAM_locate_const(params, kSignatureContextString) != nullptr &&
+         (algorithm != &KeyAlgorithm::ED25519 ||
+          OSSL_PARAM_locate_const(params, kSignatureInstance) != nullptr);
+#elif NCRYPTO_USE_BORINGSSL
+  return algorithm->isPqc();
+#else
+  return false;
+#endif
 }
 
-DataPointer EVPKeyPointer::rawPublicKey() const {
-  if (!pkey_) return {};
+namespace {
+constexpr size_t kEd25519PointSize = 32;
+constexpr size_t kEd448PointSize = 57;
+
+// Ed25519 has cofactor 8, so the first eight entries are the full
+// canonical small-order subgroup: identity, one point of order 2,
+// two points of order 4, and four points of order 8.
+constexpr unsigned char kEd25519SmallOrderPoints[][kEd25519PointSize] = {
+    // Identity.
+    {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+    // Order 2.
+    {0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
+    // Order 4.
+    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80},
+    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+    // Order 8.
+    {0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b,
+     0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39,
+     0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a},
+    {0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b,
+     0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39,
+     0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0xfa},
+    {0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4,
+     0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6,
+     0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05},
+    {0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4,
+     0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6,
+     0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x85},
+    // Non-canonical encodings of the same small-order points.
+    {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80},
+    {0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
+    {0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
+    {0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
+    {0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
+    {0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
+};
+
+// Ed448 has cofactor 4, so these four entries are the full canonical
+// small-order subgroup: identity, one point of order 2, and two points
+// of order 4.
+constexpr unsigned char kEd448SmallOrderPoints[][kEd448PointSize] = {
+    // Identity.
+    {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+    // Order 2.
+    {0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00},
+    // Order 4.
+    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
+    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80},
+};
+
+template <size_t PointSize, size_t Count>
+bool ContainsPoint(const unsigned char* candidate,
+                   const unsigned char (&points)[Count][PointSize]) {
+  for (const auto& point : points) {
+    if (memcmp(candidate, point, PointSize) == 0) return true;
+  }
+  return false;
+}
+
+bool IsSmallOrderEdDsaPoint(const EVPKeyPointer& key,
+                            const unsigned char* candidate,
+                            size_t size) {
+  if (key.isA(KeyAlgorithm::ED25519)) {
+    return size == kEd25519PointSize &&
+           ContainsPoint(candidate, kEd25519SmallOrderPoints);
+  }
+  if (key.isA(KeyAlgorithm::ED448)) {
+    return size == kEd448PointSize &&
+           ContainsPoint(candidate, kEd448SmallOrderPoints);
+  }
+  return false;
+}
+
+}  // namespace
+
+bool EVPKeyPointer::hasSmallOrderEdDsaPoint(
+    const Buffer<const unsigned char>& signature) const {
+  const size_t point_size = isA(KeyAlgorithm::ED25519) ? kEd25519PointSize
+                            : isA(KeyAlgorithm::ED448) ? kEd448PointSize
+                                                       : 0;
+  if (point_size == 0) return false;
+
+  if (signature.len != point_size * 2) return false;
+
+  if (IsSmallOrderEdDsaPoint(*this, signature.data, point_size)) {
+    return true;
+  }
+
+  unsigned char raw_public_key[kEd448PointSize];
+  size_t raw_public_key_size = point_size;
+  if (EVP_PKEY_get_raw_public_key(
+          get(), raw_public_key, &raw_public_key_size) != 1) {
+    return false;
+  }
+
+  return IsSmallOrderEdDsaPoint(*this, raw_public_key, raw_public_key_size);
+}
+
+int EVPKeyPointer::bits() const {
+  if (get() == nullptr) return 0;
+  return EVP_PKEY_bits(get());
+}
+
+size_t EVPKeyPointer::size() const {
+  if (get() == nullptr) return 0;
+  return EVP_PKEY_size(get());
+}
+
+EVPKeyCtxPointer EVPKeyPointer::newCtx() const {
+  if (!pkey_) return {};
+  return EVPKeyCtxPointer::New(*this);
+}
+
+size_t EVPKeyPointer::rawPublicKeySize() const {
+  if (!pkey_) return 0;
+  size_t len = 0;
+  if (EVP_PKEY_get_raw_public_key(get(), nullptr, &len) == 1) return len;
+  return 0;
+}
+
+size_t EVPKeyPointer::rawPrivateKeySize() const {
+  if (!pkey_) return 0;
+  size_t len = 0;
+  if (EVP_PKEY_get_raw_private_key(get(), nullptr, &len) == 1) return len;
+  return 0;
+}
+
+DataPointer EVPKeyPointer::rawPublicKey() const {
+  if (!pkey_) return {};
   if (auto data = DataPointer::Alloc(rawPublicKeySize())) {
     const Buffer<unsigned char> buf = data;
     size_t len = data.size();
@@ -3180,20 +3690,77 @@ DataPointer EVPKeyPointer::rawPublicKey() const {
   return {};
 }
 
-#if OPENSSL_WITH_PQC
-DataPointer EVPKeyPointer::rawSeed() const {
-  if (!pkey_) return {};
+namespace {
+DataPointer GetRawSeed([[maybe_unused]] EVP_PKEY* key, size_t seed_len) {
+  auto data = DataPointer::Alloc(seed_len);
+  if (!data) return {};
+#if NCRYPTO_USE_BORINGSSL || NCRYPTO_USE_OPENSSL3_PROVIDER
+  const Buffer<unsigned char> buf = data;
+  size_t len = data.size();
+#endif
+#if NCRYPTO_USE_BORINGSSL
+  if (EVP_PKEY_get_private_seed(key, buf.data, &len) != 1) return {};
+#elif NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (EVP_PKEY_get_octet_string_param(key, "seed", buf.data, buf.len, &len) !=
+      1)
+    return {};
+#else
+  return {};
+#endif
+  return data;
+}
 
-  const size_t seed_len = GetPqcSeedSize(id());
+}  // namespace
 
-  if (auto data = DataPointer::Alloc(seed_len)) {
-    const Buffer<unsigned char> buf = data;
-    if (!GetPqcSeed(get(), id(), buf)) return {};
-    return data;
+Result<DataPointer, EVPKeyPointer::RawExportError> EVPKeyPointer::rawSeed()
+    const {
+  const auto* algorithm = getAlgorithm();
+  if (algorithm == nullptr || algorithm->seedSize() == 0) {
+    return RawExportError::UNSUPPORTED_KEY_TYPE;
   }
-  return {};
+  auto data = GetRawSeed(get(), algorithm->seedSize());
+  if (!data) return RawExportError::MISSING_SEED;
+  return data;
+}
+
+Result<EVPKeyPointer::RawJwkData, EVPKeyPointer::RawExportError>
+EVPKeyPointer::exportRawJwk(bool include_private) const {
+  const auto* algorithm = getAlgorithm();
+  if (algorithm == nullptr || (!algorithm->isOkp() && !algorithm->isPqc())) {
+    return RawExportError::UNSUPPORTED_KEY_TYPE;
+  }
+  RawJwkData data{algorithm, {}, {}};
+  if (include_private) {
+    const size_t seed_len = algorithm->seedSize();
+    data.private_key =
+        seed_len != 0 ? GetRawSeed(get(), seed_len) : rawPrivateKey();
+    if (!data.private_key) {
+      return seed_len != 0 ? RawExportError::MISSING_SEED
+                           : RawExportError::FAILED;
+    }
+  }
+  data.public_key = rawPublicKey();
+  if (!data.public_key) return RawExportError::FAILED;
+  return data;
+}
+
+EVPKeyPointer EVPKeyPointer::NewRawJwk(
+    const KeyAlgorithm& algorithm,
+    const Buffer<const unsigned char>& public_key,
+    const std::optional<Buffer<const unsigned char>>& private_key) {
+  if (!algorithm.isOkp() && !algorithm.isPqc()) return {};
+  if (!private_key) return NewRawPublic(algorithm, public_key);
+  auto key = algorithm.seedSize() != 0 ? NewRawSeed(algorithm, *private_key)
+                                       : NewRawPrivate(algorithm, *private_key);
+  if (!key) return {};
+  const auto derived_public = key.rawPublicKey();
+  if (!derived_public || derived_public.size() != public_key.len ||
+      CRYPTO_memcmp(derived_public.get(), public_key.data, public_key.len) !=
+          0) {
+    return {};
+  }
+  return key;
 }
-#endif
 
 DataPointer EVPKeyPointer::rawPrivateKey() const {
   if (!pkey_) return {};
@@ -3278,7 +3845,7 @@ bool EVPKeyPointer::set(const ECKeyPointer& eckey) {
 
   OSSLParamPointer params(OSSL_PARAM_BLD_to_param(bld.get()));
   if (!params) return false;
-  auto pkey = NewPKeyFromData(EVP_PKEY_EC, selection, params.get());
+  auto pkey = NewPKeyFromData(KeyAlgorithm::EC, selection, params.get());
   if (!pkey) return false;
   reset(pkey.release());
   return true;
@@ -3296,6 +3863,47 @@ EVPKeyPointer::operator const EC_KEY*() const {
 
 namespace {
 
+EVP_PKEY* DecodeRsaPublicKey(const unsigned char** data, size_t length) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // Borrow the EVP_PKEY constructor and its data from a context that stays
+  // alive until after the restricted decoder context is destroyed.
+  EVP_PKEY* raw = nullptr;
+  DeleteFnPtr<OSSL_DECODER_CTX, OSSL_DECODER_CTX_free> construct_ctx(
+      OSSL_DECODER_CTX_new_for_pkey(&raw,
+                                    "DER",
+                                    "type-specific",
+                                    KeyAlgorithm::RSA.name(),
+                                    EVP_PKEY_PUBLIC_KEY,
+                                    nullptr,
+                                    nullptr));
+  if (!construct_ctx) return nullptr;
+  auto* construct = OSSL_DECODER_CTX_get_construct(construct_ctx.get());
+  void* construct_data =
+      OSSL_DECODER_CTX_get_construct_data(construct_ctx.get());
+  if (construct == nullptr || construct_data == nullptr) return nullptr;
+
+  // Add only the type-specific RSA decoder: new_for_pkey() can also build
+  // chains that accept SPKI. The owning context retains the cleanup callback.
+  DeleteFnPtr<OSSL_DECODER, OSSL_DECODER_free> decoder(OSSL_DECODER_fetch(
+      nullptr, KeyAlgorithm::RSA.name(), "input=der,structure=type-specific"));
+  DeleteFnPtr<OSSL_DECODER_CTX, OSSL_DECODER_CTX_free> ctx(
+      OSSL_DECODER_CTX_new());
+  if (!decoder || !ctx ||
+      OSSL_DECODER_CTX_add_decoder(ctx.get(), decoder.get()) != 1 ||
+      OSSL_DECODER_CTX_set_input_type(ctx.get(), "DER") != 1 ||
+      OSSL_DECODER_CTX_set_selection(ctx.get(), EVP_PKEY_PUBLIC_KEY) != 1 ||
+      OSSL_DECODER_CTX_set_construct(ctx.get(), construct) != 1 ||
+      OSSL_DECODER_CTX_set_construct_data(ctx.get(), construct_data) != 1) {
+    return nullptr;
+  }
+  const int result = OSSL_DECODER_from_data(ctx.get(), data, &length);
+  EVPKeyPointer key(raw);
+  return result == 1 ? key.release() : nullptr;
+#else
+  return d2i_PublicKey(NID_rsaEncryption, nullptr, data, length);
+#endif
+}
+
 EVPKeyPointer::ParseKeyResult TryParsePublicKeyInner(const BIOPointer& bp,
                                                      const char* name,
                                                      auto&& parse) {
@@ -3347,34 +3955,6 @@ constexpr bool IsASN1Sequence(const unsigned char* data,
   return true;
 }
 
-constexpr bool ReadASN1Element(const unsigned char* data,
-                               size_t size,
-                               unsigned char tag,
-                               size_t* header_size,
-                               size_t* content_size,
-                               size_t* total_size) {
-  if (size < 2 || data[0] != tag) return false;
-
-  size_t offset;
-  size_t length;
-  if (data[1] & 0x80) {
-    size_t n_bytes = data[1] & ~0x80;
-    if (n_bytes + 2 > size || n_bytes > sizeof(size_t)) return false;
-    length = 0;
-    for (size_t i = 0; i < n_bytes; i++) length = (length << 8) | data[i + 2];
-    offset = 2 + n_bytes;
-  } else {
-    offset = 2;
-    length = data[1];
-  }
-
-  if (offset > size || length > size - offset) return false;
-  *header_size = offset;
-  *content_size = length;
-  *total_size = offset + length;
-  return true;
-}
-
 constexpr bool IsEncryptedPrivateKeyInfo(
     const Buffer<const unsigned char>& buffer) {
   // Both PrivateKeyInfo and EncryptedPrivateKeyInfo start with a SEQUENCE.
@@ -3423,7 +4003,7 @@ EVPKeyPointer::ParseKeyResult EVPKeyPointer::TryParsePublicKeyPEM(
           bp,
           "RSA PUBLIC KEY",
           [](const unsigned char** p, long l) {  // NOLINT(runtime/int)
-            return d2i_PublicKey(EVP_PKEY_RSA, nullptr, p, l);
+            return DecodeRsaPublicKey(p, l);
           })) {
     return ret;
   }
@@ -3458,7 +4038,7 @@ EVPKeyPointer::ParseKeyResult EVPKeyPointer::TryParsePublicKey(
   EVP_PKEY* key = nullptr;
 
   if (config.type == PKEncodingType::PKCS1 &&
-      (key = d2i_PublicKey(EVP_PKEY_RSA, nullptr, &start, buffer.len))) {
+      (key = DecodeRsaPublicKey(&start, buffer.len))) {
     return EVPKeyPointer::ParseKeyResult(EVPKeyPointer(key));
   }
 
@@ -3574,7 +4154,7 @@ bool WriteEncryptedTraditionalPEM(BIO* bio,
 }
 
 bool ECKeyHasMissingOid(const EVPKeyPointer& key) {
-  if (key.id() != EVP_PKEY_EC) return false;
+  if (!key.isA(KeyAlgorithm::EC)) return false;
 
   const Ec ec(key.get());
   const EC_GROUP* group = ec.getGroup();
@@ -3768,11 +4348,11 @@ Result<BIOPointer, bool> EVPKeyPointer::writePrivateKey(
   switch (config.type) {
     case PKEncodingType::PKCS1: {
       // PKCS1 is only permitted for RSA keys.
-      if (id() != EVP_PKEY_RSA) return Result<BIOPointer, bool>(false);
+      if (!isA(KeyAlgorithm::RSA)) return Result<BIOPointer, bool>(false);
 
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
       const EVP_CIPHER* cipher =
-          config.format == PKFormatType::PEM ? config.cipher : nullptr;
+          config.format == PKFormatType::PEM ? config.cipher.get() : nullptr;
       if (cipher != nullptr && passphrase.len == 0) {
         err =
             !WriteEncryptedTraditionalPEM(bio.get(), get(), cipher, passphrase);
@@ -3850,11 +4430,11 @@ Result<BIOPointer, bool> EVPKeyPointer::writePrivateKey(
     }
     case PKEncodingType::SEC1: {
       // SEC1 is only permitted for EC keys
-      if (id() != EVP_PKEY_EC) return Result<BIOPointer, bool>(false);
+      if (!isA(KeyAlgorithm::EC)) return Result<BIOPointer, bool>(false);
 
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
       const EVP_CIPHER* cipher =
-          config.format == PKFormatType::PEM ? config.cipher : nullptr;
+          config.format == PKFormatType::PEM ? config.cipher.get() : nullptr;
       err = !WriteEncodedPKey(bio.get(),
                               get(),
                               OSSL_KEYMGMT_SELECT_ALL,
@@ -3920,7 +4500,7 @@ Result<BIOPointer, bool> EVPKeyPointer::writePublicKey(
   if (config.type == ncrypto::EVPKeyPointer::PKEncodingType::PKCS1) {
     // PKCS#1 is only valid for RSA keys.
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
-    if (id() != EVP_PKEY_RSA) return Result<BIOPointer, bool>(false);
+    if (!isA(KeyAlgorithm::RSA)) return Result<BIOPointer, bool>(false);
     if (!WriteEncodedPKey(bio.get(),
                           get(),
                           OSSL_KEYMGMT_SELECT_PUBLIC_KEY,
@@ -3999,59 +4579,30 @@ Result<BIOPointer, bool> EVPKeyPointer::writePublicKey(
   return bio;
 }
 
-bool EVPKeyPointer::isRsaVariant() const {
-  if (!pkey_) return false;
-  int type = id();
-  return type == EVP_PKEY_RSA || type == EVP_PKEY_RSA2 ||
-         type == EVP_PKEY_RSA_PSS;
+bool EVPKeyPointer::isRsaVariant(const EVP_PKEY* key) {
+#if !NCRYPTO_USE_OPENSSL3_PROVIDER && !NCRYPTO_USE_BORINGSSL
+  if (key != nullptr && EVP_PKEY_id(key) == EVP_PKEY_RSA2) return true;
+#endif
+  return isA(key, KeyAlgorithm::RSA) || isA(key, KeyAlgorithm::RSA_PSS);
 }
 
-bool EVPKeyPointer::isOneShotVariant() const {
-  if (!pkey_) return false;
-  int type = id();
-  switch (type) {
-    case EVP_PKEY_ED25519:
-    case EVP_PKEY_ED448:
-#if OPENSSL_WITH_PQC
-    case EVP_PKEY_ML_DSA_44:
-    case EVP_PKEY_ML_DSA_65:
-    case EVP_PKEY_ML_DSA_87:
-#if OPENSSL_WITH_PQC_SLH_DSA
-    case EVP_PKEY_SLH_DSA_SHA2_128F:
-    case EVP_PKEY_SLH_DSA_SHA2_128S:
-    case EVP_PKEY_SLH_DSA_SHA2_192F:
-    case EVP_PKEY_SLH_DSA_SHA2_192S:
-    case EVP_PKEY_SLH_DSA_SHA2_256F:
-    case EVP_PKEY_SLH_DSA_SHA2_256S:
-    case EVP_PKEY_SLH_DSA_SHAKE_128F:
-    case EVP_PKEY_SLH_DSA_SHAKE_128S:
-    case EVP_PKEY_SLH_DSA_SHAKE_192F:
-    case EVP_PKEY_SLH_DSA_SHAKE_192S:
-    case EVP_PKEY_SLH_DSA_SHAKE_256F:
-    case EVP_PKEY_SLH_DSA_SHAKE_256S:
-#endif
-#endif
-      return true;
-    default:
-      return false;
-  }
+bool EVPKeyPointer::isRsaVariant() const {
+  return isRsaVariant(get());
 }
 
 bool EVPKeyPointer::isSigVariant() const {
-  if (!pkey_) return false;
-  int type = id();
-  return type == EVP_PKEY_EC || type == EVP_PKEY_DSA;
+  return isA(KeyAlgorithm::EC) || isA(KeyAlgorithm::DSA);
 }
 
 int EVPKeyPointer::getDefaultSignPadding() const {
-  return id() == EVP_PKEY_RSA_PSS ? RSA_PKCS1_PSS_PADDING : RSA_PKCS1_PADDING;
+  return isA(KeyAlgorithm::RSA_PSS) ? RSA_PKCS1_PSS_PADDING : RSA_PKCS1_PADDING;
 }
 
 std::optional<uint32_t> EVPKeyPointer::getBytesOfRS() const {
   if (!pkey_) return std::nullopt;
-  int bits, id = base_id();
+  int bits;
 
-  if (id == EVP_PKEY_DSA) {
+  if (isA(KeyAlgorithm::DSA)) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
     DeleteFnPtr<BIGNUM, BN_free> q;
     if (!GetPKeyBnParam(get(), OSSL_PKEY_PARAM_FFC_Q, &q)) return std::nullopt;
@@ -4069,13 +4620,9 @@ std::optional<uint32_t> EVPKeyPointer::getBytesOfRS() const {
     }
     if (!has_bits) return std::nullopt;
 #endif
-  } else if (id == EVP_PKEY_EC) {
+  } else if (isA(KeyAlgorithm::EC)) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
-    Ec ec(get());
-    if (!ec) return std::nullopt;
-    const EC_GROUP* group = ec.getGroup();
-    if (group == nullptr) return std::nullopt;
-    bits = EC_GROUP_order_bits(group);
+    bits = EVP_PKEY_bits(get());
 #else
     const EC_KEY* ec_key = EVP_PKEY_get0_EC_KEY(get());
     if (ec_key == nullptr) return std::nullopt;
@@ -4093,8 +4640,7 @@ std::optional<uint32_t> EVPKeyPointer::getBytesOfRS() const {
 }
 
 EVPKeyPointer::operator Rsa() const {
-  int type = id();
-  if (type != EVP_PKEY_RSA && type != EVP_PKEY_RSA_PSS) return {};
+  if (!isA(KeyAlgorithm::RSA) && !isA(KeyAlgorithm::RSA_PSS)) return {};
 
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   return Rsa(get());
@@ -4113,8 +4659,7 @@ EVPKeyPointer::operator Rsa() const {
 }
 
 EVPKeyPointer::operator Dsa() const {
-  int type = id();
-  if (type != EVP_PKEY_DSA) return {};
+  if (!isA(KeyAlgorithm::DSA)) return {};
 
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   return Dsa(get());
@@ -4128,9 +4673,10 @@ EVPKeyPointer::operator Dsa() const {
 bool EVPKeyPointer::validateDsaParameters() const {
   if (!pkey_) return false;
 #if OPENSSL_VERSION_MAJOR >= 3
-  if (EVP_default_properties_is_fips_enabled(nullptr) && EVP_PKEY_DSA == id()) {
+  if (EVP_default_properties_is_fips_enabled(nullptr) &&
+      isA(KeyAlgorithm::DSA)) {
 #else
-  if (FIPS_mode() && EVP_PKEY_DSA == id()) {
+  if (FIPS_mode() && isA(KeyAlgorithm::DSA)) {
 #endif
     // Validate DSA2 parameters from FIPS 186-4.
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
@@ -4407,39 +4953,389 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
 
 // ============================================================================
 
-const Cipher Cipher::FromName(const char* name) {
+namespace {
+constexpr char AsciiToLower(char c) {
+  return c >= 'A' && c <= 'Z' ? c + ('a' - 'A') : c;
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+constexpr auto kUnsupportedCipherFlags =
+    EVP_CIPH_FLAG_CIPHER_WITH_MAC | EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK;
+
+bool HasUnsupportedCipherFlags(const EVP_CIPHER* cipher) {
+  return (EVP_CIPHER_get_flags(cipher) & kUnsupportedCipherFlags) != 0;
+}
+
+bool IsSupportedLegacyCipher(const EVP_CIPHER* cipher) {
+  return cipher != nullptr && cipher != EVP_enc_null() &&
+         !HasUnsupportedCipherFlags(cipher);
+}
+
+bool IsSupportedFetchedCipher(const EVP_CIPHER* cipher) {
+  if (cipher == nullptr || EVP_CIPHER_is_a(cipher, "NULL") ||
+      HasUnsupportedCipherFlags(cipher)) {
+    return false;
+  }
+
+#ifdef OSSL_CIPHER_PARAM_ENCRYPT_THEN_MAC
+  int encrypt_then_mac = 0;
+  OSSL_PARAM params[] = {
+      OSSL_PARAM_construct_int(OSSL_CIPHER_PARAM_ENCRYPT_THEN_MAC,
+                               &encrypt_then_mac),
+      OSSL_PARAM_construct_end(),
+  };
+  if (EVP_CIPHER_get_params(const_cast<EVP_CIPHER*>(cipher), params) == 1 &&
+      encrypt_then_mac != 0) {
+    return false;
+  }
+#endif
+
+  return true;
+}
+
+void PushAlgorithmAlias(const char* name, void* arg) {
+  if (name == nullptr) return;
+  static_cast<std::vector<std::string>*>(arg)->emplace_back(name);
+}
+#endif
+}  // namespace
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
+    : cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
+#endif
+
+size_t CaseInsensitiveNameHash::operator()(
+    std::string_view name) const noexcept {
+  size_t hash = 5381;
+  for (char c : name) hash = ((hash << 5) + hash) ^ AsciiToLower(c);
+  return hash;
+}
+
+bool CaseInsensitiveNameEqual::operator()(std::string_view lhs,
+                                          std::string_view rhs) const noexcept {
+  if (lhs.size() != rhs.size()) return false;
+  for (size_t n = 0; n < lhs.size(); n++) {
+    if (AsciiToLower(lhs[n]) != AsciiToLower(rhs[n])) return false;
+  }
+  return true;
+}
+
+DigestCache::Result DigestCache::lookup(const char* name,
+                                        uint64_t generation) const {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ != generation) return {};
+  const auto it = aliases_.find(name);
+  if (it == aliases_.end()) return {};
+  return lookup(it->second, generation);
+#else
+  static_cast<void>(name);
+  static_cast<void>(generation);
+  return {};
+#endif
+}
+
+DigestCache::Result DigestCache::insert(const char* name,
+                                        const EVP_MD* digest,
+                                        uint64_t generation) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ != generation || name == nullptr || digest == nullptr) {
+    return {};
+  }
+
+  const char* canonical_name = EVP_MD_get0_name(digest);
+  const OSSL_PROVIDER* provider = EVP_MD_get0_provider(digest);
+  if (canonical_name == nullptr || provider == nullptr) return {};
+
+  for (size_t index = 0; index < digests_.size(); index++) {
+    const EVP_MD* cached = digests_[index].get();
+    if (cached == nullptr) continue;
+    const char* cached_name = EVP_MD_get0_name(cached);
+    if (EVP_MD_get0_provider(cached) == provider && cached_name != nullptr &&
+        CaseInsensitiveNameEqual()(cached_name, canonical_name)) {
+      const int32_t id = static_cast<int32_t>(first_id_ + index);
+      aliases_.insert_or_assign(name, id);
+      return {cached, id};
+    }
+  }
+
+  if (next_id_ == UINT32_MAX ||
+      EVP_MD_up_ref(const_cast<EVP_MD*>(digest)) != 1) {
+    return {};
+  }
+
+  digests_.emplace_back(const_cast<EVP_MD*>(digest));
+  const int32_t id = static_cast<int32_t>(next_id_++);
+  const size_t index = digests_.size() - 1;
+
+  std::vector<std::string> aliases;
+  EVP_MD_names_do_all(digests_[index].get(), PushAlgorithmAlias, &aliases);
+  for (const std::string& alias : aliases) aliases_.emplace(alias, id);
+  aliases_.insert_or_assign(name, id);
+
+  return {digests_[index].get(), id};
+#else
+  static_cast<void>(name);
+  static_cast<void>(digest);
+  static_cast<void>(generation);
+  return {};
+#endif
+}
+
+void DigestCache::reset(uint64_t generation) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ == generation) return;
+  aliases_.clear();
+  digests_.clear();
+  first_id_ = next_id_;
+#endif
+  generation_ = generation;
+}
+
+const DigestCache::AliasMap& DigestCache::aliases() const {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return aliases_;
+#else
+  static const AliasMap empty;
+  return empty;
+#endif
+}
+
+const EVP_CIPHER* CipherCache::lookup(const char* name, uint64_t generation) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (generation_ != generation) {
+    aliases_.clear();
+    ciphers_.clear();
+    generation_ = generation;
+  }
+
+  const auto it = aliases_.find(name);
+  if (it == aliases_.end()) return nullptr;
+  if (it->second >= ciphers_.size()) return nullptr;
+  return ciphers_[it->second].get();
+#else
+  static_cast<void>(name);
+  static_cast<void>(generation);
+  return nullptr;
+#endif
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+const EVP_CIPHER* CipherCache::insert(
+    const char* name,
+    DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>&& cipher,
+    uint64_t generation) {
+  if (generation_ != generation || cipher == nullptr) return nullptr;
+
+  const char* canonical_name = EVP_CIPHER_get0_name(cipher.get());
+  const OSSL_PROVIDER* provider = EVP_CIPHER_get0_provider(cipher.get());
+  if (canonical_name != nullptr && provider != nullptr) {
+    for (size_t id = 0; id < ciphers_.size(); id++) {
+      const EVP_CIPHER* cached = ciphers_[id].get();
+      const char* cached_name = EVP_CIPHER_get0_name(cached);
+      if (EVP_CIPHER_get0_provider(cached) == provider &&
+          cached_name != nullptr &&
+          CaseInsensitiveNameEqual()(cached_name, canonical_name)) {
+        aliases_.insert_or_assign(name, id);
+        return cached;
+      }
+    }
+  }
+
+  ciphers_.emplace_back(std::move(cipher));
+  const size_t id = ciphers_.size() - 1;
+
+  std::vector<std::string> aliases;
+  EVP_CIPHER_names_do_all(ciphers_[id].get(), PushAlgorithmAlias, &aliases);
+  for (const std::string& alias : aliases) {
+    aliases_.emplace(alias, id);
+  }
+  aliases_.insert_or_assign(name, id);
+
+  return ciphers_[id].get();
+}
+#endif
+
+Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (other.fetched_cipher_ != nullptr) {
+    if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
+      fetched_cipher_.reset(other.fetched_cipher_.get());
+    } else {
+      cipher_ = nullptr;
+    }
+  }
+#endif
+}
+
+Cipher& Cipher::operator=(const Cipher& other) {
+  if (this == &other) return *this;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (other.fetched_cipher_ != nullptr) {
+    if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
+      fetched_cipher_.reset(other.fetched_cipher_.get());
+    } else {
+      fetched_cipher_.reset();
+      cipher_ = nullptr;
+      return *this;
+    }
+  } else {
+    fetched_cipher_.reset();
+  }
+#endif
+  cipher_ = other.cipher_;
+  return *this;
+}
+
+const Cipher Cipher::FromName(const char* name, CipherCache* cache) {
+  const EVP_CIPHER* cipher = EVP_get_cipherbyname(name);
+  if (cipher != nullptr) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (!IsSupportedLegacyCipher(cipher)) return Cipher();
+#endif
+    return Cipher(cipher);
+  }
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // A resolution that overlaps a FIPS transition may use either property
+  // state. The cache retains the generation observed here, so the first
+  // resolution begun after the transition clears any stale entries.
+  const uint64_t generation = getFipsStateGeneration();
+  if (cache != nullptr) {
+    if (const EVP_CIPHER* cached = cache->lookup(name, generation)) {
+      return Cipher(cached);
+    }
+  }
+
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+  DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
+      EVP_CIPHER_fetch(nullptr, name, nullptr));
+  if (!IsSupportedFetchedCipher(fetched.get())) return Cipher();
+
+  if (cache != nullptr && generation == getFipsStateGeneration()) {
+    if (const EVP_CIPHER* cached =
+            cache->insert(name, std::move(fetched), generation)) {
+      return Cipher(cached);
+    }
+  }
+
+  return Cipher(std::move(fetched));
+#else
+  static_cast<void>(cache);
+  return Cipher();
+#endif
+}
+
+const Cipher Cipher::FromNameForKeyEncoding(const char* name) {
+  // Key serializers have their own cipher restrictions. Preserve their policy
+  // instead of applying the filters used by the general cipher operations.
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+  DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
+      EVP_CIPHER_fetch(nullptr, name, nullptr));
+  if (fetched) return Cipher(std::move(fetched));
+#endif
+  // Preserve serializer errors for known ciphers that cannot be fetched.
   return Cipher(EVP_get_cipherbyname(name));
 }
 
-const Cipher Cipher::FromNid(int nid) {
-  return Cipher(EVP_get_cipherbynid(nid));
+const Cipher Cipher::FromNid(int nid, CipherCache* cache) {
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+  const EVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
+  if (cipher != nullptr) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (!IsSupportedLegacyCipher(cipher)) return Cipher();
+#endif
+    return Cipher(cipher);
+  }
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const char* name = OBJ_nid2sn(nid);
+  if (name != nullptr) return FromName(name, cache);
+#else
+  static_cast<void>(cache);
+#endif
+
+  return Cipher();
 }
 
 const Cipher Cipher::FromCtx(const CipherCtxPointer& ctx) {
   return Cipher(GetCipherCtxCipher(ctx.get()));
 }
 
-const Cipher Cipher::EMPTY = Cipher();
-const Cipher Cipher::AES_128_CBC = Cipher::FromNid(NID_aes_128_cbc);
-const Cipher Cipher::AES_192_CBC = Cipher::FromNid(NID_aes_192_cbc);
-const Cipher Cipher::AES_256_CBC = Cipher::FromNid(NID_aes_256_cbc);
-const Cipher Cipher::AES_128_CTR = Cipher::FromNid(NID_aes_128_ctr);
-const Cipher Cipher::AES_192_CTR = Cipher::FromNid(NID_aes_192_ctr);
-const Cipher Cipher::AES_256_CTR = Cipher::FromNid(NID_aes_256_ctr);
-const Cipher Cipher::AES_128_GCM = Cipher::FromNid(NID_aes_128_gcm);
-const Cipher Cipher::AES_192_GCM = Cipher::FromNid(NID_aes_192_gcm);
-const Cipher Cipher::AES_256_GCM = Cipher::FromNid(NID_aes_256_gcm);
-const Cipher Cipher::AES_128_KW = Cipher::FromNid(NID_id_aes128_wrap);
-const Cipher Cipher::AES_192_KW = Cipher::FromNid(NID_id_aes192_wrap);
-const Cipher Cipher::AES_256_KW = Cipher::FromNid(NID_id_aes256_wrap);
+namespace {
+template <int nid>
+const Cipher& GetPredefinedCipher() {
+  static const Cipher cipher = Cipher::FromNid(nid);
+  return cipher;
+}
+}  // namespace
+
+const Cipher& Cipher::AES_128_CBC() {
+  return GetPredefinedCipher<NID_aes_128_cbc>();
+}
+
+const Cipher& Cipher::AES_192_CBC() {
+  return GetPredefinedCipher<NID_aes_192_cbc>();
+}
+
+const Cipher& Cipher::AES_256_CBC() {
+  return GetPredefinedCipher<NID_aes_256_cbc>();
+}
+
+const Cipher& Cipher::AES_128_CTR() {
+  return GetPredefinedCipher<NID_aes_128_ctr>();
+}
+
+const Cipher& Cipher::AES_192_CTR() {
+  return GetPredefinedCipher<NID_aes_192_ctr>();
+}
+
+const Cipher& Cipher::AES_256_CTR() {
+  return GetPredefinedCipher<NID_aes_256_ctr>();
+}
+
+const Cipher& Cipher::AES_128_GCM() {
+  return GetPredefinedCipher<NID_aes_128_gcm>();
+}
+
+const Cipher& Cipher::AES_192_GCM() {
+  return GetPredefinedCipher<NID_aes_192_gcm>();
+}
+
+const Cipher& Cipher::AES_256_GCM() {
+  return GetPredefinedCipher<NID_aes_256_gcm>();
+}
+
+const Cipher& Cipher::AES_128_KW() {
+  return GetPredefinedCipher<NID_id_aes128_wrap>();
+}
+
+const Cipher& Cipher::AES_192_KW() {
+  return GetPredefinedCipher<NID_id_aes192_wrap>();
+}
+
+const Cipher& Cipher::AES_256_KW() {
+  return GetPredefinedCipher<NID_id_aes256_wrap>();
+}
 
 #ifndef OPENSSL_IS_BORINGSSL
-const Cipher Cipher::AES_128_OCB = Cipher::FromNid(NID_aes_128_ocb);
-const Cipher Cipher::AES_192_OCB = Cipher::FromNid(NID_aes_192_ocb);
-const Cipher Cipher::AES_256_OCB = Cipher::FromNid(NID_aes_256_ocb);
+const Cipher& Cipher::AES_128_OCB() {
+  return GetPredefinedCipher<NID_aes_128_ocb>();
+}
+
+const Cipher& Cipher::AES_192_OCB() {
+  return GetPredefinedCipher<NID_aes_192_ocb>();
+}
+
+const Cipher& Cipher::AES_256_OCB() {
+  return GetPredefinedCipher<NID_aes_256_ocb>();
+}
 #endif
 
-const Cipher Cipher::CHACHA20_POLY1305 = Cipher::FromNid(NID_chacha20_poly1305);
+const Cipher& Cipher::CHACHA20_POLY1305() {
+  return GetPredefinedCipher<NID_chacha20_poly1305>();
+}
 
 bool Cipher::isGcmMode() const {
   if (!cipher_) return false;
@@ -4461,11 +5357,38 @@ bool Cipher::isCcmMode() const {
   return getMode() == EVP_CIPH_CCM_MODE;
 }
 
+bool Cipher::isCtsMode() const {
+  if (!cipher_) return false;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return (EVP_CIPHER_get_flags(cipher_) & EVP_CIPH_FLAG_CTS) != 0;
+#else
+  return false;
+#endif
+}
+
 bool Cipher::isOcbMode() const {
   if (!cipher_) return false;
   return getMode() == EVP_CIPH_OCB_MODE;
 }
 
+bool Cipher::isSivMode() const {
+  if (!cipher_) return false;
+#if OPENSSL_WITH_AES_SIV
+  return getMode() == EVP_CIPH_SIV_MODE;
+#else
+  return false;
+#endif
+}
+
+bool Cipher::isGcmSivMode() const {
+  if (!cipher_) return false;
+#if OPENSSL_WITH_AES_GCM_SIV
+  return getMode() == EVP_CIPH_GCM_SIV_MODE;
+#else
+  return false;
+#endif
+}
+
 bool Cipher::isStreamMode() const {
   if (!cipher_) return false;
   return getMode() == EVP_CIPH_STREAM_CIPHER;
@@ -4520,6 +5443,14 @@ std::string_view Cipher::getModeLabel() const {
       return "ocb";
     case EVP_CIPH_OFB_MODE:
       return "ofb";
+#if OPENSSL_WITH_AES_SIV
+    case EVP_CIPH_SIV_MODE:
+      return "siv";
+#endif
+#if OPENSSL_WITH_AES_GCM_SIV
+    case EVP_CIPH_GCM_SIV_MODE:
+      return "gcm-siv";
+#endif
     case EVP_CIPH_WRAP_MODE:
       return "wrap";
     case EVP_CIPH_XTS_MODE:
@@ -4534,7 +5465,16 @@ const char* Cipher::getName() const {
   if (!cipher_) return {};
   // OBJ_nid2sn(EVP_CIPHER_nid(cipher)) is used here instead of
   // EVP_CIPHER_name(cipher) for compatibility with BoringSSL.
-  return OBJ_nid2sn(getNid());
+  const int nid = getNid();
+  if (nid != NID_undef) {
+    const char* name = OBJ_nid2sn(nid);
+    if (name != nullptr) return name;
+  }
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return EVP_CIPHER_get0_name(cipher_);
+#else
+  return {};
+#endif
 }
 
 bool Cipher::isSupportedAuthenticatedMode() const {
@@ -4543,6 +5483,12 @@ bool Cipher::isSupportedAuthenticatedMode() const {
     case EVP_CIPH_GCM_MODE:
 #ifndef OPENSSL_NO_OCB
     case EVP_CIPH_OCB_MODE:
+#endif
+#if OPENSSL_WITH_AES_SIV
+    case EVP_CIPH_SIV_MODE:
+#endif
+#if OPENSSL_WITH_AES_GCM_SIV
+    case EVP_CIPH_GCM_SIV_MODE:
 #endif
       return true;
     case EVP_CIPH_STREAM_CIPHER:
@@ -4621,11 +5567,57 @@ bool CipherCtxPointer::setAeadTagLength(size_t length) {
       ctx_.get(), EVP_CTRL_AEAD_SET_TAG, length, nullptr);
 }
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+namespace {
+// OSSL_CIPHER_PARAM_XTS_STANDARD is not defined by OpenSSL 3.0. Use its
+// parameter name directly so custom 3.0 providers can advertise it too.
+constexpr char kCipherParamXtsStandard[] = "xts_standard";
+
+bool SetCipherCtxStringParam(EVP_CIPHER_CTX* ctx,
+                             const char* key,
+                             const char* value) {
+  if (ctx == nullptr || value == nullptr) return false;
+
+  const OSSL_PARAM* settable = EVP_CIPHER_CTX_settable_params(ctx);
+  const OSSL_PARAM* descriptor =
+      settable == nullptr ? nullptr : OSSL_PARAM_locate_const(settable, key);
+  if (descriptor == nullptr ||
+      descriptor->data_type != OSSL_PARAM_UTF8_STRING) {
+    return false;
+  }
+
+  OSSL_PARAM params[] = {
+      OSSL_PARAM_construct_utf8_string(key, const_cast<char*>(value), 0),
+      OSSL_PARAM_END,
+  };
+  return EVP_CIPHER_CTX_set_params(ctx, params) == 1;
+}
+}  // namespace
+#endif
+
+bool CipherCtxPointer::setCtsMode(const char* mode) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return SetCipherCtxStringParam(ctx_.get(), OSSL_CIPHER_PARAM_CTS_MODE, mode);
+#else
+  static_cast<void>(mode);
+  return false;
+#endif
+}
+
 bool CipherCtxPointer::setPadding(bool padding) {
   if (!ctx_) return false;
   return EVP_CIPHER_CTX_set_padding(ctx_.get(), padding);
 }
 
+bool CipherCtxPointer::setXtsStandard(const char* standard) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return SetCipherCtxStringParam(ctx_.get(), kCipherParamXtsStandard, standard);
+#else
+  static_cast<void>(standard);
+  return false;
+#endif
+}
+
 int CipherCtxPointer::getBlockSize() const {
   if (!ctx_) return 0;
   return EVP_CIPHER_CTX_block_size(ctx_.get());
@@ -4651,11 +5643,39 @@ bool CipherCtxPointer::isCcmMode() const {
   return getMode() == EVP_CIPH_CCM_MODE;
 }
 
+bool CipherCtxPointer::isCtsMode() const {
+  if (!ctx_) return false;
+  return Cipher::FromCtx(*this).isCtsMode();
+}
+
+bool CipherCtxPointer::isXtsMode() const {
+  if (!ctx_) return false;
+  return getMode() == EVP_CIPH_XTS_MODE;
+}
+
 bool CipherCtxPointer::isWrapMode() const {
   if (!ctx_) return false;
   return getMode() == EVP_CIPH_WRAP_MODE;
 }
 
+bool CipherCtxPointer::isSivMode() const {
+  if (!ctx_) return false;
+#if OPENSSL_WITH_AES_SIV
+  return getMode() == EVP_CIPH_SIV_MODE;
+#else
+  return false;
+#endif
+}
+
+bool CipherCtxPointer::isGcmSivMode() const {
+  if (!ctx_) return false;
+#if OPENSSL_WITH_AES_GCM_SIV
+  return getMode() == EVP_CIPH_GCM_SIV_MODE;
+#else
+  return false;
+#endif
+}
+
 bool CipherCtxPointer::isChaCha20Poly1305() const {
   if (!ctx_) return false;
   return getNid() == NID_chacha20_poly1305;
@@ -4829,11 +5849,29 @@ bool ECPointPointer::mul(const EC_GROUP* group, const BIGNUM* priv_key) {
 
 // ============================================================================
 
+bool ECKeyPointer::checkPrivateKey() const {
+  const auto group = getGroup();
+  const auto priv = getPrivateKey();
+  const auto pub = getPublicKey();
+  if (group == nullptr || priv == nullptr || pub == nullptr) return false;
+
+  auto order = BignumPointer::New();
+  if (!order || !EC_GROUP_get_order(group, order.get(), nullptr) ||
+      BN_is_zero(priv) || BN_is_negative(priv) ||
+      BN_cmp(priv, order.get()) >= 0) {
+    return false;
+  }
+
+  auto expected = ECPointPointer::New(group);
+  return expected && expected.mul(group, priv) &&
+         EC_POINT_cmp(group, expected.get(), pub, nullptr) == 0;
+}
+
 #if NCRYPTO_USE_LEGACY_KEY_TYPES
 ECKeyPointer::ECKeyPointer() : key_(nullptr) {}
 
 ECKeyPointer::ECKeyPointer(const EVPKeyPointer& key) : key_(nullptr) {
-  if (key.id() != EVP_PKEY_EC) return;
+  if (!key.isA(KeyAlgorithm::EC)) return;
   const EC_KEY* ec = key;
   if (ec != nullptr) key_.reset(EC_KEY_dup(ec));
 }
@@ -4986,7 +6024,7 @@ ECKeyPointer ECKeyPointer::New(const EC_GROUP* group) {
 ECKeyPointer::ECKeyPointer() : group_(nullptr), pub_(nullptr), priv_(nullptr) {}
 
 ECKeyPointer::ECKeyPointer(const EVPKeyPointer& key) : ECKeyPointer() {
-  if (key.id() != EVP_PKEY_EC) return;
+  if (!key.isA(KeyAlgorithm::EC)) return;
   char group_name[80];
   size_t group_name_len = 0;
   if (EVP_PKEY_get_utf8_string_param(key.get(),
@@ -5072,7 +6110,7 @@ ECKeyPointer ECKeyPointer::clone() const {
 bool ECKeyPointer::generate() {
   if (!group_) return false;
   const int nid = EC_GROUP_get_curve_name(group_.get());
-  auto ctx = EVPKeyCtxPointer::NewFromID(EVP_PKEY_EC);
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::EC);
   if (!ctx || !ctx.initForKeygen() ||
       !ctx.setEcParameters(nid, OPENSSL_EC_NAMED_CURVE)) {
     return false;
@@ -5271,12 +6309,24 @@ EVPKeyCtxPointer EVPKeyCtxPointer::New(const EVPKeyPointer& key) {
   return EVPKeyCtxPointer(EVP_PKEY_CTX_new(key.get(), nullptr));
 }
 
-EVPKeyCtxPointer EVPKeyCtxPointer::NewFromID(int id) {
+EVPKeyCtxPointer EVPKeyCtxPointer::NewFromName(const char* name) {
+  if (name == nullptr) return {};
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return EVPKeyCtxPointer(EVP_PKEY_CTX_new_from_name(nullptr, name, nullptr));
+#else
+  const int id = GetLegacyKeyId(name);
+  if (id == NID_undef) return {};
 #ifdef OPENSSL_IS_BORINGSSL
-  // DSA keys are not supported with BoringSSL
+  // DSA keys are not supported with BoringSSL.
   if (id == EVP_PKEY_DSA) return {};
 #endif
   return EVPKeyCtxPointer(EVP_PKEY_CTX_new_id(id, nullptr));
+#endif
+}
+
+EVPKeyCtxPointer EVPKeyCtxPointer::NewFromAlgorithm(
+    const KeyAlgorithm& algorithm) {
+  return NewFromName(algorithm.name());
 }
 
 bool EVPKeyCtxPointer::initForDerive(const EVPKeyPointer& peer) {
@@ -5331,10 +6381,15 @@ bool EVPKeyCtxPointer::setDsaParameters(uint32_t bits,
 }
 
 bool EVPKeyCtxPointer::setEcParameters(int curve, int encoding) {
-  if (!ctx_) return false;
+  return setEcParameters(OBJ_nid2sn(curve), encoding);
+}
+
+bool EVPKeyCtxPointer::setEcParameters(const char* group_name, int encoding) {
+  if (!ctx_ || group_name == nullptr) return false;
+  const int curve = Ec::GetCurveIdFromName(group_name);
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
-  const char* group_name = OBJ_nid2sn(curve);
-  if (group_name == nullptr) return false;
+  // Keep the historical aliases while allowing names known only to providers.
+  if (curve != NID_undef) group_name = OBJ_nid2sn(curve);
 
   const char* encoding_name = nullptr;
   switch (encoding) {
@@ -5356,7 +6411,8 @@ bool EVPKeyCtxPointer::setEcParameters(int curve, int encoding) {
   };
   return EVP_PKEY_CTX_set_params(ctx_.get(), params) == 1;
 #else
-  return EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx_.get(), curve) == 1 &&
+  return curve != NID_undef &&
+         EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx_.get(), curve) == 1 &&
          EVP_PKEY_CTX_set_ec_param_enc(ctx_.get(), encoding) == 1;
 #endif
 }
@@ -5576,9 +6632,11 @@ DataPointer RSA_Cipher(const EVPKeyPointer& key,
   if (!key) return {};
   EVPKeyCtxPointer ctx = key.newCtx();
 
+  const Digest& mgf1_digest =
+      params.mgf1_digest != nullptr ? params.mgf1_digest : params.digest;
   if (!ctx || init(ctx.get()) <= 0 || !ctx.setRsaPadding(params.padding) ||
-      (params.digest != nullptr && (!ctx.setRsaOaepMd(params.digest) ||
-                                    !ctx.setRsaMgf1Md(params.digest)))) {
+      (params.digest != nullptr &&
+       (!ctx.setRsaOaepMd(params.digest) || !ctx.setRsaMgf1Md(mgf1_digest)))) {
     return {};
   }
 
@@ -5617,7 +6675,9 @@ DataPointer CipherImpl(const EVPKeyPointer& key,
   if (!key) return {};
   EVPKeyCtxPointer ctx = key.newCtx();
   if (!ctx || init(ctx.get()) <= 0 || !ctx.setRsaPadding(params.padding) ||
-      (params.digest != nullptr && !ctx.setRsaOaepMd(params.digest))) {
+      (params.digest != nullptr && !ctx.setRsaOaepMd(params.digest)) ||
+      (params.mgf1_digest != nullptr &&
+       !ctx.setRsaMgf1Md(params.mgf1_digest))) {
     return {};
   }
 
@@ -5650,149 +6710,55 @@ DataPointer CipherImpl(const EVPKeyPointer& key,
 }
 }  // namespace
 
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
-namespace {
-int DigestAlgorithmIdentifierToNid(const unsigned char* data, size_t size) {
-  size_t sequence_header;
-  size_t sequence_len;
-  size_t sequence_total;
-  if (!ReadASN1Element(
-          data, size, 0x30, &sequence_header, &sequence_len, &sequence_total)) {
-    return NID_undef;
-  }
-
-  size_t oid_header;
-  size_t oid_len;
-  size_t oid_total;
-  const unsigned char* oid = data + sequence_header;
-  if (!ReadASN1Element(
-          oid, sequence_len, 0x06, &oid_header, &oid_len, &oid_total)) {
-    return NID_undef;
-  }
-
-  const unsigned char* oid_data = oid;
-  DeleteFnPtr<ASN1_OBJECT, ASN1_OBJECT_free> obj(
-      d2i_ASN1_OBJECT(nullptr, &oid_data, oid_total));
-  if (!obj) return NID_undef;
-  return OBJ_obj2nid(obj.get());
-}
-
-bool ReadRsaPssParams(const EVP_PKEY* pkey, Rsa::PssParams* params) {
-  const int der_len = i2d_PUBKEY(pkey, nullptr);
-  if (der_len <= 0) return false;
-
-  auto der = DataPointer::Alloc(der_len);
-  if (!der) return false;
-
-  auto serialized = static_cast<unsigned char*>(der.get());
-  if (i2d_PUBKEY(pkey, &serialized) != der_len) return false;
-
-  size_t outer_header;
-  size_t outer_len;
-  size_t outer_total;
-  const auto* data = static_cast<const unsigned char*>(der.get());
-  if (!ReadASN1Element(
-          data, der.size(), 0x30, &outer_header, &outer_len, &outer_total)) {
-    return false;
-  }
-
-  size_t alg_header;
-  size_t alg_len;
-  size_t alg_total;
-  const unsigned char* alg = data + outer_header;
-  if (!ReadASN1Element(
-          alg, outer_len, 0x30, &alg_header, &alg_len, &alg_total)) {
-    return false;
-  }
-
-  size_t oid_header;
-  size_t oid_len;
-  size_t oid_total;
-  const unsigned char* oid = alg + alg_header;
-  if (!ReadASN1Element(oid, alg_len, 0x06, &oid_header, &oid_len, &oid_total) ||
-      oid_total == alg_len) {
-    return false;
-  }
+Rsa::OtherPrimeInfoPointer::OtherPrimeInfoPointer(BignumPointer&& r,
+                                                  BignumPointer&& d,
+                                                  BignumPointer&& t)
+    : r(r.release()), d(d.release()), t(t.release()) {}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+namespace {
+// Normalizes a provider digest name such as "SHA2-256" to the long name the
+// rest of the key details use ("sha256"). The returned storage has static
+// lifetime, which the string_view fields of PssParams require.
+const char* RsaPssDigestLongName(const char* name) {
+  const EVP_MD* md = EVP_get_digestbyname(name);
+  if (md == nullptr) return nullptr;
+  const int nid = EVP_MD_get_type(md);
+  return nid != NID_undef ? OBJ_nid2ln(nid) : nullptr;
+}
 
-  size_t pss_header;
-  size_t pss_len;
-  size_t pss_total;
-  const unsigned char* pss = oid + oid_total;
-  if (!ReadASN1Element(
-          pss, alg_len - oid_total, 0x30, &pss_header, &pss_len, &pss_total)) {
+bool ReadRsaPssParams(const EVP_PKEY* pkey, Rsa::PssParams* params) {
+  // The RSASSA-PSS-params sequence is exposed as a unit. The salt length is
+  // readable whenever the sequence is present, including when it is empty
+  // because every field carried its default, and unreadable when the algorithm
+  // identifier has no parameters at all. That is the distinction between a
+  // restricted key and an unrestricted one.
+  int salt_length = 0;
+  // TODO(panva): In a semver-major, reject malformed RSA-PSS parameters
+  // at key import instead of omitting asymmetricKeyDetails fields.
+  if (EVP_PKEY_get_int_param(
+          pkey, OSSL_PKEY_PARAM_RSA_PSS_SALTLEN, &salt_length) != 1 ||
+      salt_length < 0) {
     return false;
   }
+  params->salt_length = salt_length;
 
-  const unsigned char* cursor = pss + pss_header;
-  size_t remaining = pss_len;
-  while (remaining > 0) {
-    const unsigned char tag = cursor[0];
-    size_t item_header;
-    size_t item_len;
-    size_t item_total;
-    if (!ReadASN1Element(
-            cursor, remaining, tag, &item_header, &item_len, &item_total)) {
-      return false;
+  // The provider may omit default SHA-1 digest parameters. Keep the initialized
+  // defaults when a digest name is absent or cannot be resolved.
+  char name[80];
+  if (EVP_PKEY_get_utf8_string_param(
+          pkey, OSSL_PKEY_PARAM_RSA_DIGEST, name, sizeof(name), nullptr) == 1) {
+    if (const char* long_name = RsaPssDigestLongName(name)) {
+      params->digest = long_name;
     }
+  }
 
-    const unsigned char* item = cursor + item_header;
-    switch (tag) {
-      case 0xa0: {
-        const int nid = DigestAlgorithmIdentifierToNid(item, item_len);
-        if (nid != NID_undef) params->digest = OBJ_nid2ln(nid);
-        break;
-      }
-      case 0xa1: {
-        size_t mgf_header;
-        size_t mgf_len;
-        size_t mgf_total;
-        if (!ReadASN1Element(
-                item, item_len, 0x30, &mgf_header, &mgf_len, &mgf_total)) {
-          return false;
-        }
-        const unsigned char* mgf = item + mgf_header;
-        size_t mgf_oid_header;
-        size_t mgf_oid_len;
-        size_t mgf_oid_total;
-        if (!ReadASN1Element(mgf,
-                             mgf_len,
-                             0x06,
-                             &mgf_oid_header,
-                             &mgf_oid_len,
-                             &mgf_oid_total) ||
-            mgf_oid_total == mgf_len) {
-          return false;
-        }
-        const int nid = DigestAlgorithmIdentifierToNid(mgf + mgf_oid_total,
-                                                       mgf_len - mgf_oid_total);
-        if (nid != NID_undef) params->mgf1_digest = OBJ_nid2ln(nid);
-        break;
-      }
-      case 0xa2: {
-        size_t int_header;
-        size_t int_len;
-        size_t int_total;
-        if (!ReadASN1Element(
-                item, item_len, 0x02, &int_header, &int_len, &int_total)) {
-          return false;
-        }
-        // TODO(panva): In a semver-major, reject malformed RSA-PSS parameters
-        // at key import instead of omitting asymmetricKeyDetails fields.
-        if (int_len == 0 || int_len > sizeof(uint64_t) ||
-            (item[int_header] & 0x80) != 0) {
-          return false;
-        }
-        uint64_t salt_length = 0;
-        for (size_t n = 0; n < int_len; n++) {
-          salt_length = (salt_length << 8) | item[int_header + n];
-        }
-        params->salt_length = static_cast<int64_t>(salt_length);
-        break;
-      }
+  if (EVP_PKEY_get_utf8_string_param(
+          pkey, OSSL_PKEY_PARAM_RSA_MGF1_DIGEST, name, sizeof(name), nullptr) ==
+      1) {
+    if (const char* long_name = RsaPssDigestLongName(name)) {
+      params->mgf1_digest = long_name;
     }
-
-    cursor += item_total;
-    remaining -= item_total;
   }
 
   return true;
@@ -5861,14 +6827,22 @@ ASN1StringPointer EncodeRsaPssParams(const Rsa::PssParams& params) {
 
 Rsa::Rsa() : rsa_(false) {}
 
-Rsa::Rsa(const EVP_PKEY* pkey) : Rsa() {
-  const int type = EVPKeyPointer::id(pkey);
-  if (type != EVP_PKEY_RSA && type != EVP_PKEY_RSA_PSS) return;
-  rsa_pss_ = type == EVP_PKEY_RSA_PSS;
+Rsa::Rsa(const EVP_PKEY* pkey, Selection selection) : Rsa() {
+  rsa_pss_ = EVPKeyPointer::isA(pkey, KeyAlgorithm::RSA_PSS);
+  if (!EVPKeyPointer::isA(pkey, KeyAlgorithm::RSA) && !rsa_pss_) return;
   if (!GetPKeyBnParam(pkey, OSSL_PKEY_PARAM_RSA_N, &n_) ||
       !GetPKeyBnParam(pkey, OSSL_PKEY_PARAM_RSA_E, &e_)) {
     return;
   }
+  if (rsa_pss_) {
+    MarkPopErrorOnReturn pop_errors;
+    PssParams params;
+    if (ReadRsaPssParams(pkey, &params)) pss_params_ = params;
+  }
+  if (selection == Selection::Public) {
+    rsa_ = true;
+    return;
+  }
   if (!GetOptionalPKeyBnParam(pkey, OSSL_PKEY_PARAM_RSA_D, &d_) ||
       !GetOptionalPKeyBnParam(pkey, OSSL_PKEY_PARAM_RSA_FACTOR1, &p_) ||
       !GetOptionalPKeyBnParam(pkey, OSSL_PKEY_PARAM_RSA_FACTOR2, &q_) ||
@@ -5878,10 +6852,17 @@ Rsa::Rsa(const EVP_PKEY* pkey) : Rsa() {
     return;
   }
 
-  if (type == EVP_PKEY_RSA_PSS) {
-    MarkPopErrorOnReturn pop_errors;
-    PssParams params;
-    if (ReadRsaPssParams(pkey, &params)) pss_params_ = params;
+  for (const auto& names : kRsaOtherPrimeParamNames) {
+    OtherPrimeInfoPointer info;
+    if (!GetOptionalPKeyBnParam(pkey, names.factor, &info.r) ||
+        !GetOptionalPKeyBnParam(pkey, names.exponent, &info.d) ||
+        !GetOptionalPKeyBnParam(pkey, names.coefficient, &info.t)) {
+      return;
+    }
+
+    if (!info.r && !info.d && !info.t) break;
+    if (!info.r || !info.d || !info.t) return;
+    other_prime_infos_.push_back(std::move(info));
   }
 
   rsa_ = true;
@@ -5891,6 +6872,14 @@ Rsa::Rsa() : rsa_(nullptr) {}
 Rsa::Rsa(OSSL3_CONST RSA* ptr) : rsa_(ptr) {}
 #endif
 
+Rsa Rsa::PublicOnly(const EVPKeyPointer& key) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  return Rsa(key.get(), Selection::Public);
+#else
+  return key;
+#endif
+}
+
 const Rsa::PublicKey Rsa::getPublicKey() const {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (!rsa_) return {};
@@ -5916,6 +6905,55 @@ const Rsa::PrivateKey Rsa::getPrivateKey() const {
 #endif
 }
 
+const Rsa::OtherPrimeInfos Rsa::getOtherPrimeInfos() const {
+  OtherPrimeInfos infos;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  infos.reserve(other_prime_infos_.size());
+  for (const auto& info : other_prime_infos_) {
+    infos.push_back({info.r.get(), info.d.get(), info.t.get()});
+  }
+#elif NCRYPTO_USE_LEGACY_OPENSSL
+  if (rsa_ == nullptr) return infos;
+  const int count = RSA_get_multi_prime_extra_count(rsa_);
+  if (count <= 0) return infos;
+
+  std::vector<const BIGNUM*> factors(count);
+  std::vector<const BIGNUM*> exponents(count);
+  std::vector<const BIGNUM*> coefficients(count);
+  if (RSA_get0_multi_prime_factors(rsa_, factors.data()) != 1 ||
+      RSA_get0_multi_prime_crt_params(
+          rsa_, exponents.data(), coefficients.data()) != 1) {
+    return {};
+  }
+
+  infos.reserve(count);
+  for (int i = 0; i < count; i++) {
+    infos.push_back({factors[i], exponents[i], coefficients[i]});
+  }
+#endif
+  return infos;
+}
+
+bool Rsa::checkPrimeProduct() const {
+  const auto pub = getPublicKey();
+  const auto priv = getPrivateKey();
+  if (pub.n == nullptr || priv.p == nullptr || priv.q == nullptr) return false;
+  auto product = BignumPointer::New();
+  BignumCtxPointer ctx(BN_CTX_new());
+  if (!product || !ctx ||
+      BN_mul(product.get(), priv.p, priv.q, ctx.get()) != 1) {
+    return false;
+  }
+  for (const auto& info : getOtherPrimeInfos()) {
+    auto next = BignumPointer::New();
+    if (!next || BN_mul(next.get(), product.get(), info.r, ctx.get()) != 1) {
+      return false;
+    }
+    product = std::move(next);
+  }
+  return BN_cmp(product.get(), pub.n) == 0;
+}
+
 const std::optional<Rsa::PssParams> Rsa::getPssParams() const {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   return pss_params_;
@@ -6017,15 +7055,20 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
                         BignumPointer&& p,
                         BignumPointer&& dp,
                         BignumPointer&& dq,
-                        BignumPointer&& qi) {
+                        BignumPointer&& qi,
+                        OtherPrimeInfoPointers&& other_prime_infos) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (!d || !q || !p || !dp || !dq || !qi) return false;
+  for (const auto& info : other_prime_infos) {
+    if (!info.r || !info.d || !info.t) return false;
+  }
   d_.reset(d.release());
   q_.reset(q.release());
   p_.reset(p.release());
   dp_.reset(dp.release());
   dq_.reset(dq.release());
   qi_.reset(qi.release());
+  other_prime_infos_ = std::move(other_prime_infos);
   rsa_ = n_ != nullptr && e_ != nullptr;
   return rsa_;
 #else
@@ -6047,6 +7090,37 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
   dp.release();
   dq.release();
   qi.release();
+
+#if NCRYPTO_USE_LEGACY_OPENSSL
+  if (!other_prime_infos.empty()) {
+    std::vector<BIGNUM*> factors;
+    std::vector<BIGNUM*> exponents;
+    std::vector<BIGNUM*> coefficients;
+    factors.reserve(other_prime_infos.size());
+    exponents.reserve(other_prime_infos.size());
+    coefficients.reserve(other_prime_infos.size());
+    for (const auto& info : other_prime_infos) {
+      if (!info.r || !info.d || !info.t) return false;
+      factors.push_back(info.r.get());
+      exponents.push_back(info.d.get());
+      coefficients.push_back(info.t.get());
+    }
+    if (RSA_set0_multi_prime_params(const_cast<RSA*>(rsa_),
+                                    factors.data(),
+                                    exponents.data(),
+                                    coefficients.data(),
+                                    static_cast<int>(factors.size())) != 1) {
+      return false;
+    }
+    for (auto& info : other_prime_infos) {
+      info.r.release();
+      info.d.release();
+      info.t.release();
+    }
+  }
+#else
+  if (!other_prime_infos.empty()) return false;
+#endif
   return true;
 #endif
 }
@@ -6100,7 +7174,7 @@ struct CipherCallbackContext {
   void operator()(const char* name) { cb(name); }
 };
 
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
 template <class TypeName,
           TypeName* fetch_type(OSSL_LIB_CTX*, const char*, const char*),
           void free_type(TypeName*),
@@ -6124,13 +7198,49 @@ void array_push_back(const TypeName* evp_ref,
   // instance if the algorithm is supported by the public OpenSSL APIs (some
   // algorithms are used internally by OpenSSL and are also passed to this
   // callback).
-  TypeName* fetched = fetch_type(nullptr, real_name, nullptr);
-  if (fetched == nullptr) return;
+  DeleteFnPtr<TypeName, free_type> fetched(
+      fetch_type(nullptr, real_name, nullptr));
+  if (!IsSupportedFetchedCipher(fetched.get())) return;
 
-  free_type(fetched);
   auto& cb = *(static_cast<CipherCallbackContext*>(arg));
   cb(from);
 }
+
+void array_push_back_provider_name(const char* name, void* arg) {
+  if (name == nullptr) return;
+
+  const std::string_view name_view(name);
+  const bool is_dotted_decimal =
+      name_view.find('.') != std::string_view::npos &&
+      std::all_of(name_view.begin(), name_view.end(), [](unsigned char c) {
+        return (c >= '0' && c <= '9') || c == '.';
+      });
+  if (is_dotted_decimal) return;
+
+  std::string normalized_name(name_view);
+  std::transform(normalized_name.begin(),
+                 normalized_name.end(),
+                 normalized_name.begin(),
+                 [](unsigned char c) {
+                   if (c >= 'A' && c <= 'Z') {
+                     return static_cast<char>(c + ('a' - 'A'));
+                   }
+                   return static_cast<char>(c);
+                 });
+  auto& cb = *(static_cast<CipherCallbackContext*>(arg));
+  cb(normalized_name.c_str());
+}
+
+void array_push_back_provider(EVP_CIPHER* cipher, void* arg) {
+  const char* name = EVP_CIPHER_get0_name(cipher);
+  if (name == nullptr) return;
+
+  DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
+      EVP_CIPHER_fetch(nullptr, name, nullptr));
+  if (!IsSupportedFetchedCipher(fetched.get())) return;
+
+  EVP_CIPHER_names_do_all(fetched.get(), array_push_back_provider_name, arg);
+}
 #else
 template <class TypeName>
 void array_push_back(const TypeName* evp_ref,
@@ -6156,7 +7266,7 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
   }
 #else
   EVP_CIPHER_do_all_sorted(
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
       array_push_back<EVP_CIPHER,
                       EVP_CIPHER_fetch,
                       EVP_CIPHER_free,
@@ -6166,6 +7276,9 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
       array_push_back<EVP_CIPHER>,
 #endif
       &context);
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  EVP_CIPHER_do_all_provided(nullptr, array_push_back_provider, &context);
+#endif
 #endif
 }
 
@@ -6175,7 +7288,7 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
 Ec::Ec() : ec_(nullptr), pub_(nullptr) {}
 
 Ec::Ec(const EVP_PKEY* pkey) : Ec() {
-  if (EVPKeyPointer::id(pkey) != EVP_PKEY_EC) return;
+  if (!EVPKeyPointer::isA(pkey, KeyAlgorithm::EC)) return;
   char group_name[80];
   size_t group_name_len = 0;
   if (EVP_PKEY_get_utf8_string_param(pkey,
@@ -6270,6 +7383,182 @@ int Ec::getCurve() const {
   return EC_GROUP_get_curve_name(getGroup());
 }
 
+DataPointer Ec::TryExportPublic(const EVPKeyPointer& key,
+                                point_conversion_form_t form) {
+  if (!key || form != POINT_CONVERSION_UNCOMPRESSED) return {};
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  {
+    MarkPopErrorOnReturn pop_errors;
+    size_t length = 0;
+    if (EVP_PKEY_get_octet_string_param(
+            key.get(), OSSL_PKEY_PARAM_PUB_KEY, nullptr, 0, &length) == 1) {
+      auto bytes = DataPointer::Alloc(length);
+      if (bytes && length != 0 &&
+          EVP_PKEY_get_octet_string_param(key.get(),
+                                          OSSL_PKEY_PARAM_PUB_KEY,
+                                          bytes.get<unsigned char>(),
+                                          length,
+                                          &length) == 1 &&
+          (bytes.get<unsigned char>()[0] & ~1) == form) {
+        return bytes.resize(length);
+      }
+    }
+  }
+#endif
+  return {};
+}
+
+DataPointer Ec::ExportPrivate(const EVPKeyPointer& key) {
+  if (!key) return {};
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  {
+    MarkPopErrorOnReturn pop_errors;
+    BignumPointer priv;
+    BignumPointer order;
+    if (GetPKeyBnParam(key.get(), OSSL_PKEY_PARAM_PRIV_KEY, &priv) &&
+        GetPKeyBnParam(key.get(), OSSL_PKEY_PARAM_EC_ORDER, &order)) {
+      return priv.encodePadded(order.byteLength());
+    }
+  }
+#endif
+  ECKeyPointer ec(key);
+  if (!ec || ec.getPrivateKey() == nullptr) return {};
+  auto order = BignumPointer::New();
+  if (!order || !EC_GROUP_get_order(ec.getGroup(), order.get(), nullptr))
+    return {};
+  return BignumPointer::EncodePadded(ec.getPrivateKey(), order.byteLength());
+}
+
+bool Ec::GetKeyComponents(const EVPKeyPointer& key,
+                          BignumPointer* x,
+                          BignumPointer* y,
+                          BignumPointer* priv,
+                          int* degree) {
+  if (!key) return false;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const int nid = GetCurveId(key);
+  switch (nid) {
+    case NID_X9_62_prime256v1:
+    case NID_secp256k1:
+      *degree = 256;
+      break;
+    case NID_secp384r1:
+      *degree = 384;
+      break;
+    case NID_secp521r1:
+      *degree = 521;
+      break;
+    default:
+      *degree = 0;
+  }
+  if (*degree != 0) {
+    MarkPopErrorOnReturn pop_errors;
+    unsigned char x_bytes[66]{};
+    unsigned char y_bytes[66]{};
+    const size_t width = (*degree + 7) / 8;
+    OSSL_PARAM params[] = {
+        OSSL_PARAM_construct_BN(OSSL_PKEY_PARAM_EC_PUB_X, x_bytes, width),
+        OSSL_PARAM_construct_BN(OSSL_PKEY_PARAM_EC_PUB_Y, y_bytes, width),
+        OSSL_PARAM_construct_end(),
+    };
+    if (EVP_PKEY_get_params(key.get(), params) == 1 &&
+        OSSL_PARAM_modified(&params[0]) && OSSL_PARAM_modified(&params[1])) {
+      x->reset(BN_native2bn(x_bytes, width, nullptr));
+      y->reset(BN_native2bn(y_bytes, width, nullptr));
+      return *x && *y &&
+             (priv == nullptr ||
+              GetPKeyBnParam(key.get(), OSSL_PKEY_PARAM_PRIV_KEY, priv));
+    }
+  }
+#endif
+  ECKeyPointer ec(key);
+  if (!ec || ec.getPublicKey() == nullptr) return false;
+  *degree = EC_GROUP_get_degree(ec.getGroup());
+  x->reset(BN_new());
+  y->reset(BN_new());
+  if (!*x || !*y ||
+      EC_POINT_get_affine_coordinates(
+          ec.getGroup(), ec.getPublicKey(), x->get(), y->get(), nullptr) != 1) {
+    return false;
+  }
+  if (priv != nullptr) {
+    if (ec.getPrivateKey() == nullptr) return false;
+    priv->reset(BN_dup(ec.getPrivateKey()));
+    if (!*priv) return false;
+  }
+  return true;
+}
+
+int Ec::GetCurveId(const EVPKeyPointer& key) {
+  if (!key) return NID_undef;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  char name[80];
+  size_t length = 0;
+  if (EVP_PKEY_get_utf8_string_param(
+          key.get(), OSSL_PKEY_PARAM_GROUP_NAME, name, sizeof(name), &length) !=
+      1) {
+    return NID_undef;
+  }
+  return GetCurveIdFromName(name);
+#else
+  const EC_KEY* ec = key;
+  if (ec == nullptr) return NID_undef;
+  const EC_GROUP* group = EC_KEY_get0_group(ec);
+  return group == nullptr ? NID_undef : EC_GROUP_get_curve_name(group);
+#endif
+}
+
+std::optional<std::string> Ec::GetCurveName(const EVPKeyPointer& key) {
+  if (!key) return std::nullopt;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  size_t length = 0;
+  if (EVP_PKEY_get_utf8_string_param(
+          key.get(), OSSL_PKEY_PARAM_GROUP_NAME, nullptr, 0, &length) != 1) {
+    return std::nullopt;
+  }
+  std::string name(length, '\0');
+  if (EVP_PKEY_get_utf8_string_param(key.get(),
+                                     OSSL_PKEY_PARAM_GROUP_NAME,
+                                     name.data(),
+                                     name.size() + 1,
+                                     &length) != 1) {
+    return std::nullopt;
+  }
+  name.resize(length);
+  // Preserve the public short names for the curves OpenSSL already knows.
+  const int nid = GetCurveIdFromName(name.c_str());
+  return nid == NID_undef ? name : std::string(OBJ_nid2sn(nid));
+#else
+  const int nid = GetCurveId(key);
+  if (nid == NID_undef) return std::nullopt;
+  return std::string(OBJ_nid2sn(nid));
+#endif
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+namespace {
+bool IsAvailableEcGroup(const char* name) {
+  MarkPopErrorOnReturn mark;
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::EC);
+  return ctx.initForParamgen() &&
+         ctx.setEcParameters(name, OPENSSL_EC_NAMED_CURVE) && ctx.paramgen();
+}
+}  // namespace
+#endif
+
+bool Ec::CheckCurveName(const char* name) {
+  if (name == nullptr) return false;
+  if (GetCurveIdFromName(name) != NID_undef) return true;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // Keep invalid names a synchronous argument error. Generation contexts can
+  // defer rejecting a group until parameter generation. Use the same parameter
+  // generation path as key generation without requiring parameter import.
+  return IsAvailableEcGroup(name);
+#else
+  return false;
+#endif
+}
+
 int Ec::GetCurveIdFromName(const char* name) {
   int nid = EC_curve_nist2nid(name);
   if (nid == NID_undef) {
@@ -6278,14 +7567,26 @@ int Ec::GetCurveIdFromName(const char* name) {
   return nid;
 }
 
+const KeyAlgorithm* Ec::GetNamedKeyAlgorithm(const char* name) {
+  // Preserve the aliases accepted by the historical namedCurve option.
+  const int nid = GetCurveIdFromName(name);
+  if (nid == NID_undef) return nullptr;
+  const auto* algorithm = KeyAlgorithm::FromName(OBJ_nid2sn(nid));
+  return algorithm != nullptr && algorithm->isOkp() ? algorithm : nullptr;
+}
+
 bool Ec::GetCurves(Ec::GetCurveCallback callback) {
   const size_t count = EC_get_builtin_curves(nullptr, 0);
   std::vector<EC_builtin_curve> curves(count);
   if (EC_get_builtin_curves(curves.data(), count) != count) {
     return false;
   }
-  for (auto curve : curves) {
-    if (!callback(OBJ_nid2sn(curve.nid))) return false;
+  for (const auto& curve : curves) {
+    const char* name = OBJ_nid2sn(curve.nid);
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (!IsAvailableEcGroup(name)) continue;
+#endif
+    if (!callback(name)) return false;
   }
   return true;
 }
@@ -6316,11 +7617,19 @@ EVP_MD_CTX* EVPMDCtxPointer::release() {
   return ctx_.release();
 }
 
-bool EVPMDCtxPointer::digestInit(const Digest& digest) {
+bool EVPMDCtxPointer::digestInit(const EVP_MD* digest) {
   if (!ctx_) return false;
   return EVP_DigestInit_ex(ctx_.get(), digest, nullptr) > 0;
 }
 
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+bool EVPMDCtxPointer::digestInit(const EVP_MD* digest,
+                                 const OSSL_PARAM* params) {
+  if (!ctx_) return false;
+  return EVP_DigestInit_ex2(ctx_.get(), digest, params) > 0;
+}
+#endif
+
 bool EVPMDCtxPointer::digestUpdate(const Buffer<const void>& in) {
   if (!ctx_) return false;
   return EVP_DigestUpdate(ctx_.get(), in.data, in.len) > 0;
@@ -6413,18 +7722,17 @@ std::optional<EVP_PKEY_CTX*> EVPMDCtxPointer::signInitWithContext(
     return std::nullopt;
   }
   return ctx;
-#elif defined(OSSL_SIGNATURE_PARAM_CONTEXT_STRING)
+#elif NCRYPTO_USE_OPENSSL3_PROVIDER
   EVP_PKEY_CTX* ctx = nullptr;
 
-#ifdef OSSL_SIGNATURE_PARAM_INSTANCE
   // Ed25519 requires the INSTANCE param to switch into Ed25519ctx mode.
   // Without it, OpenSSL silently ignores the context string.
-  if (key.id() == EVP_PKEY_ED25519) {
+  if (key.isA(KeyAlgorithm::ED25519)) {
     const OSSL_PARAM params[] = {
         OSSL_PARAM_construct_utf8_string(
-            OSSL_SIGNATURE_PARAM_INSTANCE, const_cast<char*>("Ed25519ctx"), 0),
+            kSignatureInstance, const_cast<char*>("Ed25519ctx"), 0),
         OSSL_PARAM_construct_octet_string(
-            OSSL_SIGNATURE_PARAM_CONTEXT_STRING,
+            kSignatureContextString,
             const_cast<unsigned char*>(context_string.data),
             context_string.len),
         OSSL_PARAM_END};
@@ -6435,11 +7743,10 @@ std::optional<EVP_PKEY_CTX*> EVPMDCtxPointer::signInitWithContext(
     }
     return ctx;
   }
-#endif  // OSSL_SIGNATURE_PARAM_INSTANCE
 
   const OSSL_PARAM params[] = {
       OSSL_PARAM_construct_octet_string(
-          OSSL_SIGNATURE_PARAM_CONTEXT_STRING,
+          kSignatureContextString,
           const_cast<unsigned char*>(context_string.data),
           context_string.len),
       OSSL_PARAM_END};
@@ -6468,18 +7775,17 @@ std::optional<EVP_PKEY_CTX*> EVPMDCtxPointer::verifyInitWithContext(
     return std::nullopt;
   }
   return ctx;
-#elif defined(OSSL_SIGNATURE_PARAM_CONTEXT_STRING)
+#elif NCRYPTO_USE_OPENSSL3_PROVIDER
   EVP_PKEY_CTX* ctx = nullptr;
 
-#ifdef OSSL_SIGNATURE_PARAM_INSTANCE
   // Ed25519 requires the INSTANCE param to switch into Ed25519ctx mode.
   // Without it, OpenSSL silently ignores the context string.
-  if (key.id() == EVP_PKEY_ED25519) {
+  if (key.isA(KeyAlgorithm::ED25519)) {
     const OSSL_PARAM params[] = {
         OSSL_PARAM_construct_utf8_string(
-            OSSL_SIGNATURE_PARAM_INSTANCE, const_cast<char*>("Ed25519ctx"), 0),
+            kSignatureInstance, const_cast<char*>("Ed25519ctx"), 0),
         OSSL_PARAM_construct_octet_string(
-            OSSL_SIGNATURE_PARAM_CONTEXT_STRING,
+            kSignatureContextString,
             const_cast<unsigned char*>(context_string.data),
             context_string.len),
         OSSL_PARAM_END};
@@ -6490,11 +7796,10 @@ std::optional<EVP_PKEY_CTX*> EVPMDCtxPointer::verifyInitWithContext(
     }
     return ctx;
   }
-#endif  // OSSL_SIGNATURE_PARAM_INSTANCE
 
   const OSSL_PARAM params[] = {
       OSSL_PARAM_construct_octet_string(
-          OSSL_SIGNATURE_PARAM_CONTEXT_STRING,
+          kSignatureContextString,
           const_cast<unsigned char*>(context_string.data),
           context_string.len),
       OSSL_PARAM_END};
@@ -6669,6 +7974,79 @@ EVPMacPointer EVPMacPointer::Fetch(const char* algorithm) {
   return EVPMacPointer(EVP_MAC_fetch(nullptr, algorithm, nullptr));
 }
 
+MacKind MacCache::GetKind(EVP_MAC* mac) {
+  if (EVP_MAC_is_a(mac, OSSL_MAC_NAME_HMAC)) return MacKind::kHmac;
+  if (EVP_MAC_is_a(mac, OSSL_MAC_NAME_CMAC)) return MacKind::kCmac;
+  if (EVP_MAC_is_a(mac, OSSL_MAC_NAME_GMAC)) return MacKind::kGmac;
+  return MacKind::kOther;
+}
+
+MacCache::Result MacCache::lookup(const char* name, uint64_t generation) const {
+  if (generation_ != generation || name == nullptr) return {};
+  const auto it = aliases_.find(name);
+  if (it == aliases_.end()) return {};
+  return lookup(it->second, generation);
+}
+
+MacCache::Result MacCache::insert(const char* name,
+                                  EVPMacPointer&& mac,
+                                  uint64_t generation) {
+  if (generation_ != generation || generation != getFipsStateGeneration() ||
+      name == nullptr || mac == nullptr) {
+    return {};
+  }
+
+  const char* canonical_name = EVP_MAC_get0_name(mac.get());
+  const OSSL_PROVIDER* provider = EVP_MAC_get0_provider(mac.get());
+  if (canonical_name == nullptr || provider == nullptr) return {};
+
+  for (size_t index = 0; index < macs_.size(); index++) {
+    EVP_MAC* cached = macs_[index].mac.get();
+    if (cached == nullptr) continue;
+    const char* cached_name = EVP_MAC_get0_name(cached);
+    if (EVP_MAC_get0_provider(cached) == provider && cached_name != nullptr &&
+        CaseInsensitiveNameEqual()(cached_name, canonical_name)) {
+      if (generation != getFipsStateGeneration()) return {};
+      const int32_t id = static_cast<int32_t>(first_id_ + index);
+      aliases_.insert_or_assign(name, id);
+      return {cached, id, macs_[index].kind};
+    }
+  }
+
+  if (next_id_ == UINT32_MAX) return {};
+
+  std::vector<std::string> aliases;
+  {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+    if (EVP_MAC_names_do_all(mac.get(), PushAlgorithmAlias, &aliases) != 1) {
+      return {};
+    }
+  }
+  if (generation != getFipsStateGeneration()) return {};
+
+  const MacKind kind = GetKind(mac.get());
+  macs_.push_back({std::move(mac), kind});
+  const int32_t id = static_cast<int32_t>(next_id_++);
+  const size_t index = macs_.size() - 1;
+
+  for (const std::string& alias : aliases) aliases_.emplace(alias, id);
+  aliases_.insert_or_assign(name, id);
+
+  return {macs_[index].mac.get(), id, kind};
+}
+
+void MacCache::reset(uint64_t generation) {
+  if (generation_ == generation) return;
+  aliases_.clear();
+  macs_.clear();
+  first_id_ = next_id_;
+  generation_ = generation;
+}
+
+const MacCache::AliasMap& MacCache::aliases() const {
+  return aliases_;
+}
+
 EVPMacCtxPointer::EVPMacCtxPointer(EVP_MAC_CTX* ctx) : ctx_(ctx) {}
 
 EVPMacCtxPointer::EVPMacCtxPointer(EVPMacCtxPointer&& other) noexcept
@@ -6696,22 +8074,42 @@ EVP_MAC_CTX* EVPMacCtxPointer::release() {
 bool EVPMacCtxPointer::init(const Buffer<const void>& key,
                             const OSSL_PARAM* params) {
   if (!ctx_) return false;
-  return EVP_MAC_init(ctx_.get(),
-                      static_cast<const unsigned char*>(key.data),
-                      key.len,
-                      params) == 1;
+
+  static constexpr unsigned char kEmptyKey = 0;
+  const unsigned char* key_data = static_cast<const unsigned char*>(key.data);
+  if (key_data == nullptr) {
+    if (key.len != 0) return false;
+    key_data = &kEmptyKey;
+  }
+
+  return EVP_MAC_init(ctx_.get(), key_data, key.len, params) == 1;
 }
 
 bool EVPMacCtxPointer::update(const Buffer<const void>& data) {
   if (!ctx_) return false;
+  if (data.len == 0) return true;
+  if (data.data == nullptr) return false;
   return EVP_MAC_update(ctx_.get(),
                         static_cast<const unsigned char*>(data.data),
                         data.len) == 1;
 }
 
+size_t EVPMacCtxPointer::getSize() const {
+  return ctx_ ? EVP_MAC_CTX_get_mac_size(ctx_.get()) : 0;
+}
+
+const OSSL_PARAM* EVPMacCtxPointer::getSettableParams() const {
+  return ctx_ ? EVP_MAC_CTX_settable_params(ctx_.get()) : nullptr;
+}
+
 DataPointer EVPMacCtxPointer::final(size_t length) {
   if (!ctx_) return {};
-  auto buf = DataPointer::Alloc(length);
+
+  // DataPointer uses a null allocation to represent failure. Retain a
+  // one-byte allocation for a successful zero-length result while passing the
+  // requested zero capacity to OpenSSL. A non-null output pointer is required
+  // to actually finalize; nullptr only queries the output length.
+  auto buf = DataPointer::Alloc(length == 0 ? 1 : length);
   if (!buf) return {};
 
   size_t result_len = length;
@@ -6721,8 +8119,9 @@ DataPointer EVPMacCtxPointer::final(size_t length) {
                     length) != 1) {
     return {};
   }
+  if (result_len > length) return {};
 
-  return buf;
+  return buf.resize(result_len);
 }
 
 EVPMacCtxPointer EVPMacCtxPointer::New(EVP_MAC* mac) {
@@ -6846,7 +8245,10 @@ DataPointer xofHashDigest(const Buffer<const unsigned char>& buf,
   if (ctx.digestInit(md) != 1) {
     return {};
   }
-  if (ctx.digestUpdate(reinterpret_cast<const Buffer<const void>&>(buf)) != 1) {
+  if (ctx.digestUpdate(Buffer<const void>{
+          .data = buf.data,
+          .len = buf.len,
+      }) != 1) {
     return {};
   }
   return ctx.digestFinal(output_length);
@@ -6921,7 +8323,7 @@ std::pair<std::string, std::string> X509Name::Iterator::operator*() const {
 Dsa::Dsa() : dsa_(false) {}
 
 Dsa::Dsa(const EVP_PKEY* pkey) : Dsa() {
-  if (EVPKeyPointer::id(pkey) != EVP_PKEY_DSA) return;
+  if (!EVPKeyPointer::isA(pkey, KeyAlgorithm::DSA)) return;
   if (!GetPKeyBnParam(pkey, OSSL_PKEY_PARAM_FFC_P, &p_) ||
       !GetPKeyBnParam(pkey, OSSL_PKEY_PARAM_FFC_Q, &q_)) {
     return;
@@ -6982,50 +8384,110 @@ size_t Digest::size() const {
   return EVP_MD_size(md_);
 }
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+Digest::Digest(DeleteFnPtr<EVP_MD, EVP_MD_free> md)
+    : md_(md.get()), fetched_md_(std::move(md)) {}
+#endif
+
+Digest::Digest(const Digest& other) : md_(other.md_) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (other.fetched_md_ != nullptr) {
+    if (EVP_MD_up_ref(other.fetched_md_.get()) == 1) {
+      fetched_md_.reset(other.fetched_md_.get());
+    } else {
+      md_ = nullptr;
+    }
+  }
+#endif
+}
+
+Digest& Digest::operator=(const Digest& other) {
+  if (this == &other) return *this;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  if (other.fetched_md_ != nullptr) {
+    if (EVP_MD_up_ref(other.fetched_md_.get()) == 1) {
+      fetched_md_.reset(other.fetched_md_.get());
+    } else {
+      fetched_md_.reset();
+      md_ = nullptr;
+      return *this;
+    }
+  } else {
+    fetched_md_.reset();
+  }
+#endif
+  md_ = other.md_;
+  return *this;
+}
+
 const Digest Digest::MD5 = Digest(EVP_md5());
 const Digest Digest::SHA1 = Digest(EVP_sha1());
 const Digest Digest::SHA256 = Digest(EVP_sha256());
 const Digest Digest::SHA384 = Digest(EVP_sha384());
 const Digest Digest::SHA512 = Digest(EVP_sha512());
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+namespace {
+bool IsSupportedDigest(const EVP_MD* md) {
+  if (md == nullptr || EVP_MD_is_a(md, "NULL")) return false;
+
+  // OpenSSL currently crashes when ML-DSA-MU finalizes an empty input. Keep it
+  // unavailable until the provider implementation is fixed.
+  // https://github.com/openssl/openssl/issues/32445
+  if (EVP_MD_is_a(md, "ML-DSA-MU")) return false;
+
+  return true;
+}
+}  // namespace
+#endif
+
 const Digest Digest::FromName(const char* name) {
-  return ncrypto::getDigestByName(name);
+  const EVP_MD* md = ncrypto::getDigestByName(name);
+  if (md != nullptr) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (md == EVP_md_null()) return Digest();
+#endif
+    return Digest(md);
+  }
+
+  return Fetch(name);
+}
+
+const Digest Digest::Fetch(const char* name) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  MarkPopErrorOnReturn mark_pop_error_on_return;
+  DeleteFnPtr<EVP_MD, EVP_MD_free> fetched(
+      EVP_MD_fetch(nullptr, name, nullptr));
+  if (IsSupportedDigest(fetched.get())) {
+    return Digest(std::move(fetched));
+  }
+#endif
+
+  return Digest();
 }
 
 // ============================================================================
 // KEM Implementation
 #if OPENSSL_WITH_KEM
-#if OPENSSL_WITH_KEM_OPERATION_PARAM
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
 bool KEM::SetOperationParameter(EVP_PKEY_CTX* ctx, const EVPKeyPointer& key) {
-  const char* operation = nullptr;
-
-  switch (EVP_PKEY_id(key.get())) {
-    case EVP_PKEY_RSA:
-      operation = OSSL_KEM_PARAM_OPERATION_RSASVE;
-      break;
-#if OPENSSL_WITH_OPENSSL_DHKEM
-    case EVP_PKEY_EC:
-    case EVP_PKEY_X25519:
-    case EVP_PKEY_X448:
-      operation = OSSL_KEM_PARAM_OPERATION_DHKEM;
-      break;
-#endif
-    default:
-      unreachable();
-  }
-
-  if (operation != nullptr) {
-    OSSL_PARAM params[] = {
-        OSSL_PARAM_utf8_string(
-            OSSL_KEM_PARAM_OPERATION, const_cast<char*>(operation), 0),
-        OSSL_PARAM_END};
+  const OSSL_PARAM* settable = EVP_PKEY_CTX_settable_params(ctx);
+  if (settable == nullptr ||
+      OSSL_PARAM_locate_const(settable, "operation") == nullptr)
+    return true;
 
-    if (EVP_PKEY_CTX_set_params(ctx, params) <= 0) {
-      return false;
-    }
+  const char* operation = nullptr;
+  if (key.isA(KeyAlgorithm::RSA)) {
+    operation = "RSASVE";
+  } else if (key.isA(KeyAlgorithm::EC) || key.isA(KeyAlgorithm::X25519) ||
+             key.isA(KeyAlgorithm::X448)) {
+    operation = "DHKEM";
   }
-
-  return true;
+  if (operation == nullptr) return true;
+  OSSL_PARAM params[] = {
+      OSSL_PARAM_utf8_string("operation", const_cast<char*>(operation), 0),
+      OSSL_PARAM_END};
+  return EVP_PKEY_CTX_set_params(ctx, params) > 0;
 }
 #endif
 
@@ -7040,7 +8502,7 @@ std::optional<KEM::EncapsulateResult> KEM::Encapsulate(
     return std::nullopt;
   }
 
-#if OPENSSL_WITH_KEM_OPERATION_PARAM
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (!SetOperationParameter(ctx.get(), public_key)) {
     return std::nullopt;
   }
@@ -7081,7 +8543,7 @@ DataPointer KEM::Decapsulate(const EVPKeyPointer& private_key,
     return {};
   }
 
-#if OPENSSL_WITH_KEM_OPERATION_PARAM
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (!SetOperationParameter(ctx.get(), private_key)) {
     return {};
   }
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index f0e1e7451e4f..13444e226b63 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -12,13 +12,17 @@
 #include <openssl/rsa.h>
 #include <openssl/ssl.h>
 #include <openssl/x509.h>
+#include <array>
 #include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <list>
 #include <memory>
 #include <optional>
 #include <string>
 #include <string_view>
+#include <unordered_map>
+#include <vector>
 #if defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT &&                 \
     !defined(OPENSSL_NO_ENGINE)
 #include <openssl/engine.h>
@@ -105,51 +109,16 @@
 #define OPENSSL_WITH_EVP_MAC 0
 #endif
 
-#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_PREREQ(3, 2)
-#define OPENSSL_WITH_SIGNATURE_CONTEXT_STRING 1
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
+#define OPENSSL_WITH_AES_SIV 1
 #else
-#define OPENSSL_WITH_SIGNATURE_CONTEXT_STRING 0
+#define OPENSSL_WITH_AES_SIV 0
 #endif
 
 #if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
-#define OPENSSL_WITH_OPENSSL_DHKEM 1
-#else
-#define OPENSSL_WITH_OPENSSL_DHKEM 0
-#endif
-
-#if OPENSSL_WITH_KEM && !defined(OPENSSL_IS_BORINGSSL) &&                      \
-    !OPENSSL_VERSION_PREREQ(3, 5)
-#define OPENSSL_WITH_KEM_OPERATION_PARAM 1
-#else
-#define OPENSSL_WITH_KEM_OPERATION_PARAM 0
-#endif
-
-// Post-quantum cryptography support. Keep these explicit so code can
-// distinguish provider API shape from the available algorithm set.
-#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 5)
-#define OPENSSL_WITH_OPENSSL_PQC 1
+#define OPENSSL_WITH_AES_GCM_SIV 1
 #else
-#define OPENSSL_WITH_OPENSSL_PQC 0
-#endif
-
-#ifdef OPENSSL_IS_BORINGSSL
-#define OPENSSL_WITH_BORINGSSL_PQC 1
-#else
-#define OPENSSL_WITH_BORINGSSL_PQC 0
-#endif
-
-#define OPENSSL_WITH_PQC                                                       \
-  (OPENSSL_WITH_OPENSSL_PQC || OPENSSL_WITH_BORINGSSL_PQC)
-#define OPENSSL_WITH_PQC_ML_KEM_512 OPENSSL_WITH_OPENSSL_PQC
-#define OPENSSL_WITH_PQC_SLH_DSA OPENSSL_WITH_OPENSSL_PQC
-
-#if OPENSSL_WITH_OPENSSL_PQC
-#define EVP_PKEY_ML_KEM_512 NID_ML_KEM_512
-#define EVP_PKEY_ML_KEM_768 NID_ML_KEM_768
-#define EVP_PKEY_ML_KEM_1024 NID_ML_KEM_1024
-#elif OPENSSL_WITH_BORINGSSL_PQC
-#define EVP_PKEY_ML_KEM_768 NID_ML_KEM_768
-#define EVP_PKEY_ML_KEM_1024 NID_ML_KEM_1024
+#define OPENSSL_WITH_AES_GCM_SIV 0
 #endif
 
 #if OPENSSL_VERSION_PREREQ(3, 0)
@@ -351,6 +320,8 @@ class DataPointer;
 class DHPointer;
 class ECKeyPointer;
 class EVPKeyPointer;
+class KeyAlgorithm;
+class MacCache;
 class EVPMacCtxPointer;
 class EVPMacPointer;
 class EVPMDCtxPointer;
@@ -385,9 +356,12 @@ class Digest final {
   static constexpr size_t MAX_SIZE = EVP_MAX_MD_SIZE;
   Digest() = default;
   Digest(const EVP_MD* md) : md_(md) {}
-  Digest(const Digest&) = default;
-  Digest& operator=(const Digest&) = default;
+  Digest(const Digest& other);
+  Digest& operator=(const Digest& other);
   inline Digest& operator=(const EVP_MD* md) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    fetched_md_.reset();
+#endif
     md_ = md;
     return *this;
   }
@@ -406,9 +380,72 @@ class Digest final {
   static const Digest SHA512;
 
   static const Digest FromName(const char* name);
+  static const Digest Fetch(const char* name);
 
  private:
   const EVP_MD* md_ = nullptr;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  explicit Digest(DeleteFnPtr<EVP_MD, EVP_MD_free> md);
+  DeleteFnPtr<EVP_MD, EVP_MD_free> fetched_md_;
+#endif
+};
+
+struct CaseInsensitiveNameHash {
+  using is_transparent = void;
+  size_t operator()(std::string_view name) const noexcept;
+};
+
+struct CaseInsensitiveNameEqual {
+  using is_transparent = void;
+  bool operator()(std::string_view lhs, std::string_view rhs) const noexcept;
+};
+
+class DigestCache final {
+ public:
+  struct Result {
+    const EVP_MD* digest = nullptr;
+    int32_t id = -1;
+  };
+
+  using AliasMap = std::unordered_map<std::string,
+                                      int32_t,
+                                      CaseInsensitiveNameHash,
+                                      CaseInsensitiveNameEqual>;
+
+  DigestCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(DigestCache)
+
+  Result lookup(const char* name, uint64_t generation) const;
+  inline Result lookup(int32_t id, uint64_t generation) const {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    if (generation_ != generation || id == -1) return {};
+    const uint32_t unsigned_id = static_cast<uint32_t>(id);
+    if (unsigned_id < first_id_) return {};
+    const size_t index = unsigned_id - first_id_;
+    if (index >= digests_.size()) return {};
+    return {digests_[index].get(), id};
+#else
+    static_cast<void>(id);
+    static_cast<void>(generation);
+    return {};
+#endif
+  }
+  Result insert(const char* name, const EVP_MD* digest, uint64_t generation);
+  void reset(uint64_t generation);
+  const AliasMap& aliases() const;
+
+ private:
+  uint64_t generation_ = 0;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
+
+  // IDs are not reused across generations because JavaScript caches them
+  // independently in each Realm.
+  uint32_t first_id_ = 0;
+  uint32_t next_id_ = 0;
+  std::vector<EVPMDPointer> digests_;
+  AliasMap aliases_;
+#endif
 };
 
 // Computes a fixed-length digest.
@@ -419,6 +456,32 @@ DataPointer xofHashDigest(const Buffer<const unsigned char>& data,
                           const EVP_MD* md,
                           size_t length);
 
+class CipherCache final {
+ public:
+  CipherCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(CipherCache)
+
+  const EVP_CIPHER* lookup(const char* name, uint64_t generation);
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const EVP_CIPHER* insert(const char* name,
+                           DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>&& cipher,
+                           uint64_t generation);
+#endif
+
+ private:
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  using EVPCipherPointer = DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>;
+
+  uint64_t generation_ = 0;
+  std::vector<EVPCipherPointer> ciphers_;
+  std::unordered_map<std::string,
+                     size_t,
+                     CaseInsensitiveNameHash,
+                     CaseInsensitiveNameEqual>
+      aliases_;
+#endif
+};
+
 class Cipher final {
  public:
   static constexpr size_t MAX_KEY_LENGTH = EVP_MAX_KEY_LENGTH;
@@ -437,9 +500,12 @@ class Cipher final {
 
   Cipher() = default;
   Cipher(const EVP_CIPHER* cipher) : cipher_(cipher) {}
-  Cipher(const Cipher&) = default;
-  Cipher& operator=(const Cipher&) = default;
+  Cipher(const Cipher& other);
+  Cipher& operator=(const Cipher& other);
   inline Cipher& operator=(const EVP_CIPHER* cipher) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    fetched_cipher_.reset();
+#endif
     cipher_ = cipher;
     return *this;
   }
@@ -461,7 +527,10 @@ class Cipher final {
   bool isWrapMode() const;
   bool isCtrMode() const;
   bool isCcmMode() const;
+  bool isCtsMode() const;
   bool isOcbMode() const;
+  bool isSivMode() const;
+  bool isGcmSivMode() const;
   bool isStreamMode() const;
   bool isChaCha20Poly1305() const;
 
@@ -472,8 +541,9 @@ class Cipher final {
                  unsigned char* key,
                  unsigned char* iv) const;
 
-  static const Cipher FromName(const char* name);
-  static const Cipher FromNid(int nid);
+  static const Cipher FromName(const char* name, CipherCache* cache = nullptr);
+  static const Cipher FromNameForKeyEncoding(const char* name);
+  static const Cipher FromNid(int nid, CipherCache* cache = nullptr);
   static const Cipher FromCtx(const CipherCtxPointer& ctx);
 
   using CipherNameCallback = std::function<void(const char* name)>;
@@ -482,32 +552,29 @@ class Cipher final {
   // is able to do so.
   static void ForEach(CipherNameCallback callback);
 
-  // Utilities to get various ciphers by type. If the underlying
-  // implementation does not support the requested cipher, then
-  // the result will be an empty Cipher object whose bool operator
-  // will return false.
-
-  static const Cipher EMPTY;
-  static const Cipher AES_128_CBC;
-  static const Cipher AES_192_CBC;
-  static const Cipher AES_256_CBC;
-  static const Cipher AES_128_CTR;
-  static const Cipher AES_192_CTR;
-  static const Cipher AES_256_CTR;
-  static const Cipher AES_128_GCM;
-  static const Cipher AES_192_GCM;
-  static const Cipher AES_256_GCM;
-  static const Cipher AES_128_KW;
-  static const Cipher AES_192_KW;
-  static const Cipher AES_256_KW;
-  static const Cipher AES_128_OCB;
-  static const Cipher AES_192_OCB;
-  static const Cipher AES_256_OCB;
-  static const Cipher CHACHA20_POLY1305;
+  // Lazily resolves common ciphers. If the underlying implementation does not
+  // support the requested cipher, the returned Cipher will be empty.
+  static const Cipher& AES_128_CBC();
+  static const Cipher& AES_192_CBC();
+  static const Cipher& AES_256_CBC();
+  static const Cipher& AES_128_CTR();
+  static const Cipher& AES_192_CTR();
+  static const Cipher& AES_256_CTR();
+  static const Cipher& AES_128_GCM();
+  static const Cipher& AES_192_GCM();
+  static const Cipher& AES_256_GCM();
+  static const Cipher& AES_128_KW();
+  static const Cipher& AES_192_KW();
+  static const Cipher& AES_256_KW();
+  static const Cipher& AES_128_OCB();
+  static const Cipher& AES_192_OCB();
+  static const Cipher& AES_256_OCB();
+  static const Cipher& CHACHA20_POLY1305();
 
   struct CipherParams {
     int padding;
     Digest digest;
+    Digest mgf1_digest;
     const Buffer<const void> label;
   };
 
@@ -532,6 +599,10 @@ class Cipher final {
 
  private:
   const EVP_CIPHER* cipher_ = nullptr;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  explicit Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
+  DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
+#endif
 };
 
 // ============================================================================
@@ -579,8 +650,10 @@ class Dsa final {
 class Rsa final {
  public:
   Rsa();
+  enum class Selection { Public, Private };
+  static Rsa PublicOnly(const EVPKeyPointer& key);
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
-  explicit Rsa(const EVP_PKEY* pkey);
+  explicit Rsa(const EVP_PKEY* pkey, Selection selection = Selection::Private);
 #else
   Rsa(OSSL3_CONST RSA* rsa);
 #endif
@@ -609,6 +682,23 @@ class Rsa final {
     const BIGNUM* dq;
     const BIGNUM* qi;
   };
+  struct OtherPrimeInfo {
+    const BIGNUM* r;
+    const BIGNUM* d;
+    const BIGNUM* t;
+  };
+  struct OtherPrimeInfoPointer {
+    OtherPrimeInfoPointer() = default;
+    OtherPrimeInfoPointer(BignumPointer&& r,
+                          BignumPointer&& d,
+                          BignumPointer&& t);
+
+    DeleteFnPtr<BIGNUM, BN_clear_free> r;
+    DeleteFnPtr<BIGNUM, BN_clear_free> d;
+    DeleteFnPtr<BIGNUM, BN_clear_free> t;
+  };
+  using OtherPrimeInfos = std::vector<OtherPrimeInfo>;
+  using OtherPrimeInfoPointers = std::vector<OtherPrimeInfoPointer>;
   struct PssParams {
     std::string_view digest = "sha1";
     std::optional<std::string_view> mgf1_digest = "sha1";
@@ -617,6 +707,9 @@ class Rsa final {
 
   const PublicKey getPublicKey() const;
   const PrivateKey getPrivateKey() const;
+  const OtherPrimeInfos getOtherPrimeInfos() const;
+  // Check that n is the product of all private-key prime factors.
+  bool checkPrimeProduct() const;
   const std::optional<PssParams> getPssParams() const;
 
   bool setPublicKey(BignumPointer&& n, BignumPointer&& e);
@@ -625,7 +718,8 @@ class Rsa final {
                      BignumPointer&& p,
                      BignumPointer&& dp,
                      BignumPointer&& dq,
-                     BignumPointer&& qi);
+                     BignumPointer&& qi,
+                     OtherPrimeInfoPointers&& other_prime_infos = {});
 
   using CipherParams = Cipher::CipherParams;
 
@@ -650,6 +744,7 @@ class Rsa final {
   DeleteFnPtr<BIGNUM, BN_clear_free> dp_;
   DeleteFnPtr<BIGNUM, BN_clear_free> dq_;
   DeleteFnPtr<BIGNUM, BN_clear_free> qi_;
+  OtherPrimeInfoPointers other_prime_infos_;
   std::optional<PssParams> pss_params_;
 #else
   OSSL3_CONST RSA* rsa_;
@@ -677,6 +772,18 @@ class Ec final {
 #endif
 
   static int GetCurveIdFromName(const char* name);
+  static int GetCurveId(const EVPKeyPointer& key);
+  static std::optional<std::string> GetCurveName(const EVPKeyPointer& key);
+  static bool CheckCurveName(const char* name);
+  static DataPointer TryExportPublic(const EVPKeyPointer& key,
+                                     point_conversion_form_t form);
+  static DataPointer ExportPrivate(const EVPKeyPointer& key);
+  static bool GetKeyComponents(const EVPKeyPointer& key,
+                               BignumPointer* x,
+                               BignumPointer* y,
+                               BignumPointer* priv,
+                               int* degree);
+  static const KeyAlgorithm* GetNamedKeyAlgorithm(const char* name);
 
   using GetCurveCallback = std::function<bool(const char*)>;
   static bool GetCurves(GetCurveCallback callback);
@@ -918,7 +1025,9 @@ class CipherCtxPointer final {
   bool setIvLength(size_t length);
   bool setAeadTag(const Buffer<const char>& tag);
   bool setAeadTagLength(size_t length);
+  bool setCtsMode(const char* mode);
   bool setPadding(bool padding);
+  bool setXtsStandard(const char* standard);
   bool init(const Cipher& cipher,
             bool encrypt,
             const unsigned char* key = nullptr,
@@ -931,7 +1040,11 @@ class CipherCtxPointer final {
   bool isGcmMode() const;
   bool isOcbMode() const;
   bool isCcmMode() const;
+  bool isCtsMode() const;
+  bool isXtsMode() const;
   bool isWrapMode() const;
+  bool isSivMode() const;
+  bool isGcmSivMode() const;
   bool isChaCha20Poly1305() const;
 
   bool update(const Buffer<const unsigned char>& in,
@@ -944,6 +1057,79 @@ class CipherCtxPointer final {
   DeleteFnPtr<EVP_CIPHER_CTX, EVP_CIPHER_CTX_free> ctx_;
 };
 
+// Known key algorithms are identified by provider names, never synthetic NIDs.
+// Descriptors have static lifetime; availability is queried from the backend.
+class KeyAlgorithm final {
+ public:
+  static const KeyAlgorithm RSA;
+  static const KeyAlgorithm RSA_PSS;
+  static const KeyAlgorithm DSA;
+  static const KeyAlgorithm DH;
+  static const KeyAlgorithm EC;
+  static const KeyAlgorithm ED25519;
+  static const KeyAlgorithm ED448;
+  static const KeyAlgorithm X25519;
+  static const KeyAlgorithm X448;
+  static const KeyAlgorithm SM2;
+  static const KeyAlgorithm ML_DSA_44;
+  static const KeyAlgorithm ML_DSA_65;
+  static const KeyAlgorithm ML_DSA_87;
+  static const KeyAlgorithm ML_KEM_512;
+  static const KeyAlgorithm ML_KEM_768;
+  static const KeyAlgorithm ML_KEM_1024;
+  static const KeyAlgorithm SLH_DSA_SHA2_128F;
+  static const KeyAlgorithm SLH_DSA_SHA2_128S;
+  static const KeyAlgorithm SLH_DSA_SHA2_192F;
+  static const KeyAlgorithm SLH_DSA_SHA2_192S;
+  static const KeyAlgorithm SLH_DSA_SHA2_256F;
+  static const KeyAlgorithm SLH_DSA_SHA2_256S;
+  static const KeyAlgorithm SLH_DSA_SHAKE_128F;
+  static const KeyAlgorithm SLH_DSA_SHAKE_128S;
+  static const KeyAlgorithm SLH_DSA_SHAKE_192F;
+  static const KeyAlgorithm SLH_DSA_SHAKE_192S;
+  static const KeyAlgorithm SLH_DSA_SHAKE_256F;
+  static const KeyAlgorithm SLH_DSA_SHAKE_256S;
+
+  // Look up a canonical name case-insensitively, including unavailable
+  // algorithms.
+  static const KeyAlgorithm* FromName(const char* name);
+  using Callback = std::function<void(const KeyAlgorithm&)>;
+  static void ForEachPqc(Callback callback);
+
+  const char* name() const { return name_; }
+  const char* keyTypeName() const {
+    return key_type_name_[0] == '\0' ? nullptr : key_type_name_.data();
+  }
+  bool isRsa() const;
+  bool isAvailable() const;
+  bool isPqc() const;
+  bool isOkp() const;
+  bool isOneShot() const;
+  bool supportsRawPublic() const;
+  bool supportsRawPrivate() const;
+  size_t seedSize() const;
+
+ private:
+  enum class Family { Other, EdDSA, XDH, MLDSA, MLKEM, SLHDSA };
+  static constexpr size_t kMaxKeyTypeNameLength = 32;
+  template <size_t N>
+  constexpr KeyAlgorithm(const char (&name)[N],
+                         Family family,
+                         bool has_key_type = true)
+      : name_(name), family_(family) {
+    static_assert(N <= kMaxKeyTypeNameLength);
+    if (has_key_type) {
+      for (size_t i = 0; i < N; i++) {
+        key_type_name_[i] =
+            name[i] >= 'A' && name[i] <= 'Z' ? name[i] + ('a' - 'A') : name[i];
+      }
+    }
+  }
+  const char* name_;
+  std::array<char, kMaxKeyTypeNameLength> key_type_name_{};
+  Family family_;
+};
+
 class EVPKeyCtxPointer final {
  public:
   EVPKeyCtxPointer();
@@ -968,6 +1154,7 @@ class EVPKeyCtxPointer final {
   bool setDhParameters(int prime_size, uint32_t generator);
   bool setDsaParameters(uint32_t bits, std::optional<int> q_bits);
   bool setEcParameters(int curve, int encoding);
+  bool setEcParameters(const char* group_name, int encoding);
 
   bool setRsaOaepMd(const Digest& md);
   bool setRsaMgf1Md(const Digest& md);
@@ -1006,7 +1193,8 @@ class EVPKeyCtxPointer final {
   int initForSign();
 
   static EVPKeyCtxPointer New(const EVPKeyPointer& key);
-  static EVPKeyCtxPointer NewFromID(int id);
+  static EVPKeyCtxPointer NewFromName(const char* name);
+  static EVPKeyCtxPointer NewFromAlgorithm(const KeyAlgorithm& algorithm);
 
  private:
   DeleteFnPtr<EVP_PKEY_CTX, EVP_PKEY_CTX_free> ctx_;
@@ -1015,14 +1203,12 @@ class EVPKeyCtxPointer final {
 class EVPKeyPointer final {
  public:
   static EVPKeyPointer New();
-  static EVPKeyPointer NewRawPublic(int id,
+  static EVPKeyPointer NewRawPublic(const KeyAlgorithm& algorithm,
                                     const Buffer<const unsigned char>& data);
-  static EVPKeyPointer NewRawPrivate(int id,
+  static EVPKeyPointer NewRawPrivate(const KeyAlgorithm& algorithm,
                                      const Buffer<const unsigned char>& data);
-#if OPENSSL_WITH_PQC
-  static EVPKeyPointer NewRawSeed(int id,
+  static EVPKeyPointer NewRawSeed(const KeyAlgorithm& algorithm,
                                   const Buffer<const unsigned char>& data);
-#endif
   static EVPKeyPointer NewDH(DHPointer&& dh);
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   static EVPKeyPointer NewRSA(const Rsa& rsa);
@@ -1070,7 +1256,7 @@ class EVPKeyPointer final {
   using PublicKeyEncodingConfig = AsymmetricKeyEncodingConfig;
 
   struct PrivateKeyEncodingConfig : public AsymmetricKeyEncodingConfig {
-    const EVP_CIPHER* cipher = nullptr;
+    Cipher cipher;
     std::optional<DataPointer> passphrase = std::nullopt;
     PrivateKeyEncodingConfig() = default;
     PrivateKeyEncodingConfig(bool output_key_object,
@@ -1127,11 +1313,19 @@ class EVPKeyPointer final {
   void reset(EVP_PKEY* pkey = nullptr);
   EVP_PKEY* release();
 
-  static int id(const EVP_PKEY* key);
-  static int base_id(const EVP_PKEY* key);
-
-  int id() const;
-  int base_id() const;
+  static bool isA(const EVP_PKEY* key, const char* name);
+  bool isA(const char* name) const;
+  static bool isA(const EVP_PKEY* key, const KeyAlgorithm& algorithm);
+  bool isA(const KeyAlgorithm& algorithm) const;
+  // Resolve a known algorithm without caching key or provider state.
+  const KeyAlgorithm* getAlgorithm() const;
+  // Stable public key-type name, or nullptr for an unsupported key type.
+  const char* getKeyTypeName() const;
+  bool supportsRawPublic() const;
+  bool supportsRawPrivate() const;
+  bool supportsContextString() const;
+  bool hasSmallOrderEdDsaPoint(
+      const Buffer<const unsigned char>& signature) const;
   int bits() const;
   size_t size() const;
 
@@ -1141,9 +1335,22 @@ class EVPKeyPointer final {
   DataPointer rawPrivateKey() const;
   BIOPointer derPublicKey() const;
 
-#if OPENSSL_WITH_PQC
-  DataPointer rawSeed() const;
-#endif
+  enum class RawExportError { UNSUPPORTED_KEY_TYPE, MISSING_SEED, FAILED };
+  Result<DataPointer, RawExportError> rawSeed() const;
+
+  struct RawJwkData {
+    const KeyAlgorithm* algorithm = nullptr;
+    DataPointer public_key;
+    DataPointer private_key;
+  };
+  // Raw JWK material for OKP and AKP keys. Private bytes use the JWK
+  // representation (a seed for ML-DSA/ML-KEM, a raw private key otherwise).
+  Result<RawJwkData, RawExportError> exportRawJwk(bool include_private) const;
+  static EVPKeyPointer NewRawJwk(
+      const KeyAlgorithm& algorithm,
+      const Buffer<const unsigned char>& public_key,
+      const std::optional<Buffer<const unsigned char>>& private_key =
+          std::nullopt);
 
   Result<BIOPointer, bool> writePrivateKey(
       const PrivateKeyEncodingConfig& config) const;
@@ -1159,9 +1366,10 @@ class EVPKeyPointer final {
   operator Rsa() const;
   operator Dsa() const;
 
+  static bool isRsaVariant(const EVP_PKEY* key);
   bool isRsaVariant() const;
-  bool isOneShotVariant() const;
   bool isSigVariant() const;
+  bool mayBeSM2() const;
   bool validateDsaParameters() const;
 
  private:
@@ -1623,6 +1831,7 @@ class ECKeyPointer final {
   bool setPublicKeyRaw(const BignumPointer& x, const BignumPointer& y);
   bool generate();
   bool checkKey() const;
+  bool checkPrivateKey() const;
   DataPointer computeSecret(const ECPointPointer& peer) const;
 
   const EC_GROUP* getGroup() const;
@@ -1666,7 +1875,16 @@ class EVPMDCtxPointer final {
   void reset(EVP_MD_CTX* ctx = nullptr);
   EVP_MD_CTX* release();
 
-  bool digestInit(const Digest& digest);
+  bool digestInit(const EVP_MD* digest);
+  inline bool digestInit(const Digest& digest) {
+    return digestInit(digest.get());
+  }
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+  bool digestInit(const EVP_MD* digest, const OSSL_PARAM* params);
+  inline bool digestInit(const Digest& digest, const OSSL_PARAM* params) {
+    return digestInit(digest.get(), params);
+  }
+#endif
   bool digestUpdate(const Buffer<const void>& in);
   DataPointer digestFinal(size_t length);
   bool digestFinalInto(Buffer<void>* buf);
@@ -1758,6 +1976,61 @@ class EVPMacPointer final {
   DeleteFnPtr<EVP_MAC, EVP_MAC_free> mac_;
 };
 
+enum class MacKind : uint8_t {
+  kOther,
+  kHmac,
+  kCmac,
+  kGmac,
+};
+
+class MacCache final {
+ public:
+  struct Result {
+    // Borrowed from the cache and valid until the cache is reset. Creating an
+    // EVP_MAC_CTX takes an independent reference to the method.
+    EVP_MAC* mac = nullptr;
+    int32_t id = -1;
+    MacKind kind = MacKind::kOther;
+  };
+
+  using AliasMap = std::unordered_map<std::string,
+                                      int32_t,
+                                      CaseInsensitiveNameHash,
+                                      CaseInsensitiveNameEqual>;
+
+  MacCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(MacCache)
+
+  Result lookup(const char* name, uint64_t generation) const;
+  inline Result lookup(int32_t id, uint64_t generation) const {
+    if (generation_ != generation || id == -1) return {};
+    const uint32_t unsigned_id = static_cast<uint32_t>(id);
+    if (unsigned_id < first_id_) return {};
+    const size_t index = unsigned_id - first_id_;
+    if (index >= macs_.size()) return {};
+    return {macs_[index].mac.get(), id, macs_[index].kind};
+  }
+  Result insert(const char* name, EVPMacPointer&& mac, uint64_t generation);
+  void reset(uint64_t generation);
+  const AliasMap& aliases() const;
+  static MacKind GetKind(EVP_MAC* mac);
+
+ private:
+  struct Entry {
+    EVPMacPointer mac;
+    MacKind kind;
+  };
+
+  uint64_t generation_ = 0;
+
+  // IDs are not reused across generations because JavaScript may cache them
+  // independently in each Realm.
+  uint32_t first_id_ = 0;
+  uint32_t next_id_ = 0;
+  std::vector<Entry> macs_;
+  AliasMap aliases_;
+};
+
 class EVPMacCtxPointer final {
  public:
   EVPMacCtxPointer() = default;
@@ -1776,6 +2049,8 @@ class EVPMacCtxPointer final {
 
   bool init(const Buffer<const void>& key, const OSSL_PARAM* params = nullptr);
   bool update(const Buffer<const void>& data);
+  size_t getSize() const;
+  const OSSL_PARAM* getSettableParams() const;
   DataPointer final(size_t length);
 
   static EVPMacCtxPointer New(EVP_MAC* mac);
@@ -1812,6 +2087,14 @@ class HMACCtxPointer final {
 };
 #endif  // OPENSSL_WITH_EVP_MAC
 
+#if !OPENSSL_WITH_EVP_MAC
+class MacCache final {
+ public:
+  MacCache() = default;
+  NCRYPTO_DISALLOW_COPY_AND_MOVE(MacCache)
+};
+#endif
+
 #ifndef OPENSSL_NO_ENGINE
 class EnginePointer final {
  public:
@@ -1854,8 +2137,14 @@ class EnginePointer final {
 // FIPS
 bool isFipsEnabled();
 
+// Configure seed-preserving PQC private-key encoding when the backend supports
+// it.
+void ConfigurePqcEncoding();
+
 bool setFipsEnabled(bool enabled, CryptoErrorList* errors);
 
+uint64_t getFipsStateGeneration();
+
 bool testFipsEnabled();
 
 // ============================================================================
@@ -1888,8 +2177,29 @@ Buffer<char> ExportChallenge(const char* input, size_t length);
 // ============================================================================
 // KDF
 
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+class KDF final {
+ public:
+  KDF() = default;
+  KDF(KDF&&) noexcept = default;
+  KDF& operator=(KDF&&) noexcept = default;
+  NCRYPTO_DISALLOW_COPY(KDF)
+
+  inline operator bool() const { return kdf_ != nullptr; }
+
+  static KDF Fetch(const char* algorithm, OSSL_LIB_CTX* libctx = nullptr);
+
+  // Each derivation uses a fresh context. A null output can be used for
+  // parameter validation by KDFs that support it, such as scrypt.
+  bool derive(const Buffer<unsigned char>& out, const OSSL_PARAM* params) const;
+
+ private:
+  explicit KDF(EVP_KDF* kdf);
+  DeleteFnPtr<EVP_KDF, EVP_KDF_free> kdf_;
+};
+#endif
+
 const EVP_MD* getDigestByName(const char* name);
-const EVP_CIPHER* getCipherByName(const char* name);
 
 // Verify that the specified HKDF output length is valid for the given digest.
 // The maximum length for HKDF output for a given digest is 255 times the
@@ -1963,7 +2273,7 @@ class KEM final {
                                  const Buffer<const void>& ciphertext);
 
  private:
-#if OPENSSL_WITH_KEM_OPERATION_PARAM
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
   static bool SetOperationParameter(EVP_PKEY_CTX* ctx,
                                     const EVPKeyPointer& key);
 #endif
diff --git a/deps/nghttp2/unofficial.gni b/deps/nghttp2/unofficial.gni
index 4558fbbf5e5f..d37754f59124 100644
--- a/deps/nghttp2/unofficial.gni
+++ b/deps/nghttp2/unofficial.gni
@@ -4,40 +4,53 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("nghttp2_gn_build") {
-  config("nghttp2_config") {
-    include_dirs = [ "lib/includes" ]
-    if (!is_component_build) {
-      defines = [ "NGHTTP2_STATICLIB" ]
+  if (node_shared_nghttp2) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("nghttp2_config") {
+      packages = [ "libnghttp2" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":nghttp2_config" ]
+    }
+  } else {
+    config("nghttp2_config") {
+      include_dirs = [ "lib/includes" ]
+      if (!is_component_build) {
+        defines = [ "NGHTTP2_STATICLIB" ]
+      }
     }
-  }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("nghttp2.gyp") ],
-                            "scope",
-                            [ "nghttp2.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("nghttp2.gyp") ],
+                              "scope",
+                              [ "nghttp2.gyp" ])
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
+    component(target_name) {
+      forward_variables_from(invoker, "*")
 
-    public_configs = [ ":nghttp2_config" ]
-    defines = [
-      "_U_",
-      "HAVE_CONFIG_H"
-    ]
-    if (is_component_build) {
-      defines += [ "BUILDING_NGHTTP2" ]
-    }
+      public_configs = [ ":nghttp2_config" ]
+      defines = [
+        "_U_",
+        "HAVE_CONFIG_H"
+      ]
+      if (is_component_build) {
+        defines += [ "BUILDING_NGHTTP2" ]
+      }
 
-    sources = gypi_values.nghttp2_sources
+      sources = gypi_values.nghttp2_sources
 
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        # Ref https://github.com/nghttp2/nghttp2/pull/2258
-        # This can be removed when the above PR is ingested.
-        "-Wno-extra-semi",
-      ]
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          # Ref https://github.com/nghttp2/nghttp2/pull/2258
+          # This can be removed when the above PR is ingested.
+          "-Wno-extra-semi",
+        ]
+      }
     }
   }
 }
diff --git a/deps/npm/docs/content/commands/npm-ls.md b/deps/npm/docs/content/commands/npm-ls.md
index 24746c173b7c..b38603c203fc 100644
--- a/deps/npm/docs/content/commands/npm-ls.md
+++ b/deps/npm/docs/content/commands/npm-ls.md
@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
 For example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@11.19.0 /path/to/npm
+npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```
diff --git a/deps/npm/docs/content/commands/npm.md b/deps/npm/docs/content/commands/npm.md
index 769bb262064e..75157bd7b598 100644
--- a/deps/npm/docs/content/commands/npm.md
+++ b/deps/npm/docs/content/commands/npm.md
@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-11.19.0
+11.19.1
 
 ### Description
 
diff --git a/deps/npm/docs/output/commands/npm-access.html b/deps/npm/docs/output/commands/npm-access.html
index 2a044ef5ed59..ac6df64b960b 100644
--- a/deps/npm/docs/output/commands/npm-access.html
+++ b/deps/npm/docs/output/commands/npm-access.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-access----11190">
+<h1 id="----npm-access----11191">
     <span>npm-access</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Set access level on published packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-adduser.html b/deps/npm/docs/output/commands/npm-adduser.html
index c59e21d94298..29aec6314e96 100644
--- a/deps/npm/docs/output/commands/npm-adduser.html
+++ b/deps/npm/docs/output/commands/npm-adduser.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-adduser----11190">
+<h1 id="----npm-adduser----11191">
     <span>npm-adduser</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Add a registry user account</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-approve-scripts.html b/deps/npm/docs/output/commands/npm-approve-scripts.html
index 55c9db2b2a2b..3d61cc8ea23a 100644
--- a/deps/npm/docs/output/commands/npm-approve-scripts.html
+++ b/deps/npm/docs/output/commands/npm-approve-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-approve-scripts----11190">
+<h1 id="----npm-approve-scripts----11191">
     <span>npm-approve-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Approve install scripts for specific dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-audit.html b/deps/npm/docs/output/commands/npm-audit.html
index 438891b03cbc..9117faa9bed5 100644
--- a/deps/npm/docs/output/commands/npm-audit.html
+++ b/deps/npm/docs/output/commands/npm-audit.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-audit----11190">
+<h1 id="----npm-audit----11191">
     <span>npm-audit</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a security audit</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-bugs.html b/deps/npm/docs/output/commands/npm-bugs.html
index eb7a91c9457f..63f4c29210a2 100644
--- a/deps/npm/docs/output/commands/npm-bugs.html
+++ b/deps/npm/docs/output/commands/npm-bugs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-bugs----11190">
+<h1 id="----npm-bugs----11191">
     <span>npm-bugs</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Report bugs for a package in a web browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-cache.html b/deps/npm/docs/output/commands/npm-cache.html
index 374878c8d04e..3377b00cc56c 100644
--- a/deps/npm/docs/output/commands/npm-cache.html
+++ b/deps/npm/docs/output/commands/npm-cache.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-cache----11190">
+<h1 id="----npm-cache----11191">
     <span>npm-cache</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manipulates packages cache</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ci.html b/deps/npm/docs/output/commands/npm-ci.html
index 0a91d5159b12..edde5bbdef66 100644
--- a/deps/npm/docs/output/commands/npm-ci.html
+++ b/deps/npm/docs/output/commands/npm-ci.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ci----11190">
+<h1 id="----npm-ci----11191">
     <span>npm-ci</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Clean install a project</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-completion.html b/deps/npm/docs/output/commands/npm-completion.html
index dc927a82868a..b5a6f445d451 100644
--- a/deps/npm/docs/output/commands/npm-completion.html
+++ b/deps/npm/docs/output/commands/npm-completion.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-completion----11190">
+<h1 id="----npm-completion----11191">
     <span>npm-completion</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Tab Completion for npm</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-config.html b/deps/npm/docs/output/commands/npm-config.html
index 5b4e3e1204bc..c9ea9080cf78 100644
--- a/deps/npm/docs/output/commands/npm-config.html
+++ b/deps/npm/docs/output/commands/npm-config.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-config----11190">
+<h1 id="----npm-config----11191">
     <span>npm-config</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage the npm configuration files</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-dedupe.html b/deps/npm/docs/output/commands/npm-dedupe.html
index 0f08ae285737..abe4a229e77c 100644
--- a/deps/npm/docs/output/commands/npm-dedupe.html
+++ b/deps/npm/docs/output/commands/npm-dedupe.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dedupe----11190">
+<h1 id="----npm-dedupe----11191">
     <span>npm-dedupe</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Reduce duplication in the package tree</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-deny-scripts.html b/deps/npm/docs/output/commands/npm-deny-scripts.html
index 8b82b3684feb..3a56f32dc977 100644
--- a/deps/npm/docs/output/commands/npm-deny-scripts.html
+++ b/deps/npm/docs/output/commands/npm-deny-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deny-scripts----11190">
+<h1 id="----npm-deny-scripts----11191">
     <span>npm-deny-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Deny install scripts for specific dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-deprecate.html b/deps/npm/docs/output/commands/npm-deprecate.html
index 489345c280bc..90f45466cad9 100644
--- a/deps/npm/docs/output/commands/npm-deprecate.html
+++ b/deps/npm/docs/output/commands/npm-deprecate.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deprecate----11190">
+<h1 id="----npm-deprecate----11191">
     <span>npm-deprecate</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Deprecate a version of a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-diff.html b/deps/npm/docs/output/commands/npm-diff.html
index 3bb3d244a198..fba245e3b33a 100644
--- a/deps/npm/docs/output/commands/npm-diff.html
+++ b/deps/npm/docs/output/commands/npm-diff.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-diff----11190">
+<h1 id="----npm-diff----11191">
     <span>npm-diff</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The registry diff command</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-dist-tag.html b/deps/npm/docs/output/commands/npm-dist-tag.html
index 9f3aafdf4314..2d42ee8e3e84 100644
--- a/deps/npm/docs/output/commands/npm-dist-tag.html
+++ b/deps/npm/docs/output/commands/npm-dist-tag.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dist-tag----11190">
+<h1 id="----npm-dist-tag----11191">
     <span>npm-dist-tag</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Modify package distribution tags</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-docs.html b/deps/npm/docs/output/commands/npm-docs.html
index fbdd0ad2b626..98295c7943e0 100644
--- a/deps/npm/docs/output/commands/npm-docs.html
+++ b/deps/npm/docs/output/commands/npm-docs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-docs----11190">
+<h1 id="----npm-docs----11191">
     <span>npm-docs</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Open documentation for a package in a web browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-doctor.html b/deps/npm/docs/output/commands/npm-doctor.html
index b7dc5d2caf84..096f12bf3b80 100644
--- a/deps/npm/docs/output/commands/npm-doctor.html
+++ b/deps/npm/docs/output/commands/npm-doctor.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-doctor----11190">
+<h1 id="----npm-doctor----11191">
     <span>npm-doctor</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Check the health of your npm environment</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-edit.html b/deps/npm/docs/output/commands/npm-edit.html
index 3aed53c2677a..7a555a8f39a4 100644
--- a/deps/npm/docs/output/commands/npm-edit.html
+++ b/deps/npm/docs/output/commands/npm-edit.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-edit----11190">
+<h1 id="----npm-edit----11191">
     <span>npm-edit</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Edit an installed package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-exec.html b/deps/npm/docs/output/commands/npm-exec.html
index a5ea0d54c343..94e8e68c05f1 100644
--- a/deps/npm/docs/output/commands/npm-exec.html
+++ b/deps/npm/docs/output/commands/npm-exec.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-exec----11190">
+<h1 id="----npm-exec----11191">
     <span>npm-exec</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a command from a local or remote npm package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-explain.html b/deps/npm/docs/output/commands/npm-explain.html
index bce1694bcf08..ccf68b227121 100644
--- a/deps/npm/docs/output/commands/npm-explain.html
+++ b/deps/npm/docs/output/commands/npm-explain.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-explain----11190">
+<h1 id="----npm-explain----11191">
     <span>npm-explain</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Explain installed packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-explore.html b/deps/npm/docs/output/commands/npm-explore.html
index 872892c9f1d5..7b4d6a2ed2c4 100644
--- a/deps/npm/docs/output/commands/npm-explore.html
+++ b/deps/npm/docs/output/commands/npm-explore.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-explore----11190">
+<h1 id="----npm-explore----11191">
     <span>npm-explore</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Browse an installed package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-find-dupes.html b/deps/npm/docs/output/commands/npm-find-dupes.html
index b71cbeb015db..19b5ae4ffcfa 100644
--- a/deps/npm/docs/output/commands/npm-find-dupes.html
+++ b/deps/npm/docs/output/commands/npm-find-dupes.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-find-dupes----11190">
+<h1 id="----npm-find-dupes----11191">
     <span>npm-find-dupes</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Find duplication in the package tree</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-fund.html b/deps/npm/docs/output/commands/npm-fund.html
index 9f04fd7ea66b..c657d182afd3 100644
--- a/deps/npm/docs/output/commands/npm-fund.html
+++ b/deps/npm/docs/output/commands/npm-fund.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-fund----11190">
+<h1 id="----npm-fund----11191">
     <span>npm-fund</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Retrieve funding information</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-get.html b/deps/npm/docs/output/commands/npm-get.html
index 94a56fd4a81b..59eaf5e577cb 100644
--- a/deps/npm/docs/output/commands/npm-get.html
+++ b/deps/npm/docs/output/commands/npm-get.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-get----11190">
+<h1 id="----npm-get----11191">
     <span>npm-get</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Get a value from the npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-help-search.html b/deps/npm/docs/output/commands/npm-help-search.html
index d3666992d1e9..d4abfb29c360 100644
--- a/deps/npm/docs/output/commands/npm-help-search.html
+++ b/deps/npm/docs/output/commands/npm-help-search.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-help-search----11190">
+<h1 id="----npm-help-search----11191">
     <span>npm-help-search</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Search npm help documentation</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-help.html b/deps/npm/docs/output/commands/npm-help.html
index e7fa1b32e601..d4fe535e8bd0 100644
--- a/deps/npm/docs/output/commands/npm-help.html
+++ b/deps/npm/docs/output/commands/npm-help.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-help----11190">
+<h1 id="----npm-help----11191">
     <span>npm-help</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Get help on npm</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-init.html b/deps/npm/docs/output/commands/npm-init.html
index 265ee78ad2cf..af686f90a7ac 100644
--- a/deps/npm/docs/output/commands/npm-init.html
+++ b/deps/npm/docs/output/commands/npm-init.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-init----11190">
+<h1 id="----npm-init----11191">
     <span>npm-init</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Create a package.json file</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-ci-test.html b/deps/npm/docs/output/commands/npm-install-ci-test.html
index 94d4e4a663b8..bdf779e2eef8 100644
--- a/deps/npm/docs/output/commands/npm-install-ci-test.html
+++ b/deps/npm/docs/output/commands/npm-install-ci-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-ci-test----11190">
+<h1 id="----npm-install-ci-test----11191">
     <span>npm-install-ci-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install a project with a clean slate and run tests</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-scripts.html b/deps/npm/docs/output/commands/npm-install-scripts.html
index d78f5efc1653..8174e90a5094 100644
--- a/deps/npm/docs/output/commands/npm-install-scripts.html
+++ b/deps/npm/docs/output/commands/npm-install-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-scripts----11190">
+<h1 id="----npm-install-scripts----11191">
     <span>npm-install-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage install-script approvals for dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-test.html b/deps/npm/docs/output/commands/npm-install-test.html
index c55b06547a9d..e75fb52d3239 100644
--- a/deps/npm/docs/output/commands/npm-install-test.html
+++ b/deps/npm/docs/output/commands/npm-install-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-test----11190">
+<h1 id="----npm-install-test----11191">
     <span>npm-install-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install package(s) and run tests</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install.html b/deps/npm/docs/output/commands/npm-install.html
index 80af90cc3db9..ed78f6576bb7 100644
--- a/deps/npm/docs/output/commands/npm-install.html
+++ b/deps/npm/docs/output/commands/npm-install.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install----11190">
+<h1 id="----npm-install----11191">
     <span>npm-install</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-link.html b/deps/npm/docs/output/commands/npm-link.html
index 3a5795b866f5..aa01ff7a259a 100644
--- a/deps/npm/docs/output/commands/npm-link.html
+++ b/deps/npm/docs/output/commands/npm-link.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-link----11190">
+<h1 id="----npm-link----11191">
     <span>npm-link</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Symlink a package folder</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ll.html b/deps/npm/docs/output/commands/npm-ll.html
index 601f99e91029..f8df2515bfa4 100644
--- a/deps/npm/docs/output/commands/npm-ll.html
+++ b/deps/npm/docs/output/commands/npm-ll.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ll----11190">
+<h1 id="----npm-ll----11191">
     <span>npm-ll</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">List installed packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-login.html b/deps/npm/docs/output/commands/npm-login.html
index 33d44e488838..1c6d938ec6c1 100644
--- a/deps/npm/docs/output/commands/npm-login.html
+++ b/deps/npm/docs/output/commands/npm-login.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-login----11190">
+<h1 id="----npm-login----11191">
     <span>npm-login</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Login to a registry user account</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-logout.html b/deps/npm/docs/output/commands/npm-logout.html
index 0be803c18ae7..cf319a086f89 100644
--- a/deps/npm/docs/output/commands/npm-logout.html
+++ b/deps/npm/docs/output/commands/npm-logout.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-logout----11190">
+<h1 id="----npm-logout----11191">
     <span>npm-logout</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Log out of the registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ls.html b/deps/npm/docs/output/commands/npm-ls.html
index bda454a04c77..b733762be373 100644
--- a/deps/npm/docs/output/commands/npm-ls.html
+++ b/deps/npm/docs/output/commands/npm-ls.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ls----11190">
+<h1 id="----npm-ls----11191">
     <span>npm-ls</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">List installed packages</span>
 </header>
@@ -209,7 +209,7 @@ <h3 id="description">Description</h3>
 <p>Positional arguments are <code>name@version-range</code> identifiers, which will limit the results to only the paths to the packages named.
 Note that nested packages will <em>also</em> show the paths to the specified packages.
 For example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre><code class="language-bash">npm@11.19.0 /path/to/npm
+<pre><code class="language-bash">npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>
diff --git a/deps/npm/docs/output/commands/npm-org.html b/deps/npm/docs/output/commands/npm-org.html
index 32df155d69ce..6a2c22951a60 100644
--- a/deps/npm/docs/output/commands/npm-org.html
+++ b/deps/npm/docs/output/commands/npm-org.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-org----11190">
+<h1 id="----npm-org----11191">
     <span>npm-org</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage orgs</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-outdated.html b/deps/npm/docs/output/commands/npm-outdated.html
index 5355d7dd09aa..b85880371cdf 100644
--- a/deps/npm/docs/output/commands/npm-outdated.html
+++ b/deps/npm/docs/output/commands/npm-outdated.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-outdated----11190">
+<h1 id="----npm-outdated----11191">
     <span>npm-outdated</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Check for outdated packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-owner.html b/deps/npm/docs/output/commands/npm-owner.html
index 7dc17627f50a..6b8afff7ba36 100644
--- a/deps/npm/docs/output/commands/npm-owner.html
+++ b/deps/npm/docs/output/commands/npm-owner.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-owner----11190">
+<h1 id="----npm-owner----11191">
     <span>npm-owner</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage package owners</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-pack.html b/deps/npm/docs/output/commands/npm-pack.html
index 3f92c3ff7579..d7f148d92ed7 100644
--- a/deps/npm/docs/output/commands/npm-pack.html
+++ b/deps/npm/docs/output/commands/npm-pack.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-pack----11190">
+<h1 id="----npm-pack----11191">
     <span>npm-pack</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Create a tarball from a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ping.html b/deps/npm/docs/output/commands/npm-ping.html
index 84d634064212..3c49a0713166 100644
--- a/deps/npm/docs/output/commands/npm-ping.html
+++ b/deps/npm/docs/output/commands/npm-ping.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ping----11190">
+<h1 id="----npm-ping----11191">
     <span>npm-ping</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Ping npm registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-pkg.html b/deps/npm/docs/output/commands/npm-pkg.html
index cf995cca7679..d80ac21f9af3 100644
--- a/deps/npm/docs/output/commands/npm-pkg.html
+++ b/deps/npm/docs/output/commands/npm-pkg.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-pkg----11190">
+<h1 id="----npm-pkg----11191">
     <span>npm-pkg</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manages your package.json</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-prefix.html b/deps/npm/docs/output/commands/npm-prefix.html
index 0336ac659020..1592a1d3048d 100644
--- a/deps/npm/docs/output/commands/npm-prefix.html
+++ b/deps/npm/docs/output/commands/npm-prefix.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-prefix----11190">
+<h1 id="----npm-prefix----11191">
     <span>npm-prefix</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display prefix</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-profile.html b/deps/npm/docs/output/commands/npm-profile.html
index 8c0d0a337c8c..24f5db6d7f37 100644
--- a/deps/npm/docs/output/commands/npm-profile.html
+++ b/deps/npm/docs/output/commands/npm-profile.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-profile----11190">
+<h1 id="----npm-profile----11191">
     <span>npm-profile</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Change settings on your registry profile</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-prune.html b/deps/npm/docs/output/commands/npm-prune.html
index d340e0fd84a6..736620c0a24a 100644
--- a/deps/npm/docs/output/commands/npm-prune.html
+++ b/deps/npm/docs/output/commands/npm-prune.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-prune----11190">
+<h1 id="----npm-prune----11191">
     <span>npm-prune</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove extraneous packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-publish.html b/deps/npm/docs/output/commands/npm-publish.html
index d1ee0efa5d16..a20d56b8d10e 100644
--- a/deps/npm/docs/output/commands/npm-publish.html
+++ b/deps/npm/docs/output/commands/npm-publish.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-publish----11190">
+<h1 id="----npm-publish----11191">
     <span>npm-publish</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Publish a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-query.html b/deps/npm/docs/output/commands/npm-query.html
index a8347390a34a..a74342cf2782 100644
--- a/deps/npm/docs/output/commands/npm-query.html
+++ b/deps/npm/docs/output/commands/npm-query.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-query----11190">
+<h1 id="----npm-query----11191">
     <span>npm-query</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Dependency selector query</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-rebuild.html b/deps/npm/docs/output/commands/npm-rebuild.html
index 8c2277d8a914..39403a70941d 100644
--- a/deps/npm/docs/output/commands/npm-rebuild.html
+++ b/deps/npm/docs/output/commands/npm-rebuild.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-rebuild----11190">
+<h1 id="----npm-rebuild----11191">
     <span>npm-rebuild</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Rebuild a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-repo.html b/deps/npm/docs/output/commands/npm-repo.html
index b60cd8bc1ddd..5337679c8248 100644
--- a/deps/npm/docs/output/commands/npm-repo.html
+++ b/deps/npm/docs/output/commands/npm-repo.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-repo----11190">
+<h1 id="----npm-repo----11191">
     <span>npm-repo</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Open package repository page in the browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-restart.html b/deps/npm/docs/output/commands/npm-restart.html
index 960530ad2975..0786bdc34a54 100644
--- a/deps/npm/docs/output/commands/npm-restart.html
+++ b/deps/npm/docs/output/commands/npm-restart.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-restart----11190">
+<h1 id="----npm-restart----11191">
     <span>npm-restart</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Restart a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-root.html b/deps/npm/docs/output/commands/npm-root.html
index b5ad8c5c1389..165223c6fdb6 100644
--- a/deps/npm/docs/output/commands/npm-root.html
+++ b/deps/npm/docs/output/commands/npm-root.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-root----11190">
+<h1 id="----npm-root----11191">
     <span>npm-root</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display npm root</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-run.html b/deps/npm/docs/output/commands/npm-run.html
index 985df67fddef..15ca998eb8a8 100644
--- a/deps/npm/docs/output/commands/npm-run.html
+++ b/deps/npm/docs/output/commands/npm-run.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-run----11190">
+<h1 id="----npm-run----11191">
     <span>npm-run</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run arbitrary package scripts</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-sbom.html b/deps/npm/docs/output/commands/npm-sbom.html
index db72c21adc4f..fe84c36327a6 100644
--- a/deps/npm/docs/output/commands/npm-sbom.html
+++ b/deps/npm/docs/output/commands/npm-sbom.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-sbom----11190">
+<h1 id="----npm-sbom----11191">
     <span>npm-sbom</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Generate a Software Bill of Materials (SBOM)</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-search.html b/deps/npm/docs/output/commands/npm-search.html
index f4764833e25a..98006e7d2253 100644
--- a/deps/npm/docs/output/commands/npm-search.html
+++ b/deps/npm/docs/output/commands/npm-search.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-search----11190">
+<h1 id="----npm-search----11191">
     <span>npm-search</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Search for packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-set.html b/deps/npm/docs/output/commands/npm-set.html
index d0fe94ba7e98..6202cdf7b3cd 100644
--- a/deps/npm/docs/output/commands/npm-set.html
+++ b/deps/npm/docs/output/commands/npm-set.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-set----11190">
+<h1 id="----npm-set----11191">
     <span>npm-set</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Set a value in the npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-shrinkwrap.html b/deps/npm/docs/output/commands/npm-shrinkwrap.html
index 85fb2b99986f..abb9c216e6da 100644
--- a/deps/npm/docs/output/commands/npm-shrinkwrap.html
+++ b/deps/npm/docs/output/commands/npm-shrinkwrap.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-shrinkwrap----11190">
+<h1 id="----npm-shrinkwrap----11191">
     <span>npm-shrinkwrap</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Lock down dependency versions for publication</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stage.html b/deps/npm/docs/output/commands/npm-stage.html
index 225d4970fad3..74c4f7acddf0 100644
--- a/deps/npm/docs/output/commands/npm-stage.html
+++ b/deps/npm/docs/output/commands/npm-stage.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stage----11190">
+<h1 id="----npm-stage----11191">
     <span>npm-stage</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Stage packages for publishing</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-star.html b/deps/npm/docs/output/commands/npm-star.html
index 5521c413462c..4ba2f61b1797 100644
--- a/deps/npm/docs/output/commands/npm-star.html
+++ b/deps/npm/docs/output/commands/npm-star.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-star----11190">
+<h1 id="----npm-star----11191">
     <span>npm-star</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Mark your favorite packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stars.html b/deps/npm/docs/output/commands/npm-stars.html
index 9f497020875d..a1c7c0a4fd9d 100644
--- a/deps/npm/docs/output/commands/npm-stars.html
+++ b/deps/npm/docs/output/commands/npm-stars.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stars----11190">
+<h1 id="----npm-stars----11191">
     <span>npm-stars</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">View packages marked as favorites</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-start.html b/deps/npm/docs/output/commands/npm-start.html
index 4a6ec9e7e2c8..063ac6b3d809 100644
--- a/deps/npm/docs/output/commands/npm-start.html
+++ b/deps/npm/docs/output/commands/npm-start.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-start----11190">
+<h1 id="----npm-start----11191">
     <span>npm-start</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Start a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stop.html b/deps/npm/docs/output/commands/npm-stop.html
index 243f702c961e..b4e84d2488de 100644
--- a/deps/npm/docs/output/commands/npm-stop.html
+++ b/deps/npm/docs/output/commands/npm-stop.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stop----11190">
+<h1 id="----npm-stop----11191">
     <span>npm-stop</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Stop a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-team.html b/deps/npm/docs/output/commands/npm-team.html
index 0baf06db4b1a..c9a7504b91fa 100644
--- a/deps/npm/docs/output/commands/npm-team.html
+++ b/deps/npm/docs/output/commands/npm-team.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-team----11190">
+<h1 id="----npm-team----11191">
     <span>npm-team</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage organization teams and team memberships</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-test.html b/deps/npm/docs/output/commands/npm-test.html
index 2d46aafd0b14..bbb30678ba8c 100644
--- a/deps/npm/docs/output/commands/npm-test.html
+++ b/deps/npm/docs/output/commands/npm-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-test----11190">
+<h1 id="----npm-test----11191">
     <span>npm-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Test a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-token.html b/deps/npm/docs/output/commands/npm-token.html
index 58a528ce2180..680c2aa534f8 100644
--- a/deps/npm/docs/output/commands/npm-token.html
+++ b/deps/npm/docs/output/commands/npm-token.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-token----11190">
+<h1 id="----npm-token----11191">
     <span>npm-token</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage your authentication tokens</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-trust.html b/deps/npm/docs/output/commands/npm-trust.html
index 429e22957b18..6d531484035c 100644
--- a/deps/npm/docs/output/commands/npm-trust.html
+++ b/deps/npm/docs/output/commands/npm-trust.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-trust----11190">
+<h1 id="----npm-trust----11191">
     <span>npm-trust</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage trusted publishing relationships between packages and CI/CD providers</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-undeprecate.html b/deps/npm/docs/output/commands/npm-undeprecate.html
index 67b6d048c079..d5239ca0cac0 100644
--- a/deps/npm/docs/output/commands/npm-undeprecate.html
+++ b/deps/npm/docs/output/commands/npm-undeprecate.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-undeprecate----11190">
+<h1 id="----npm-undeprecate----11191">
     <span>npm-undeprecate</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Undeprecate a version of a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-uninstall.html b/deps/npm/docs/output/commands/npm-uninstall.html
index 8197d3646c62..26991d034bd4 100644
--- a/deps/npm/docs/output/commands/npm-uninstall.html
+++ b/deps/npm/docs/output/commands/npm-uninstall.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-uninstall----11190">
+<h1 id="----npm-uninstall----11191">
     <span>npm-uninstall</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-unpublish.html b/deps/npm/docs/output/commands/npm-unpublish.html
index 21b698cad72e..4fda332a9615 100644
--- a/deps/npm/docs/output/commands/npm-unpublish.html
+++ b/deps/npm/docs/output/commands/npm-unpublish.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-unpublish----11190">
+<h1 id="----npm-unpublish----11191">
     <span>npm-unpublish</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove a package from the registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-unstar.html b/deps/npm/docs/output/commands/npm-unstar.html
index 2564643c7435..25db54715ddb 100644
--- a/deps/npm/docs/output/commands/npm-unstar.html
+++ b/deps/npm/docs/output/commands/npm-unstar.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-unstar----11190">
+<h1 id="----npm-unstar----11191">
     <span>npm-unstar</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove an item from your favorite packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-update.html b/deps/npm/docs/output/commands/npm-update.html
index c89bc400aa3c..fff2f70073cd 100644
--- a/deps/npm/docs/output/commands/npm-update.html
+++ b/deps/npm/docs/output/commands/npm-update.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-update----11190">
+<h1 id="----npm-update----11191">
     <span>npm-update</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Update packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-version.html b/deps/npm/docs/output/commands/npm-version.html
index 2cb36d263256..310abe5db903 100644
--- a/deps/npm/docs/output/commands/npm-version.html
+++ b/deps/npm/docs/output/commands/npm-version.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-version----11190">
+<h1 id="----npm-version----11191">
     <span>npm-version</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Bump a package version</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-view.html b/deps/npm/docs/output/commands/npm-view.html
index 2356b4e79166..18f28fe17077 100644
--- a/deps/npm/docs/output/commands/npm-view.html
+++ b/deps/npm/docs/output/commands/npm-view.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-view----11190">
+<h1 id="----npm-view----11191">
     <span>npm-view</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">View registry info</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-whoami.html b/deps/npm/docs/output/commands/npm-whoami.html
index bd768a237695..91a7d6e2288d 100644
--- a/deps/npm/docs/output/commands/npm-whoami.html
+++ b/deps/npm/docs/output/commands/npm-whoami.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-whoami----11190">
+<h1 id="----npm-whoami----11191">
     <span>npm-whoami</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display npm username</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm.html b/deps/npm/docs/output/commands/npm.html
index cc749dc6e59a..99674e1362df 100644
--- a/deps/npm/docs/output/commands/npm.html
+++ b/deps/npm/docs/output/commands/npm.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm----11190">
+<h1 id="----npm----11191">
     <span>npm</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">javascript package manager</span>
 </header>
@@ -203,7 +203,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 </code></pre>
 <p>Note: This command is unaware of workspaces.</p>
 <h3 id="version">Version</h3>
-<p>11.19.0</p>
+<p>11.19.1</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.
 It puts modules in place so that node can find them, and manages dependency conflicts intelligently.</p>
diff --git a/deps/npm/docs/output/commands/npx.html b/deps/npm/docs/output/commands/npx.html
index 8abb0349d715..d3cb1e00cc5b 100644
--- a/deps/npm/docs/output/commands/npx.html
+++ b/deps/npm/docs/output/commands/npx.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npx----11190">
+<h1 id="----npx----11191">
     <span>npx</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a command from a local or remote npm package</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/folders.html b/deps/npm/docs/output/configuring-npm/folders.html
index 7b04e59dbed2..3e86bf9a9ee5 100644
--- a/deps/npm/docs/output/configuring-npm/folders.html
+++ b/deps/npm/docs/output/configuring-npm/folders.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----folders----11190">
+<h1 id="----folders----11191">
     <span>Folders</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Folder structures used by npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/install.html b/deps/npm/docs/output/configuring-npm/install.html
index d607ef84697b..610fc057a134 100644
--- a/deps/npm/docs/output/configuring-npm/install.html
+++ b/deps/npm/docs/output/configuring-npm/install.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----install----11190">
+<h1 id="----install----11191">
     <span>Install</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Download and install node and npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-global.html b/deps/npm/docs/output/configuring-npm/npm-global.html
index 7b04e59dbed2..3e86bf9a9ee5 100644
--- a/deps/npm/docs/output/configuring-npm/npm-global.html
+++ b/deps/npm/docs/output/configuring-npm/npm-global.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----folders----11190">
+<h1 id="----folders----11191">
     <span>Folders</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Folder structures used by npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-json.html b/deps/npm/docs/output/configuring-npm/npm-json.html
index 0cdb967a8c34..97a03a6d6175 100644
--- a/deps/npm/docs/output/configuring-npm/npm-json.html
+++ b/deps/npm/docs/output/configuring-npm/npm-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----packagejson----11190">
+<h1 id="----packagejson----11191">
     <span>package.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Specifics of npm's package.json handling</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html b/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
index f26ba837f409..134524b16af6 100644
--- a/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
+++ b/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-shrinkwrapjson----11190">
+<h1 id="----npm-shrinkwrapjson----11191">
     <span>npm-shrinkwrap.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">A publishable lockfile</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npmrc.html b/deps/npm/docs/output/configuring-npm/npmrc.html
index 6e88197b3fbf..a5eb291b57ca 100644
--- a/deps/npm/docs/output/configuring-npm/npmrc.html
+++ b/deps/npm/docs/output/configuring-npm/npmrc.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npmrc----11190">
+<h1 id="----npmrc----11191">
     <span>.npmrc</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The npm config files</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/package-json.html b/deps/npm/docs/output/configuring-npm/package-json.html
index 0cdb967a8c34..97a03a6d6175 100644
--- a/deps/npm/docs/output/configuring-npm/package-json.html
+++ b/deps/npm/docs/output/configuring-npm/package-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----packagejson----11190">
+<h1 id="----packagejson----11191">
     <span>package.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Specifics of npm's package.json handling</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/package-lock-json.html b/deps/npm/docs/output/configuring-npm/package-lock-json.html
index 68476b2f14e4..9a4f1631b337 100644
--- a/deps/npm/docs/output/configuring-npm/package-lock-json.html
+++ b/deps/npm/docs/output/configuring-npm/package-lock-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----package-lockjson----11190">
+<h1 id="----package-lockjson----11191">
     <span>package-lock.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">A manifestation of the manifest</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/config.html b/deps/npm/docs/output/using-npm/config.html
index 9d288a3a2e86..ac5829fba75d 100644
--- a/deps/npm/docs/output/using-npm/config.html
+++ b/deps/npm/docs/output/using-npm/config.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----config----11190">
+<h1 id="----config----11191">
     <span>Config</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">About npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/dependency-selectors.html b/deps/npm/docs/output/using-npm/dependency-selectors.html
index 80acfdd6ea80..c56b5e6c4027 100644
--- a/deps/npm/docs/output/using-npm/dependency-selectors.html
+++ b/deps/npm/docs/output/using-npm/dependency-selectors.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----dependency-selectors----11190">
+<h1 id="----dependency-selectors----11191">
     <span>Dependency Selectors</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Dependency Selector Syntax &amp; Querying</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/developers.html b/deps/npm/docs/output/using-npm/developers.html
index 5457f4a7943b..984f28bfe7b2 100644
--- a/deps/npm/docs/output/using-npm/developers.html
+++ b/deps/npm/docs/output/using-npm/developers.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----developers----11190">
+<h1 id="----developers----11191">
     <span>Developers</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Developer guide</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/logging.html b/deps/npm/docs/output/using-npm/logging.html
index 62b819e82646..f6f6dd742f12 100644
--- a/deps/npm/docs/output/using-npm/logging.html
+++ b/deps/npm/docs/output/using-npm/logging.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----logging----11190">
+<h1 id="----logging----11191">
     <span>Logging</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Why, What &amp; How we Log</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/orgs.html b/deps/npm/docs/output/using-npm/orgs.html
index 39559c361b78..f579fcbbac1f 100644
--- a/deps/npm/docs/output/using-npm/orgs.html
+++ b/deps/npm/docs/output/using-npm/orgs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----organizations----11190">
+<h1 id="----organizations----11191">
     <span>Organizations</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Working with teams &amp; organizations</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/package-spec.html b/deps/npm/docs/output/using-npm/package-spec.html
index 82b8d1d9ad2e..620f470d109b 100644
--- a/deps/npm/docs/output/using-npm/package-spec.html
+++ b/deps/npm/docs/output/using-npm/package-spec.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----package-spec----11190">
+<h1 id="----package-spec----11191">
     <span>Package spec</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Package name specifier</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/registry.html b/deps/npm/docs/output/using-npm/registry.html
index b3d34df82033..e61715c22e4b 100644
--- a/deps/npm/docs/output/using-npm/registry.html
+++ b/deps/npm/docs/output/using-npm/registry.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----registry----11190">
+<h1 id="----registry----11191">
     <span>Registry</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The JavaScript Package Registry</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/removal.html b/deps/npm/docs/output/using-npm/removal.html
index b85ee02590cc..07ee6c06bc40 100644
--- a/deps/npm/docs/output/using-npm/removal.html
+++ b/deps/npm/docs/output/using-npm/removal.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----removal----11190">
+<h1 id="----removal----11191">
     <span>Removal</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Cleaning the slate</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/scope.html b/deps/npm/docs/output/using-npm/scope.html
index f2e733bc9ebf..a08571ebfda3 100644
--- a/deps/npm/docs/output/using-npm/scope.html
+++ b/deps/npm/docs/output/using-npm/scope.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----scope----11190">
+<h1 id="----scope----11191">
     <span>Scope</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Scoped packages</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/scripts.html b/deps/npm/docs/output/using-npm/scripts.html
index c2a9641f62d2..4e852304a114 100644
--- a/deps/npm/docs/output/using-npm/scripts.html
+++ b/deps/npm/docs/output/using-npm/scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----scripts----11190">
+<h1 id="----scripts----11191">
     <span>Scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">How npm handles the "scripts" field</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/workspaces.html b/deps/npm/docs/output/using-npm/workspaces.html
index 3a9986755339..ec3d3abed055 100644
--- a/deps/npm/docs/output/using-npm/workspaces.html
+++ b/deps/npm/docs/output/using-npm/workspaces.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----workspaces----11190">
+<h1 id="----workspaces----11191">
     <span>Workspaces</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Working with workspaces</span>
 </header>
diff --git a/deps/npm/lib/commands/pack.js b/deps/npm/lib/commands/pack.js
index be4a1b240bea..9c4b59657f4a 100644
--- a/deps/npm/lib/commands/pack.js
+++ b/deps/npm/lib/commands/pack.js
@@ -45,6 +45,7 @@ class Pack extends BaseCommand {
       ) ? { ...this.npm.flatOptions, before: null } : this.npm.flatOptions
       const manifest = await pacote.manifest(spec, {
         ...options,
+        ...(spec.type === 'directory' && { allowDirectory: 'all' }),
         Arborist,
         preferOnline: true,
         _isRoot: true,
diff --git a/deps/npm/man/man1/npm-access.1 b/deps/npm/man/man1/npm-access.1
index 3b7d77d8962f..435819623db2 100644
--- a/deps/npm/man/man1/npm-access.1
+++ b/deps/npm/man/man1/npm-access.1
@@ -1,4 +1,4 @@
-.TH "NPM-ACCESS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ACCESS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-access\fR - Set access level on published packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-adduser.1 b/deps/npm/man/man1/npm-adduser.1
index 53ed267a0aa4..5cc628784241 100644
--- a/deps/npm/man/man1/npm-adduser.1
+++ b/deps/npm/man/man1/npm-adduser.1
@@ -1,4 +1,4 @@
-.TH "NPM-ADDUSER" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ADDUSER" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-adduser\fR - Add a registry user account
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-approve-scripts.1 b/deps/npm/man/man1/npm-approve-scripts.1
index 943459b20562..f874e752ab97 100644
--- a/deps/npm/man/man1/npm-approve-scripts.1
+++ b/deps/npm/man/man1/npm-approve-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-APPROVE-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-APPROVE-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-approve-scripts\fR - Approve install scripts for specific dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-audit.1 b/deps/npm/man/man1/npm-audit.1
index 77fbcbe595ef..8c9815292aee 100644
--- a/deps/npm/man/man1/npm-audit.1
+++ b/deps/npm/man/man1/npm-audit.1
@@ -1,4 +1,4 @@
-.TH "NPM-AUDIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-AUDIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-audit\fR - Run a security audit
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-bugs.1 b/deps/npm/man/man1/npm-bugs.1
index 05a37e504c7e..0113cf310fdb 100644
--- a/deps/npm/man/man1/npm-bugs.1
+++ b/deps/npm/man/man1/npm-bugs.1
@@ -1,4 +1,4 @@
-.TH "NPM-BUGS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-BUGS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-bugs\fR - Report bugs for a package in a web browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-cache.1 b/deps/npm/man/man1/npm-cache.1
index fd725dd57fe2..71eaeccf613d 100644
--- a/deps/npm/man/man1/npm-cache.1
+++ b/deps/npm/man/man1/npm-cache.1
@@ -1,4 +1,4 @@
-.TH "NPM-CACHE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CACHE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-cache\fR - Manipulates packages cache
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ci.1 b/deps/npm/man/man1/npm-ci.1
index bbae51d8e983..2e544d6dfa80 100644
--- a/deps/npm/man/man1/npm-ci.1
+++ b/deps/npm/man/man1/npm-ci.1
@@ -1,4 +1,4 @@
-.TH "NPM-CI" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CI" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ci\fR - Clean install a project
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-completion.1 b/deps/npm/man/man1/npm-completion.1
index d01c54ab63af..d5cefe61d0c7 100644
--- a/deps/npm/man/man1/npm-completion.1
+++ b/deps/npm/man/man1/npm-completion.1
@@ -1,4 +1,4 @@
-.TH "NPM-COMPLETION" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-COMPLETION" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-completion\fR - Tab Completion for npm
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-config.1 b/deps/npm/man/man1/npm-config.1
index 34b79e9d1c57..b0ef989fe726 100644
--- a/deps/npm/man/man1/npm-config.1
+++ b/deps/npm/man/man1/npm-config.1
@@ -1,4 +1,4 @@
-.TH "NPM-CONFIG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CONFIG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-config\fR - Manage the npm configuration files
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-dedupe.1 b/deps/npm/man/man1/npm-dedupe.1
index 0b11deb4d467..1fa8e34027fb 100644
--- a/deps/npm/man/man1/npm-dedupe.1
+++ b/deps/npm/man/man1/npm-dedupe.1
@@ -1,4 +1,4 @@
-.TH "NPM-DEDUPE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DEDUPE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-dedupe\fR - Reduce duplication in the package tree
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-deny-scripts.1 b/deps/npm/man/man1/npm-deny-scripts.1
index d8a41f57479e..70fb96d6fcd2 100644
--- a/deps/npm/man/man1/npm-deny-scripts.1
+++ b/deps/npm/man/man1/npm-deny-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-DENY-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DENY-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-deny-scripts\fR - Deny install scripts for specific dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-deprecate.1 b/deps/npm/man/man1/npm-deprecate.1
index c45dd75584ec..e07bd5829ef7 100644
--- a/deps/npm/man/man1/npm-deprecate.1
+++ b/deps/npm/man/man1/npm-deprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM-DEPRECATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DEPRECATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-deprecate\fR - Deprecate a version of a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-diff.1 b/deps/npm/man/man1/npm-diff.1
index 45efb60c236c..42c3903bd468 100644
--- a/deps/npm/man/man1/npm-diff.1
+++ b/deps/npm/man/man1/npm-diff.1
@@ -1,4 +1,4 @@
-.TH "NPM-DIFF" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DIFF" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-diff\fR - The registry diff command
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-dist-tag.1 b/deps/npm/man/man1/npm-dist-tag.1
index 989a2c64d307..8ebc625273cc 100644
--- a/deps/npm/man/man1/npm-dist-tag.1
+++ b/deps/npm/man/man1/npm-dist-tag.1
@@ -1,4 +1,4 @@
-.TH "NPM-DIST-TAG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DIST-TAG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-dist-tag\fR - Modify package distribution tags
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-docs.1 b/deps/npm/man/man1/npm-docs.1
index ee614b710885..26fa80d54d5d 100644
--- a/deps/npm/man/man1/npm-docs.1
+++ b/deps/npm/man/man1/npm-docs.1
@@ -1,4 +1,4 @@
-.TH "NPM-DOCS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DOCS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-docs\fR - Open documentation for a package in a web browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-doctor.1 b/deps/npm/man/man1/npm-doctor.1
index 5344645b17ed..f5b750fd6a3b 100644
--- a/deps/npm/man/man1/npm-doctor.1
+++ b/deps/npm/man/man1/npm-doctor.1
@@ -1,4 +1,4 @@
-.TH "NPM-DOCTOR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DOCTOR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-doctor\fR - Check the health of your npm environment
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-edit.1 b/deps/npm/man/man1/npm-edit.1
index bca15e054f60..5055e6feaa5d 100644
--- a/deps/npm/man/man1/npm-edit.1
+++ b/deps/npm/man/man1/npm-edit.1
@@ -1,4 +1,4 @@
-.TH "NPM-EDIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EDIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-edit\fR - Edit an installed package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-exec.1 b/deps/npm/man/man1/npm-exec.1
index 4b580f484bc1..5ae0a77e2880 100644
--- a/deps/npm/man/man1/npm-exec.1
+++ b/deps/npm/man/man1/npm-exec.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXEC" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXEC" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-exec\fR - Run a command from a local or remote npm package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-explain.1 b/deps/npm/man/man1/npm-explain.1
index 20374a8fbb37..7869082b6c6f 100644
--- a/deps/npm/man/man1/npm-explain.1
+++ b/deps/npm/man/man1/npm-explain.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXPLAIN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXPLAIN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-explain\fR - Explain installed packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-explore.1 b/deps/npm/man/man1/npm-explore.1
index bee110155bd5..df1fd2dc6517 100644
--- a/deps/npm/man/man1/npm-explore.1
+++ b/deps/npm/man/man1/npm-explore.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXPLORE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXPLORE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-explore\fR - Browse an installed package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-find-dupes.1 b/deps/npm/man/man1/npm-find-dupes.1
index a1cfc3abd0d2..f1f3970dd1d7 100644
--- a/deps/npm/man/man1/npm-find-dupes.1
+++ b/deps/npm/man/man1/npm-find-dupes.1
@@ -1,4 +1,4 @@
-.TH "NPM-FIND-DUPES" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-FIND-DUPES" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-find-dupes\fR - Find duplication in the package tree
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-fund.1 b/deps/npm/man/man1/npm-fund.1
index ec516b28396d..88bfe299c31f 100644
--- a/deps/npm/man/man1/npm-fund.1
+++ b/deps/npm/man/man1/npm-fund.1
@@ -1,4 +1,4 @@
-.TH "NPM-FUND" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-FUND" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-fund\fR - Retrieve funding information
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-get.1 b/deps/npm/man/man1/npm-get.1
index d4763eb28c8c..7982d28e324a 100644
--- a/deps/npm/man/man1/npm-get.1
+++ b/deps/npm/man/man1/npm-get.1
@@ -1,4 +1,4 @@
-.TH "NPM-GET" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-GET" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-get\fR - Get a value from the npm configuration
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-help-search.1 b/deps/npm/man/man1/npm-help-search.1
index 63213fa4188a..e7c7d97ebcea 100644
--- a/deps/npm/man/man1/npm-help-search.1
+++ b/deps/npm/man/man1/npm-help-search.1
@@ -1,4 +1,4 @@
-.TH "NPM-HELP-SEARCH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-HELP-SEARCH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-help-search\fR - Search npm help documentation
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-help.1 b/deps/npm/man/man1/npm-help.1
index 59f2f1df9436..7725a82d09c1 100644
--- a/deps/npm/man/man1/npm-help.1
+++ b/deps/npm/man/man1/npm-help.1
@@ -1,4 +1,4 @@
-.TH "NPM-HELP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-HELP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-help\fR - Get help on npm
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-init.1 b/deps/npm/man/man1/npm-init.1
index cf4c37761d14..bd984db7d203 100644
--- a/deps/npm/man/man1/npm-init.1
+++ b/deps/npm/man/man1/npm-init.1
@@ -1,4 +1,4 @@
-.TH "NPM-INIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-init\fR - Create a package.json file
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-ci-test.1 b/deps/npm/man/man1/npm-install-ci-test.1
index e30140015a1c..b477b4a8b0eb 100644
--- a/deps/npm/man/man1/npm-install-ci-test.1
+++ b/deps/npm/man/man1/npm-install-ci-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-CI-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-CI-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-ci-test\fR - Install a project with a clean slate and run tests
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-scripts.1 b/deps/npm/man/man1/npm-install-scripts.1
index 907b48c50ff5..b634903e3ecc 100644
--- a/deps/npm/man/man1/npm-install-scripts.1
+++ b/deps/npm/man/man1/npm-install-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-scripts\fR - Manage install-script approvals for dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-test.1 b/deps/npm/man/man1/npm-install-test.1
index 88e0ed187377..d6774940ea2f 100644
--- a/deps/npm/man/man1/npm-install-test.1
+++ b/deps/npm/man/man1/npm-install-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-test\fR - Install package(s) and run tests
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install.1 b/deps/npm/man/man1/npm-install.1
index b1ccd245238d..c6ca10ab642c 100644
--- a/deps/npm/man/man1/npm-install.1
+++ b/deps/npm/man/man1/npm-install.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install\fR - Install a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-link.1 b/deps/npm/man/man1/npm-link.1
index d124bcf66a33..ea482b872b86 100644
--- a/deps/npm/man/man1/npm-link.1
+++ b/deps/npm/man/man1/npm-link.1
@@ -1,4 +1,4 @@
-.TH "NPM-LINK" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LINK" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-link\fR - Symlink a package folder
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ll.1 b/deps/npm/man/man1/npm-ll.1
index 982d8ee3a6c7..136777491e0f 100644
--- a/deps/npm/man/man1/npm-ll.1
+++ b/deps/npm/man/man1/npm-ll.1
@@ -1,4 +1,4 @@
-.TH "NPM-LL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ll\fR - List installed packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-login.1 b/deps/npm/man/man1/npm-login.1
index 392c5b25d84d..ecc47d745dee 100644
--- a/deps/npm/man/man1/npm-login.1
+++ b/deps/npm/man/man1/npm-login.1
@@ -1,4 +1,4 @@
-.TH "NPM-LOGIN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LOGIN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-login\fR - Login to a registry user account
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-logout.1 b/deps/npm/man/man1/npm-logout.1
index 7ca6be27366c..22d86e96586e 100644
--- a/deps/npm/man/man1/npm-logout.1
+++ b/deps/npm/man/man1/npm-logout.1
@@ -1,4 +1,4 @@
-.TH "NPM-LOGOUT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LOGOUT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-logout\fR - Log out of the registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ls.1 b/deps/npm/man/man1/npm-ls.1
index 6fe6245988fe..52224d908c20 100644
--- a/deps/npm/man/man1/npm-ls.1
+++ b/deps/npm/man/man1/npm-ls.1
@@ -1,4 +1,4 @@
-.TH "NPM-LS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ls\fR - List installed packages
 .SS "Synopsis"
@@ -20,7 +20,7 @@ Positional arguments are \fBname@version-range\fR identifiers, which will limit
 .P
 .RS 2
 .nf
-npm@11.19.0 /path/to/npm
+npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 .fi
diff --git a/deps/npm/man/man1/npm-org.1 b/deps/npm/man/man1/npm-org.1
index 50e94a589d49..4b7592722da4 100644
--- a/deps/npm/man/man1/npm-org.1
+++ b/deps/npm/man/man1/npm-org.1
@@ -1,4 +1,4 @@
-.TH "NPM-ORG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ORG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-org\fR - Manage orgs
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-outdated.1 b/deps/npm/man/man1/npm-outdated.1
index a2ecbcc50b5c..f83acac0d642 100644
--- a/deps/npm/man/man1/npm-outdated.1
+++ b/deps/npm/man/man1/npm-outdated.1
@@ -1,4 +1,4 @@
-.TH "NPM-OUTDATED" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-OUTDATED" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-outdated\fR - Check for outdated packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-owner.1 b/deps/npm/man/man1/npm-owner.1
index 3815d60d8b2b..68a98e734ef5 100644
--- a/deps/npm/man/man1/npm-owner.1
+++ b/deps/npm/man/man1/npm-owner.1
@@ -1,4 +1,4 @@
-.TH "NPM-OWNER" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-OWNER" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-owner\fR - Manage package owners
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-pack.1 b/deps/npm/man/man1/npm-pack.1
index f5f159779bdc..58b82df26634 100644
--- a/deps/npm/man/man1/npm-pack.1
+++ b/deps/npm/man/man1/npm-pack.1
@@ -1,4 +1,4 @@
-.TH "NPM-PACK" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PACK" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-pack\fR - Create a tarball from a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ping.1 b/deps/npm/man/man1/npm-ping.1
index e44d02e67e88..4df93fbd993a 100644
--- a/deps/npm/man/man1/npm-ping.1
+++ b/deps/npm/man/man1/npm-ping.1
@@ -1,4 +1,4 @@
-.TH "NPM-PING" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PING" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ping\fR - Ping npm registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-pkg.1 b/deps/npm/man/man1/npm-pkg.1
index ad4adfa8c654..ad11f73873aa 100644
--- a/deps/npm/man/man1/npm-pkg.1
+++ b/deps/npm/man/man1/npm-pkg.1
@@ -1,4 +1,4 @@
-.TH "NPM-PKG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PKG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-pkg\fR - Manages your package.json
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-prefix.1 b/deps/npm/man/man1/npm-prefix.1
index a810bc8c0140..6c990176088b 100644
--- a/deps/npm/man/man1/npm-prefix.1
+++ b/deps/npm/man/man1/npm-prefix.1
@@ -1,4 +1,4 @@
-.TH "NPM-PREFIX" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PREFIX" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-prefix\fR - Display prefix
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-profile.1 b/deps/npm/man/man1/npm-profile.1
index 0593fa483958..0d5d54620f73 100644
--- a/deps/npm/man/man1/npm-profile.1
+++ b/deps/npm/man/man1/npm-profile.1
@@ -1,4 +1,4 @@
-.TH "NPM-PROFILE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PROFILE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-profile\fR - Change settings on your registry profile
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-prune.1 b/deps/npm/man/man1/npm-prune.1
index c62e7d6bd395..8f67ca9384f8 100644
--- a/deps/npm/man/man1/npm-prune.1
+++ b/deps/npm/man/man1/npm-prune.1
@@ -1,4 +1,4 @@
-.TH "NPM-PRUNE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PRUNE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-prune\fR - Remove extraneous packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-publish.1 b/deps/npm/man/man1/npm-publish.1
index 62676301d5ab..4e738ab0bbd7 100644
--- a/deps/npm/man/man1/npm-publish.1
+++ b/deps/npm/man/man1/npm-publish.1
@@ -1,4 +1,4 @@
-.TH "NPM-PUBLISH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PUBLISH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-publish\fR - Publish a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-query.1 b/deps/npm/man/man1/npm-query.1
index 3ca4eb1b659f..334fc20660e4 100644
--- a/deps/npm/man/man1/npm-query.1
+++ b/deps/npm/man/man1/npm-query.1
@@ -1,4 +1,4 @@
-.TH "NPM-QUERY" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-QUERY" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-query\fR - Dependency selector query
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-rebuild.1 b/deps/npm/man/man1/npm-rebuild.1
index b0710049573e..6a09726529b4 100644
--- a/deps/npm/man/man1/npm-rebuild.1
+++ b/deps/npm/man/man1/npm-rebuild.1
@@ -1,4 +1,4 @@
-.TH "NPM-REBUILD" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-REBUILD" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-rebuild\fR - Rebuild a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-repo.1 b/deps/npm/man/man1/npm-repo.1
index 46fdc0cb111e..5ff08e9eeb4d 100644
--- a/deps/npm/man/man1/npm-repo.1
+++ b/deps/npm/man/man1/npm-repo.1
@@ -1,4 +1,4 @@
-.TH "NPM-REPO" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-REPO" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-repo\fR - Open package repository page in the browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-restart.1 b/deps/npm/man/man1/npm-restart.1
index b552a5e2a86a..d4f5f0d3df1f 100644
--- a/deps/npm/man/man1/npm-restart.1
+++ b/deps/npm/man/man1/npm-restart.1
@@ -1,4 +1,4 @@
-.TH "NPM-RESTART" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-RESTART" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-restart\fR - Restart a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-root.1 b/deps/npm/man/man1/npm-root.1
index 9d701e336bff..ecd0c64ef6bb 100644
--- a/deps/npm/man/man1/npm-root.1
+++ b/deps/npm/man/man1/npm-root.1
@@ -1,4 +1,4 @@
-.TH "NPM-ROOT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ROOT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-root\fR - Display npm root
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-run.1 b/deps/npm/man/man1/npm-run.1
index 185111dbafbb..8aadcceff7c1 100644
--- a/deps/npm/man/man1/npm-run.1
+++ b/deps/npm/man/man1/npm-run.1
@@ -1,4 +1,4 @@
-.TH "NPM-RUN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-RUN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-run\fR - Run arbitrary package scripts
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-sbom.1 b/deps/npm/man/man1/npm-sbom.1
index a8a74f9e02c6..f694d642f9ad 100644
--- a/deps/npm/man/man1/npm-sbom.1
+++ b/deps/npm/man/man1/npm-sbom.1
@@ -1,4 +1,4 @@
-.TH "NPM-SBOM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SBOM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-sbom\fR - Generate a Software Bill of Materials (SBOM)
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-search.1 b/deps/npm/man/man1/npm-search.1
index 2a0fbbc58709..969d0e784902 100644
--- a/deps/npm/man/man1/npm-search.1
+++ b/deps/npm/man/man1/npm-search.1
@@ -1,4 +1,4 @@
-.TH "NPM-SEARCH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SEARCH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-search\fR - Search for packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-set.1 b/deps/npm/man/man1/npm-set.1
index 4333006b47ff..4deaf8e01aca 100644
--- a/deps/npm/man/man1/npm-set.1
+++ b/deps/npm/man/man1/npm-set.1
@@ -1,4 +1,4 @@
-.TH "NPM-SET" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SET" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-set\fR - Set a value in the npm configuration
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-shrinkwrap.1 b/deps/npm/man/man1/npm-shrinkwrap.1
index 0fc20a6ccaeb..35caa20c3dc0 100644
--- a/deps/npm/man/man1/npm-shrinkwrap.1
+++ b/deps/npm/man/man1/npm-shrinkwrap.1
@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SHRINKWRAP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-shrinkwrap\fR - Lock down dependency versions for publication
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stage.1 b/deps/npm/man/man1/npm-stage.1
index 9a677ba6b03e..8c2016052130 100644
--- a/deps/npm/man/man1/npm-stage.1
+++ b/deps/npm/man/man1/npm-stage.1
@@ -1,4 +1,4 @@
-.TH "NPM-STAGE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STAGE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stage\fR - Stage packages for publishing
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-star.1 b/deps/npm/man/man1/npm-star.1
index dbabe90b0bd6..a2191c120e35 100644
--- a/deps/npm/man/man1/npm-star.1
+++ b/deps/npm/man/man1/npm-star.1
@@ -1,4 +1,4 @@
-.TH "NPM-STAR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STAR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-star\fR - Mark your favorite packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stars.1 b/deps/npm/man/man1/npm-stars.1
index 2999dd8abbf0..aca98ed914a5 100644
--- a/deps/npm/man/man1/npm-stars.1
+++ b/deps/npm/man/man1/npm-stars.1
@@ -1,4 +1,4 @@
-.TH "NPM-STARS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STARS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stars\fR - View packages marked as favorites
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-start.1 b/deps/npm/man/man1/npm-start.1
index c8966bd38a68..d2f3b4d87cc8 100644
--- a/deps/npm/man/man1/npm-start.1
+++ b/deps/npm/man/man1/npm-start.1
@@ -1,4 +1,4 @@
-.TH "NPM-START" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-START" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-start\fR - Start a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stop.1 b/deps/npm/man/man1/npm-stop.1
index c900d58437f5..7896dd6acd17 100644
--- a/deps/npm/man/man1/npm-stop.1
+++ b/deps/npm/man/man1/npm-stop.1
@@ -1,4 +1,4 @@
-.TH "NPM-STOP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STOP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stop\fR - Stop a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-team.1 b/deps/npm/man/man1/npm-team.1
index 4de50f8c6b06..21ccc530ad81 100644
--- a/deps/npm/man/man1/npm-team.1
+++ b/deps/npm/man/man1/npm-team.1
@@ -1,4 +1,4 @@
-.TH "NPM-TEAM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TEAM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-team\fR - Manage organization teams and team memberships
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-test.1 b/deps/npm/man/man1/npm-test.1
index 311ba399498b..8cae879d8291 100644
--- a/deps/npm/man/man1/npm-test.1
+++ b/deps/npm/man/man1/npm-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-test\fR - Test a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-token.1 b/deps/npm/man/man1/npm-token.1
index 4b1cbae98b24..fc82daf8d0cf 100644
--- a/deps/npm/man/man1/npm-token.1
+++ b/deps/npm/man/man1/npm-token.1
@@ -1,4 +1,4 @@
-.TH "NPM-TOKEN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TOKEN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-token\fR - Manage your authentication tokens
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-trust.1 b/deps/npm/man/man1/npm-trust.1
index f8de6022c0f0..fce69eb33b75 100644
--- a/deps/npm/man/man1/npm-trust.1
+++ b/deps/npm/man/man1/npm-trust.1
@@ -1,4 +1,4 @@
-.TH "NPM-TRUST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TRUST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-trust\fR - Manage trusted publishing relationships between packages and CI/CD providers
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-undeprecate.1 b/deps/npm/man/man1/npm-undeprecate.1
index 1a26688b4530..11f91ee9b913 100644
--- a/deps/npm/man/man1/npm-undeprecate.1
+++ b/deps/npm/man/man1/npm-undeprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNDEPRECATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNDEPRECATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-undeprecate\fR - Undeprecate a version of a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-uninstall.1 b/deps/npm/man/man1/npm-uninstall.1
index 39791e588e7e..b9ff997229dc 100644
--- a/deps/npm/man/man1/npm-uninstall.1
+++ b/deps/npm/man/man1/npm-uninstall.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNINSTALL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNINSTALL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-uninstall\fR - Remove a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-unpublish.1 b/deps/npm/man/man1/npm-unpublish.1
index f839376efe0f..5bbb86e8c8f3 100644
--- a/deps/npm/man/man1/npm-unpublish.1
+++ b/deps/npm/man/man1/npm-unpublish.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNPUBLISH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNPUBLISH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-unpublish\fR - Remove a package from the registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-unstar.1 b/deps/npm/man/man1/npm-unstar.1
index 555868c3fb68..0d0e2f2c9e6a 100644
--- a/deps/npm/man/man1/npm-unstar.1
+++ b/deps/npm/man/man1/npm-unstar.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNSTAR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNSTAR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-unstar\fR - Remove an item from your favorite packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-update.1 b/deps/npm/man/man1/npm-update.1
index 55b4191e801b..4f5e015b20d7 100644
--- a/deps/npm/man/man1/npm-update.1
+++ b/deps/npm/man/man1/npm-update.1
@@ -1,4 +1,4 @@
-.TH "NPM-UPDATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UPDATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-update\fR - Update packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-version.1 b/deps/npm/man/man1/npm-version.1
index fd261b5cd42a..c15a0d19acfa 100644
--- a/deps/npm/man/man1/npm-version.1
+++ b/deps/npm/man/man1/npm-version.1
@@ -1,4 +1,4 @@
-.TH "NPM-VERSION" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-VERSION" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-version\fR - Bump a package version
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-view.1 b/deps/npm/man/man1/npm-view.1
index a150ce2d979d..b9210c424cd2 100644
--- a/deps/npm/man/man1/npm-view.1
+++ b/deps/npm/man/man1/npm-view.1
@@ -1,4 +1,4 @@
-.TH "NPM-VIEW" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-VIEW" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-view\fR - View registry info
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-whoami.1 b/deps/npm/man/man1/npm-whoami.1
index 920d19146bd3..5d44c35a7f48 100644
--- a/deps/npm/man/man1/npm-whoami.1
+++ b/deps/npm/man/man1/npm-whoami.1
@@ -1,4 +1,4 @@
-.TH "NPM-WHOAMI" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-WHOAMI" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-whoami\fR - Display npm username
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm.1 b/deps/npm/man/man1/npm.1
index 9791f5f274f5..25a9e19288c9 100644
--- a/deps/npm/man/man1/npm.1
+++ b/deps/npm/man/man1/npm.1
@@ -1,4 +1,4 @@
-.TH "NPM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm\fR - javascript package manager
 .SS "Synopsis"
@@ -12,7 +12,7 @@ npm
 Note: This command is unaware of workspaces.
 .SS "Version"
 .P
-11.19.0
+11.19.1
 .SS "Description"
 .P
 npm is the package manager for the Node JavaScript platform. It puts modules in place so that node can find them, and manages dependency conflicts intelligently.
diff --git a/deps/npm/man/man1/npx.1 b/deps/npm/man/man1/npx.1
index 3c4afb8aec51..39fcb358f7ce 100644
--- a/deps/npm/man/man1/npx.1
+++ b/deps/npm/man/man1/npx.1
@@ -1,4 +1,4 @@
-.TH "NPX" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPX" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpx\fR - Run a command from a local or remote npm package
 .SS "Synopsis"
diff --git a/deps/npm/man/man5/folders.5 b/deps/npm/man/man5/folders.5
index 0717f575c47f..7ec714295100 100644
--- a/deps/npm/man/man5/folders.5
+++ b/deps/npm/man/man5/folders.5
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "July 2026" "NPM@11.19.0" ""
+.TH "FOLDERS" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBFolders\fR - Folder structures used by npm
 .SS "Description"
diff --git a/deps/npm/man/man5/install.5 b/deps/npm/man/man5/install.5
index 200dcc3dfd3a..b54f427c5da9 100644
--- a/deps/npm/man/man5/install.5
+++ b/deps/npm/man/man5/install.5
@@ -1,4 +1,4 @@
-.TH "INSTALL" "5" "July 2026" "NPM@11.19.0" ""
+.TH "INSTALL" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBInstall\fR - Download and install node and npm
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-global.5 b/deps/npm/man/man5/npm-global.5
index 0717f575c47f..7ec714295100 100644
--- a/deps/npm/man/man5/npm-global.5
+++ b/deps/npm/man/man5/npm-global.5
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "July 2026" "NPM@11.19.0" ""
+.TH "FOLDERS" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBFolders\fR - Folder structures used by npm
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-json.5 b/deps/npm/man/man5/npm-json.5
index 4d4a9084ac7a..4a79f2788851 100644
--- a/deps/npm/man/man5/npm-json.5
+++ b/deps/npm/man/man5/npm-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage.json\fR - Specifics of npm's package.json handling
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-shrinkwrap-json.5 b/deps/npm/man/man5/npm-shrinkwrap-json.5
index 9f3d7597d161..1af7bf467c03 100644
--- a/deps/npm/man/man5/npm-shrinkwrap-json.5
+++ b/deps/npm/man/man5/npm-shrinkwrap-json.5
@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SHRINKWRAP.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-shrinkwrap.json\fR - A publishable lockfile
 .SS "Description"
diff --git a/deps/npm/man/man5/npmrc.5 b/deps/npm/man/man5/npmrc.5
index 83578c624089..9d2361126088 100644
--- a/deps/npm/man/man5/npmrc.5
+++ b/deps/npm/man/man5/npmrc.5
@@ -1,4 +1,4 @@
-.TH ".NPMRC" "5" "July 2026" "NPM@11.19.0" ""
+.TH ".NPMRC" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fB.npmrc\fR - The npm config files
 .SS "Description"
diff --git a/deps/npm/man/man5/package-json.5 b/deps/npm/man/man5/package-json.5
index 4d4a9084ac7a..4a79f2788851 100644
--- a/deps/npm/man/man5/package-json.5
+++ b/deps/npm/man/man5/package-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage.json\fR - Specifics of npm's package.json handling
 .SS "Description"
diff --git a/deps/npm/man/man5/package-lock-json.5 b/deps/npm/man/man5/package-lock-json.5
index 7bc632269f50..ace3d4d69594 100644
--- a/deps/npm/man/man5/package-lock-json.5
+++ b/deps/npm/man/man5/package-lock-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE-LOCK.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE-LOCK.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage-lock.json\fR - A manifestation of the manifest
 .SS "Description"
diff --git a/deps/npm/man/man7/config.7 b/deps/npm/man/man7/config.7
index b68980abc38f..684663e33757 100644
--- a/deps/npm/man/man7/config.7
+++ b/deps/npm/man/man7/config.7
@@ -1,4 +1,4 @@
-.TH "CONFIG" "7" "July 2026" "NPM@11.19.0" ""
+.TH "CONFIG" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBConfig\fR - About npm configuration
 .SS "Description"
diff --git a/deps/npm/man/man7/dependency-selectors.7 b/deps/npm/man/man7/dependency-selectors.7
index 4d242ab6e6c4..ec08ce0750b3 100644
--- a/deps/npm/man/man7/dependency-selectors.7
+++ b/deps/npm/man/man7/dependency-selectors.7
@@ -1,4 +1,4 @@
-.TH "SELECTORS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SELECTORS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBSelectors\fR - Dependency Selector Syntax & Querying
 .SS "Description"
diff --git a/deps/npm/man/man7/developers.7 b/deps/npm/man/man7/developers.7
index 201aedc081dd..aebb1f99a74a 100644
--- a/deps/npm/man/man7/developers.7
+++ b/deps/npm/man/man7/developers.7
@@ -1,4 +1,4 @@
-.TH "DEVELOPERS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "DEVELOPERS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBDevelopers\fR - Developer guide
 .SS "Description"
diff --git a/deps/npm/man/man7/logging.7 b/deps/npm/man/man7/logging.7
index be1e6ea6fffa..7fab6e089256 100644
--- a/deps/npm/man/man7/logging.7
+++ b/deps/npm/man/man7/logging.7
@@ -1,4 +1,4 @@
-.TH "LOGGING" "7" "July 2026" "NPM@11.19.0" ""
+.TH "LOGGING" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBLogging\fR - Why, What & How we Log
 .SS "Description"
diff --git a/deps/npm/man/man7/orgs.7 b/deps/npm/man/man7/orgs.7
index 43732ecdb5cb..975eded22dfc 100644
--- a/deps/npm/man/man7/orgs.7
+++ b/deps/npm/man/man7/orgs.7
@@ -1,4 +1,4 @@
-.TH "ORGANIZATIONS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "ORGANIZATIONS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBOrganizations\fR - Working with teams & organizations
 .SS "Description"
diff --git a/deps/npm/man/man7/package-spec.7 b/deps/npm/man/man7/package-spec.7
index d76da151b48e..a68e9b8f7e74 100644
--- a/deps/npm/man/man7/package-spec.7
+++ b/deps/npm/man/man7/package-spec.7
@@ -1,4 +1,4 @@
-.TH "SPEC" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SPEC" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBspec\fR - Package name specifier
 .SS "Description"
diff --git a/deps/npm/man/man7/registry.7 b/deps/npm/man/man7/registry.7
index 16e295f6ac11..a91c60c14565 100644
--- a/deps/npm/man/man7/registry.7
+++ b/deps/npm/man/man7/registry.7
@@ -1,4 +1,4 @@
-.TH "REGISTRY" "7" "July 2026" "NPM@11.19.0" ""
+.TH "REGISTRY" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBRegistry\fR - The JavaScript Package Registry
 .SS "Description"
diff --git a/deps/npm/man/man7/removal.7 b/deps/npm/man/man7/removal.7
index 1e0a0ddd0cf3..bb4d7a8d4365 100644
--- a/deps/npm/man/man7/removal.7
+++ b/deps/npm/man/man7/removal.7
@@ -1,4 +1,4 @@
-.TH "REMOVAL" "7" "July 2026" "NPM@11.19.0" ""
+.TH "REMOVAL" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBRemoval\fR - Cleaning the slate
 .SS "Synopsis"
diff --git a/deps/npm/man/man7/scope.7 b/deps/npm/man/man7/scope.7
index 6bb685d20984..f2744feb1343 100644
--- a/deps/npm/man/man7/scope.7
+++ b/deps/npm/man/man7/scope.7
@@ -1,4 +1,4 @@
-.TH "SCOPE" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SCOPE" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBScope\fR - Scoped packages
 .SS "Description"
diff --git a/deps/npm/man/man7/scripts.7 b/deps/npm/man/man7/scripts.7
index 797e70b65138..4af3522042ba 100644
--- a/deps/npm/man/man7/scripts.7
+++ b/deps/npm/man/man7/scripts.7
@@ -1,4 +1,4 @@
-.TH "SCRIPTS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SCRIPTS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBScripts\fR - How npm handles the "scripts" field
 .SS "Description"
diff --git a/deps/npm/man/man7/workspaces.7 b/deps/npm/man/man7/workspaces.7
index fb9807cdfe4c..b31d897d2f3d 100644
--- a/deps/npm/man/man7/workspaces.7
+++ b/deps/npm/man/man7/workspaces.7
@@ -1,4 +1,4 @@
-.TH "WORKSPACES" "7" "July 2026" "NPM@11.19.0" ""
+.TH "WORKSPACES" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBWorkspaces\fR - Working with workspaces
 .SS "Description"
diff --git a/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js b/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
index e4e5bd87666d..869a6bee2380 100644
--- a/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
+++ b/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXPANSION_MAX = void 0;
+exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0;
 exports.expand = expand;
 const balanced_match_1 = require("balanced-match");
 const escSlash = '\0SLASH' + Math.random() + '\0';
@@ -19,6 +19,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 exports.EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+exports.EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -68,7 +79,7 @@ function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = exports.EXPANSION_MAX } = options;
+    const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -78,7 +89,7 @@ function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -92,25 +103,116 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-    // of non-expanding `{}` groups can't exhaust the call stack.
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
+        }
+    }
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
     for (;;) {
         const m = (0, balanced_match_1.balanced)('{', '}', str);
-        if (!m)
-            return [str];
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
         // no need to expand pre, since it is guaranteed to be free of brace-sets
         const pre = m.pre;
-        if (/\$$/.test(m.pre)) {
-            const post = m.post.length ? expand_(m.post, max, false) : [''];
-            for (let k = 0; k < post.length && k < max; k++) {
-                const expansion = pre + '{' + m.body + '}' + post[k];
-                expansions.push(expansion);
-            }
-            return expansions;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
         }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
@@ -123,89 +225,65 @@ function expand_(str, max, isTop) {
                 isTop = true;
                 continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
+        }
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
         }
-        // Only expand post once we know this brace set actually expands. Computing
-        // it before the early returns above expanded post a second time on every
-        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-        // exponentially.
-        const post = m.post.length ? expand_(m.post, max, false) : [''];
-        let n;
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
                 }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
             }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
-        return expansions;
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
+    return acc;
 }
 //# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/brace-expansion/dist/esm/index.js b/deps/npm/node_modules/brace-expansion/dist/esm/index.js
index b2d2aa91bb1c..fd68f5702920 100644
--- a/deps/npm/node_modules/brace-expansion/dist/esm/index.js
+++ b/deps/npm/node_modules/brace-expansion/dist/esm/index.js
@@ -15,6 +15,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 export const EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+export const EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -64,7 +75,7 @@ export function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = EXPANSION_MAX } = options;
+    const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -74,7 +85,7 @@ export function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -88,25 +99,116 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-    // of non-expanding `{}` groups can't exhaust the call stack.
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
+        }
+    }
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
     for (;;) {
         const m = balanced('{', '}', str);
-        if (!m)
-            return [str];
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
         // no need to expand pre, since it is guaranteed to be free of brace-sets
         const pre = m.pre;
-        if (/\$$/.test(m.pre)) {
-            const post = m.post.length ? expand_(m.post, max, false) : [''];
-            for (let k = 0; k < post.length && k < max; k++) {
-                const expansion = pre + '{' + m.body + '}' + post[k];
-                expansions.push(expansion);
-            }
-            return expansions;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
         }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
@@ -119,89 +221,65 @@ function expand_(str, max, isTop) {
                 isTop = true;
                 continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
+        }
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
         }
-        // Only expand post once we know this brace set actually expands. Computing
-        // it before the early returns above expanded post a second time on every
-        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-        // exponentially.
-        const post = m.post.length ? expand_(m.post, max, false) : [''];
-        let n;
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
                 }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
             }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
-        return expansions;
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
+    return acc;
 }
 //# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/brace-expansion/package.json b/deps/npm/node_modules/brace-expansion/package.json
index a5142f2787b6..4376400796c9 100644
--- a/deps/npm/node_modules/brace-expansion/package.json
+++ b/deps/npm/node_modules/brace-expansion/package.json
@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "5.0.7",
+  "version": "5.0.9",
   "files": [
     "dist"
   ],
@@ -46,7 +46,7 @@
   },
   "license": "MIT",
   "engines": {
-    "node": "18 || 20 || >=22"
+    "node": "20 || >=22"
   },
   "tshy": {
     "exports": {
diff --git a/deps/npm/node_modules/ip-address/dist/common.js b/deps/npm/node_modules/ip-address/dist/common.js
index 6b76e051b44e..0c15d21e3a39 100644
--- a/deps/npm/node_modules/ip-address/dist/common.js
+++ b/deps/npm/node_modules/ip-address/dist/common.js
@@ -1,23 +1,47 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isInSubnet = isInSubnet;
+exports.isHostInSubnet = isHostInSubnet;
 exports.isCorrect = isCorrect;
 exports.prefixLengthFromMask = prefixLengthFromMask;
+exports.assertByteArray = assertByteArray;
 exports.numberToPaddedHex = numberToPaddedHex;
 exports.stringToPaddedHex = stringToPaddedHex;
 exports.testBit = testBit;
 const address_error_1 = require("./address-error");
+/**
+ * Returns whether this address's *network* is contained within `address`,
+ * i.e. whether every address this one can represent also falls inside
+ * `address`. A network wider than `address` is not contained in it, so
+ * `10.0.0.0/8` is not in `10.0.0.0/16`.
+ *
+ * To ask whether the address itself falls inside a range, ignoring any CIDR
+ * suffix it was written with, use {@link isHostInSubnet} instead. That is the
+ * question the special-use classifiers ask.
+ */
 function isInSubnet(address) {
     if (this.subnetMask < address.subnetMask) {
         return false;
     }
-    if (this.mask(address.subnetMask) === address.mask()) {
-        return true;
-    }
-    return false;
+    return isHostInSubnet.call(this, address);
+}
+/**
+ * Returns whether this address's host bits fall inside `address`, ignoring
+ * this address's own subnet mask.
+ *
+ * This is the primitive the special-use classifiers (`isLoopback`,
+ * `isPrivate`, `isLinkLocal`, `getType`, …) are built on: they answer a
+ * question about the address, so the answer must not change with the CIDR
+ * suffix the caller happened to write. Use this rather than
+ * {@link isInSubnet} when classifying a single address — notably when the
+ * address came from untrusted input and the result backs a trust-boundary
+ * decision such as an SSRF allow/deny filter.
+ */
+function isHostInSubnet(address) {
+    return this.mask(address.subnetMask) === address.mask();
 }
 function isCorrect(defaultBits) {
-    return function () {
+    return function isCorrectForm() {
         if (this.addressMinusSuffix !== this.correctForm()) {
             return false;
         }
@@ -46,6 +70,21 @@ function prefixLengthFromMask(value, totalBits) {
     }
     return firstZero;
 }
+/**
+ * Throws `AddressError` unless `bytes` holds exactly `byteCount` integers,
+ * each from `minimum` to 255. Pass a `minimum` of `-128` where signed bytes
+ * are accepted and folded to unsigned, and `0` where they are not.
+ */
+function assertByteArray(bytes, byteCount, family, minimum) {
+    if (bytes.length !== byteCount) {
+        throw new address_error_1.AddressError(`${family} addresses require exactly ${byteCount} bytes`);
+    }
+    for (let i = 0; i < bytes.length; i++) {
+        if (!Number.isInteger(bytes[i]) || bytes[i] < minimum || bytes[i] > 255) {
+            throw new address_error_1.AddressError(`All bytes must be integers between ${minimum} and 255`);
+        }
+    }
+}
 function numberToPaddedHex(number) {
     return number.toString(16).padStart(2, '0');
 }
diff --git a/deps/npm/node_modules/ip-address/dist/ipv4.js b/deps/npm/node_modules/ip-address/dist/ipv4.js
index 2c0fd182086d..1360e1836a0d 100644
--- a/deps/npm/node_modules/ip-address/dist/ipv4.js
+++ b/deps/npm/node_modules/ip-address/dist/ipv4.js
@@ -35,6 +35,7 @@ const isCorrect4 = common.isCorrect(constants.BITS);
  */
 class Address4 {
     constructor(address) {
+        this.addressMinusSuffix = '';
         this.groups = constants.GROUPS;
         this.parsedAddress = [];
         this.parsedSubnet = '';
@@ -51,6 +52,15 @@ class Address4 {
          * @returns {boolean}
          */
         this.isInSubnet = common.isInSubnet;
+        /**
+         * Returns true if this address's host bits fall inside the given subnet,
+         * ignoring this address's own subnet mask. Prefer this over `isInSubnet`
+         * when classifying a single address, so the answer doesn't change with the
+         * CIDR suffix the caller happened to write — notably when the address came
+         * from untrusted input and the result backs a trust-boundary decision.
+         * @returns {boolean}
+         */
+        this.isHostInSubnet = common.isHostInSubnet;
         this.address = address;
         const subnet = constants.RE_SUBNET_STRING.exec(address);
         if (subnet) {
@@ -78,7 +88,7 @@ class Address4 {
             new Address4(address);
             return true;
         }
-        catch (e) {
+        catch {
             return false;
         }
     }
@@ -90,6 +100,11 @@ class Address4 {
      */
     parse(address) {
         const groups = address.split('.');
+        // Checked before the general match so the error names the actual problem.
+        // Address6 rejects the same notation on its v4-in-v6 path.
+        if (groups.some((group) => /^0\d/.test(group))) {
+            throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.");
+        }
         if (!address.match(constants.RE_ADDRESS)) {
             throw new address_error_1.AddressError('Invalid IPv4 address.');
         }
@@ -128,7 +143,6 @@ class Address4 {
     static fromAddressAndWildcardMask(address, wildcardMask) {
         const wildcard = new Address4(wildcardMask).bigInt();
         const allOnes = (BigInt(1) << BigInt(constants.BITS)) - BigInt(1);
-        // eslint-disable-next-line no-bitwise
         const mask = wildcard ^ allOnes;
         const bits = common.prefixLengthFromMask(mask, constants.BITS);
         return new Address4(`${address}/${bits}`);
@@ -328,32 +342,32 @@ class Address4 {
      * @returns {Address4}
      */
     static fromBigInt(bigInt) {
-        if (bigInt < 0n || bigInt > 0xffffffffn) {
+        if (bigInt < BigInt(0) || bigInt > BigInt(0xffffffff)) {
             throw new address_error_1.AddressError('IPv4 BigInt must be in the range 0 to 2**32 - 1');
         }
         return Address4.fromHex(bigInt.toString(16).padStart(8, '0'));
     }
     /**
-     * Convert a byte array to an Address4 object.
+     * Convert a byte array to an Address4 object. Throws `AddressError` unless
+     * given exactly 4 integers from 0 to 255. Signed bytes are rejected, so
+     * this differs from `Address6.fromByteArray`, which folds them; the two
+     * contracts converge on this stricter form in the next major version.
      *
      * To convert from a Node.js `Buffer`, spread it: `Address4.fromByteArray([...buf])`.
      * @param {Array<number>} bytes - an array of 4 bytes (0-255)
      * @returns {Address4}
      */
     static fromByteArray(bytes) {
-        if (bytes.length !== 4) {
-            throw new address_error_1.AddressError('IPv4 addresses require exactly 4 bytes');
-        }
-        // Validate that all bytes are within valid range (0-255)
-        for (let i = 0; i < bytes.length; i++) {
-            if (!Number.isInteger(bytes[i]) || bytes[i] < 0 || bytes[i] > 255) {
-                throw new address_error_1.AddressError('All bytes must be integers between 0 and 255');
-            }
-        }
+        common.assertByteArray(bytes, 4, 'IPv4', 0);
         return this.fromUnsignedByteArray(bytes);
     }
     /**
-     * Convert an unsigned byte array to an Address4 object
+     * Convert an unsigned byte array to an Address4 object. Throws
+     * `AddressError` unless given exactly 4 bytes, and rejects values outside
+     * 0 to 255 when parsing the resulting address.
+     *
+     * To convert from a Node.js `Buffer`, spread it:
+     * `Address4.fromUnsignedByteArray([...buf])`.
      * @param {Array<number>} bytes - an array of 4 unsigned bytes (0-255)
      * @returns {Address4}
      */
@@ -383,7 +397,8 @@ class Address4 {
         return this.binaryZeroPad().slice(start, end);
     }
     /**
-     * Return the reversed ip6.arpa form of the address
+     * Return the reversed in-addr.arpa form of the address, e.g.
+     * `42.2.0.192.in-addr.arpa.` for `192.0.2.42`.
      * @param {Object} options
      * @param {boolean} options.omitSuffix - omit the "in-addr.arpa" suffix
      * @returns {String}
@@ -403,49 +418,49 @@ class Address4 {
      * @returns {boolean}
      */
     isMulticast() {
-        return this.isInSubnet(MULTICAST_V4);
+        return this.isHostInSubnet(MULTICAST_V4);
     }
     /**
      * Returns true if the address is in one of the [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private address ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`).
      * @returns {boolean}
      */
     isPrivate() {
-        return PRIVATE_V4.some((subnet) => this.isInSubnet(subnet));
+        return PRIVATE_V4.some((subnet) => this.isHostInSubnet(subnet));
     }
     /**
      * Returns true if the address is in the loopback range `127.0.0.0/8` ([RFC 1122](https://datatracker.ietf.org/doc/html/rfc1122)).
      * @returns {boolean}
      */
     isLoopback() {
-        return this.isInSubnet(LOOPBACK_V4);
+        return this.isHostInSubnet(LOOPBACK_V4);
     }
     /**
      * Returns true if the address is in the link-local range `169.254.0.0/16` ([RFC 3927](https://datatracker.ietf.org/doc/html/rfc3927)).
      * @returns {boolean}
      */
     isLinkLocal() {
-        return this.isInSubnet(LINK_LOCAL_V4);
+        return this.isHostInSubnet(LINK_LOCAL_V4);
     }
     /**
      * Returns true if the address is the unspecified address `0.0.0.0`.
      * @returns {boolean}
      */
     isUnspecified() {
-        return this.isInSubnet(UNSPECIFIED_V4);
+        return this.isHostInSubnet(UNSPECIFIED_V4);
     }
     /**
      * Returns true if the address is the limited broadcast address `255.255.255.255` ([RFC 919](https://datatracker.ietf.org/doc/html/rfc919)).
      * @returns {boolean}
      */
     isBroadcast() {
-        return this.isInSubnet(BROADCAST_V4);
+        return this.isHostInSubnet(BROADCAST_V4);
     }
     /**
      * Returns true if the address is in the carrier-grade NAT range `100.64.0.0/10` ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)).
      * @returns {boolean}
      */
     isCGNAT() {
-        return this.isInSubnet(CGNAT_V4);
+        return this.isHostInSubnet(CGNAT_V4);
     }
     /**
      * Returns a zero-padded base-2 string representation of the address
@@ -458,12 +473,17 @@ class Address4 {
         return this._binaryZeroPad;
     }
     /**
-     * Groups an IPv4 address for inclusion at the end of an IPv6 address
+     * Groups an IPv4 address for inclusion at the end of an IPv6 address.
+     *
+     * Returns an HTML fragment: each half of the address is wrapped in a
+     * `<span>` carrying the group classes an address-inspector UI hovers on.
+     * The address content is HTML-escaped; anything you concatenate around it
+     * is your responsibility.
      * @returns {String}
      */
     groupForV6() {
         const segments = this.parsedAddress;
-        return this.address.replace(constants.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments
+        return this.correctForm().replace(constants.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments
             .slice(0, 2)
             .join('.')}</span>.<span class="hover-group group-v4 group-7">${segments
             .slice(2, 4)
diff --git a/deps/npm/node_modules/ip-address/dist/ipv6.js b/deps/npm/node_modules/ip-address/dist/ipv6.js
index a78020ee7886..d5f4fdb9c87a 100644
--- a/deps/npm/node_modules/ip-address/dist/ipv6.js
+++ b/deps/npm/node_modules/ip-address/dist/ipv6.js
@@ -73,7 +73,6 @@ function paddedHex(octet) {
     return parseInt(octet, 16).toString(16).padStart(4, '0');
 }
 function unsignByte(b) {
-    // eslint-disable-next-line no-bitwise
     return b & 0xff;
 }
 /**
@@ -97,6 +96,15 @@ class Address6 {
          * @returns {boolean}
          */
         this.isInSubnet = common.isInSubnet;
+        /**
+         * Returns true if this address's host bits fall inside the given subnet,
+         * ignoring this address's own subnet mask. Prefer this over `isInSubnet`
+         * when classifying a single address, so the answer doesn't change with the
+         * CIDR suffix the caller happened to write — notably when the address came
+         * from untrusted input and the result backs a trust-boundary decision.
+         * @returns {boolean}
+         */
+        this.isHostInSubnet = common.isHostInSubnet;
         /**
          * Returns true if the address is correct, false otherwise
          * @returns {boolean}
@@ -121,7 +129,10 @@ class Address6 {
             }
             address = address.replace(constants6.RE_SUBNET_STRING, '');
         }
-        else if (/\//.test(address)) {
+        // RE_SUBNET_STRING anchors on the end of the address, so it strips only
+        // the trailing suffix. A second one left behind (`::/0/1`) is malformed
+        // and must be rejected rather than parsed as an address group.
+        if (/\//.test(address)) {
             throw new address_error_1.AddressError('Invalid subnet mask.');
         }
         const zone = constants6.RE_ZONE_STRING.exec(address);
@@ -145,7 +156,7 @@ class Address6 {
             new Address6(address);
             return true;
         }
-        catch (e) {
+        catch {
             return false;
         }
     }
@@ -160,7 +171,7 @@ class Address6 {
      * address.correctForm(); // '::e8:d4a5:1000'
      */
     static fromBigInt(bigInt) {
-        if (bigInt < 0n || bigInt > (1n << BigInt(constants6.BITS)) - 1n) {
+        if (bigInt < BigInt(0) || bigInt > (BigInt(1) << BigInt(constants6.BITS)) - BigInt(1)) {
             throw new address_error_1.AddressError('IPv6 BigInt must be in the range 0 to 2**128 - 1');
         }
         const hex = bigInt.toString(16).padStart(32, '0');
@@ -181,46 +192,36 @@ class Address6 {
      * addressAndPort.port; // 8080
      */
     static fromURL(url) {
+        var _a;
         let host;
         let port = null;
         let result;
+        let error;
+        // Remove the protocol prefix, if any
+        const stripped = url.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '');
         // If we have brackets parse them and find a port
-        if (url.indexOf('[') !== -1 && url.indexOf(']:') !== -1) {
-            result = constants6.RE_URL_WITH_PORT.exec(url);
+        if (stripped.indexOf('[') !== -1 && stripped.indexOf(']:') !== -1) {
+            error = 'failed to parse address with port';
+            result = constants6.RE_URL_WITH_PORT.exec(stripped);
             if (result === null) {
-                return {
-                    error: 'failed to parse address with port',
-                    address: null,
-                    port: null,
-                };
+                return { error, address: null, port: null };
             }
             host = result[1];
             port = result[2];
-            // If there's a URL extract the address
         }
-        else if (url.indexOf('/') !== -1) {
-            // Remove the protocol prefix
-            url = url.replace(/^[a-z0-9]+:\/\//, '');
-            // Parse the address
-            result = constants6.RE_URL.exec(url);
+        else {
+            error = 'failed to parse address from URL';
+            result = constants6.RE_URL.exec(stripped);
             if (result === null) {
-                return {
-                    error: 'failed to parse address from URL',
-                    address: null,
-                    port: null,
-                };
+                return { error, address: null, port: null };
             }
-            host = result[1];
-            // Otherwise just assign the URL to the host and let the library parse it
-        }
-        else {
-            host = url;
+            host = (_a = result[1]) !== null && _a !== void 0 ? _a : result[2];
         }
         // If there's a port convert it to an integer
         if (port) {
             port = parseInt(port, 10);
-            // squelch out of range ports
-            if (port < 0 || port > 65536) {
+            // squelch out of range ports (valid ports are 0-65535)
+            if (port < 0 || port > 65535) {
                 port = null;
             }
         }
@@ -228,10 +229,17 @@ class Address6 {
             // Standardize `undefined` to `null`
             port = null;
         }
-        return {
-            address: new Address6(host),
-            port,
-        };
+        // The URL character class is a superset of valid IPv6, so a host the
+        // regex accepted (an IPv4 literal, bare punctuation, too many groups)
+        // can still be rejected by the parser
+        let address;
+        try {
+            address = new Address6(host);
+        }
+        catch {
+            return { error, address: null, port: null };
+        }
+        return { address, port };
     }
     /**
      * Construct an `Address6` from an address and a hex subnet mask given as
@@ -258,7 +266,6 @@ class Address6 {
     static fromAddressAndWildcardMask(address, wildcardMask) {
         const wildcard = new Address6(wildcardMask).bigInt();
         const allOnes = (BigInt(1) << BigInt(constants6.BITS)) - BigInt(1);
-        // eslint-disable-next-line no-bitwise
         const mask = wildcard ^ allOnes;
         const bits = common.prefixLengthFromMask(mask, constants6.BITS);
         return new Address6(`${address}/${bits}`);
@@ -493,7 +500,7 @@ class Address6 {
     getType() {
         for (let i = 0; i < TYPE_SUBNETS.length; i++) {
             const entry = TYPE_SUBNETS[i];
-            if (this.isInSubnet(entry[0])) {
+            if (this.isHostInSubnet(entry[0])) {
                 return entry[1];
             }
         }
@@ -635,20 +642,27 @@ class Address6 {
         }
         const groups = address.split(':');
         const lastGroup = groups.slice(-1)[0];
+        // RE_ADDRESS rejects octets with a leading zero, so a dotted-quad tail is
+        // matched permissively first: that way this notation still gets its own
+        // message with the offending octet highlighted, rather than falling
+        // through as an unrecognized group.
+        const v4Octets = lastGroup.split('.');
+        if (v4Octets.length === constants4.GROUPS &&
+            v4Octets.every((octet) => /^\d{1,3}$/.test(octet))) {
+            if (v4Octets.some((octet) => /^0\d/.test(octet))) {
+                // The prefix groups haven't been through the bad-character check
+                // yet, so escape them before including in the error HTML.
+                const highlighted = v4Octets.map(spanLeadingZeroes4).join('.');
+                const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
+                const separator = groups.length > 1 ? ':' : '';
+                throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
+            }
+        }
         const address4 = lastGroup.match(constants4.RE_ADDRESS);
         if (address4) {
             this.parsedAddress4 = address4[0];
-            this.address4 = new ipv4_1.Address4(this.parsedAddress4);
-            for (let i = 0; i < this.address4.groups; i++) {
-                if (/^0[0-9]+/.test(this.address4.parsedAddress[i])) {
-                    // The prefix groups haven't been through the bad-character check
-                    // yet, so escape them before including in the error HTML.
-                    const highlighted = this.address4.parsedAddress.map(spanLeadingZeroes4).join('.');
-                    const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
-                    const separator = groups.length > 1 ? ':' : '';
-                    throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
-                }
-            }
+            const v4Suffix = this.subnetMask >= 96 ? `/${this.subnetMask - 96}` : '';
+            this.address4 = new ipv4_1.Address4(`${this.parsedAddress4}${v4Suffix}`);
             this.v4 = true;
             groups[groups.length - 1] = this.address4.toGroup6();
             address = groups.join(':');
@@ -734,7 +748,11 @@ class Address6 {
         return BigInt(`0x${this.parsedAddress.map(paddedHex).join('')}`);
     }
     /**
-     * Return the last two groups of this address as an IPv4 address string
+     * Return the last two groups of this address as an IPv4 address string.
+     * If this address carries a CIDR prefix that covers the trailing 32 bits
+     * (i.e. `subnetMask >= 96`), the resulting `Address4` inherits the
+     * corresponding v4 prefix (`subnetMask - 96`); otherwise it defaults to
+     * `/32`.
      * @returns {Address4}
      * @example
      * var address = new Address6('2001:4860:4001::1825:bf11');
@@ -742,7 +760,18 @@ class Address6 {
      */
     to4() {
         const binary = this.binaryZeroPad().split('');
-        return ipv4_1.Address4.fromHex(BigInt(`0b${binary.slice(96, 128).join('')}`).toString(16).padStart(8, '0'));
+        const hex = BigInt(`0b${binary.slice(96, 128).join('')}`)
+            .toString(16)
+            .padStart(8, '0');
+        if (this.subnetMask >= 96) {
+            const v4Mask = this.subnetMask - 96;
+            const groups = [];
+            for (let i = 0; i < 8; i += 2) {
+                groups.push(parseInt(hex.slice(i, i + 2), 16));
+            }
+            return new ipv4_1.Address4(`${groups.join('.')}/${v4Mask}`);
+        }
+        return ipv4_1.Address4.fromHex(hex);
     }
     /**
      * Return the v4-in-v6 form of the address
@@ -756,7 +785,7 @@ class Address6 {
         if (!/:$/.test(correct)) {
             infix = ':';
         }
-        return correct + infix + address4.address;
+        return correct + infix + address4.correctForm();
     }
     /**
      * Decodes the Teredo tunneling fields embedded in this address. Returns the
@@ -788,11 +817,9 @@ class Address6 {
         */
         const prefix = this.getBitsBase16(0, 32);
         const bitsForUdpPort = this.getBits(80, 96);
-        // eslint-disable-next-line no-bitwise
         const udpPort = (bitsForUdpPort ^ BigInt('0xffff')).toString();
         const server4 = ipv4_1.Address4.fromHex(this.getBitsBase16(32, 64));
         const bitsForClient4 = this.getBits(96, 128);
-        // eslint-disable-next-line no-bitwise
         const client4 = ipv4_1.Address4.fromHex((bitsForClient4 ^ BigInt('0xffffffff')).toString(16).padStart(8, '0'));
         const flagsBase2 = this.getBitsBase2(64, 80);
         const coneNat = (0, common_1.testBit)(flagsBase2, 15);
@@ -874,12 +901,14 @@ class Address6 {
         }
         else {
             const beforeU = 64 - pl;
-            bits =
-                prefixBits.slice(0, pl) +
-                    v4Bits.slice(0, beforeU) +
-                    '00000000' +
-                    v4Bits.slice(beforeU) +
-                    '0'.repeat(128 - 72 - (32 - beforeU));
+            bits = [
+                prefixBits.slice(0, pl),
+                v4Bits.slice(0, beforeU),
+                // Bits 64 to 71 are the reserved u octet and are always zero.
+                '00000000',
+                v4Bits.slice(beforeU),
+                '0'.repeat(128 - 72 - (32 - beforeU)),
+            ].join('');
         }
         const hex = BigInt(`0b${bits}`).toString(16).padStart(32, '0');
         const groups = [];
@@ -902,7 +931,7 @@ class Address6 {
         if (pl !== 32 && pl !== 40 && pl !== 48 && pl !== 56 && pl !== 64 && pl !== 96) {
             throw new address_error_1.AddressError('NAT64 prefix length must be 32, 40, 48, 56, 64, or 96');
         }
-        if (!this.isInSubnet(prefix6)) {
+        if (!this.isHostInSubnet(prefix6)) {
             return null;
         }
         const bits = this.binaryZeroPad();
@@ -927,9 +956,9 @@ class Address6 {
      * @returns {Array}
      */
     toByteArray() {
-        const valueWithoutPadding = this.bigInt().toString(16);
-        const leadingPad = '0'.repeat(valueWithoutPadding.length % 2);
-        const value = `${leadingPad}${valueWithoutPadding}`;
+        const value = this.bigInt()
+            .toString(16)
+            .padStart(constants6.BITS / 4, '0');
         const bytes = [];
         for (let i = 0, length = value.length; i < length; i += 2) {
             bytes.push(parseInt(value.substring(i, i + 2), 16));
@@ -943,24 +972,39 @@ class Address6 {
      * @returns {Array}
      */
     toUnsignedByteArray() {
+        // toByteArray() emits 0 to 255, so unsigning it is an identity mapping and
+        // the two methods return equal arrays. 11.0.0 keeps one of them and makes
+        // this a deprecated alias; test/common-test.ts fails at that version.
         return this.toByteArray().map(unsignByte);
     }
     /**
      * Convert a byte array to an Address6 object.
      *
+     * Accepts unsigned bytes (0 to 255) or signed bytes (-128 to 127, as an
+     * `Int8Array` or a Java `byte[]` holds them), folding signed values to their
+     * unsigned equivalent. Throws `AddressError` unless given exactly 16
+     * integers from -128 to 255.
+     *
      * To convert from a Node.js `Buffer`, spread it: `Address6.fromByteArray([...buf])`.
      * @returns {Address6}
      */
     static fromByteArray(bytes) {
+        // Address4.fromByteArray takes unsigned bytes only. 11.0.0 aligns this
+        // method with it, at which point the -128 floor here, unsignByte, and the
+        // mapping below all go; test/common-test.ts fails at that version.
+        common.assertByteArray(bytes, 16, 'IPv6', -128);
         return this.fromUnsignedByteArray(bytes.map(unsignByte));
     }
     /**
      * Convert an unsigned byte array to an Address6 object.
      *
+     * Throws `AddressError` unless given exactly 16 integers from 0 to 255.
+     *
      * To convert from a Node.js `Buffer`, spread it: `Address6.fromUnsignedByteArray([...buf])`.
      * @returns {Address6}
      */
     static fromUnsignedByteArray(bytes) {
+        common.assertByteArray(bytes, 16, 'IPv6', 0);
         const BYTE_MAX = BigInt('256');
         let result = BigInt('0');
         let multiplier = BigInt('1');
@@ -982,7 +1026,11 @@ class Address6 {
      * @returns {boolean}
      */
     isLinkLocal() {
-        // Zeroes are required, i.e. we can't check isInSubnet with 'fe80::/10'
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isLinkLocal();
+        }
+        // Zeroes are required, i.e. we can't check isHostInSubnet with 'fe80::/10'
         if (this.getBitsBase2(0, 64) ===
             '1111111010000000000000000000000000000000000000000000000000000000') {
             return true;
@@ -994,6 +1042,10 @@ class Address6 {
      * @returns {boolean}
      */
     isMulticast() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isMulticast();
+        }
         const type = this.getType();
         return type === 'Multicast' || type.startsWith('Multicast ');
     }
@@ -1016,27 +1068,54 @@ class Address6 {
      * @returns {boolean}
      */
     isMapped4() {
-        return this.isInSubnet(IPV4_MAPPED_SUBNET);
+        return this.isHostInSubnet(IPV4_MAPPED_SUBNET);
+    }
+    /**
+     * If this address embeds a routable IPv4 address — i.e. it is IPv4-mapped
+     * (`::ffff:0:0/96`) or sits in the NAT64 well-known prefix (`64:ff9b::/96`,
+     * [RFC 6052](https://datatracker.ietf.org/doc/html/rfc6052)) — return that
+     * embedded address as an {@link Address4}; otherwise return null.
+     *
+     * The special-property checks (`isLoopback`, `isLinkLocal`, `isMulticast`,
+     * `isUnspecified`, `isPrivate`, `isCGNAT`, `isBroadcast`) call this first and
+     * delegate to the embedded {@link Address4} when present, so a literal such as
+     * `::ffff:127.0.0.1` is classified by what it actually reaches (loopback)
+     * rather than by its IPv6 wrapper (which `getType()` reports as IPv4-mapped).
+     * This matters wherever the checks back a trust-boundary decision (e.g. an
+     * SSRF allow/deny filter): without normalization, `::ffff:10.0.0.1`,
+     * `::ffff:169.254.169.254`, `64:ff9b::7f00:1`, etc. would all read as
+     * non-internal.
+     * @returns {Address4 | null}
+     */
+    embeddedIPv4() {
+        if (this.isMapped4() || this.isHostInSubnet(NAT64_WELL_KNOWN_SUBNET)) {
+            return this.to4();
+        }
+        return null;
     }
     /**
      * Returns true if the address is a Teredo address, false otherwise
      * @returns {boolean}
      */
     isTeredo() {
-        return this.isInSubnet(TEREDO_SUBNET);
+        return this.isHostInSubnet(TEREDO_SUBNET);
     }
     /**
      * Returns true if the address is a 6to4 address, false otherwise
      * @returns {boolean}
      */
     is6to4() {
-        return this.isInSubnet(SIX_TO_FOUR_SUBNET);
+        return this.isHostInSubnet(SIX_TO_FOUR_SUBNET);
     }
     /**
      * Returns true if the address is a loopback address, false otherwise
      * @returns {boolean}
      */
     isLoopback() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isLoopback();
+        }
         return this.getType() === 'Loopback';
     }
     /**
@@ -1044,13 +1123,64 @@ class Address6 {
      * @returns {boolean}
      */
     isULA() {
-        return this.isInSubnet(ULA_SUBNET);
+        return this.isHostInSubnet(ULA_SUBNET);
+    }
+    /**
+     * Returns true if the address is private, i.e. a Unique Local Address in
+     * `fc00::/7` ([RFC 4193](https://datatracker.ietf.org/doc/html/rfc4193)) or an
+     * IPv4-mapped / NAT64 address whose embedded IPv4 address is in one of the
+     * [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private ranges
+     * (e.g. `::ffff:10.0.0.1`). This is the IPv6 counterpart to
+     * {@link Address4.isPrivate}; use it instead of {@link isULA} when you need to
+     * catch mapped RFC 1918 addresses as well as native ULAs.
+     * @returns {boolean}
+     */
+    isPrivate() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isPrivate();
+        }
+        return this.isULA();
+    }
+    /**
+     * Returns true if the address is an IPv4-mapped / NAT64 address whose embedded
+     * IPv4 address is in the carrier-grade NAT range `100.64.0.0/10`
+     * ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)), false
+     * otherwise. There is no native IPv6 CGNAT range, so this only ever returns
+     * true for an embedded IPv4 address (e.g. `::ffff:100.64.0.1`).
+     * @returns {boolean}
+     */
+    isCGNAT() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isCGNAT();
+        }
+        return false;
+    }
+    /**
+     * Returns true if the address is an IPv4-mapped / NAT64 address whose embedded
+     * IPv4 address is the limited broadcast address `255.255.255.255`
+     * ([RFC 919](https://datatracker.ietf.org/doc/html/rfc919)), false otherwise.
+     * There is no IPv6 broadcast, so this only ever returns true for an embedded
+     * IPv4 address (e.g. `::ffff:255.255.255.255`).
+     * @returns {boolean}
+     */
+    isBroadcast() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isBroadcast();
+        }
+        return false;
     }
     /**
      * Returns true if the address is the unspecified address `::`.
      * @returns {boolean}
      */
     isUnspecified() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isUnspecified();
+        }
         return this.getType() === 'Unspecified';
     }
     /**
@@ -1058,7 +1188,7 @@ class Address6 {
      * @returns {boolean}
      */
     isDocumentation() {
-        return this.isInSubnet(DOCUMENTATION_SUBNET);
+        return this.isHostInSubnet(DOCUMENTATION_SUBNET);
     }
     // #endregion
     // #region HTML
@@ -1111,7 +1241,12 @@ class Address6 {
         return `<a href="${safeHref}">${safeForm}</a>`;
     }
     /**
-     * Groups an address
+     * Groups an address.
+     *
+     * Returns an HTML fragment: each group is wrapped in a `<span>` carrying
+     * the group classes an address-inspector UI hovers on. The address content
+     * is HTML-escaped; anything you concatenate around it is your
+     * responsibility.
      * @returns {String}
      */
     group() {
@@ -1214,4 +1349,5 @@ const SIX_TO_FOUR_SUBNET = new Address6('2002::/16');
 const ULA_SUBNET = new Address6('fc00::/7');
 const DOCUMENTATION_SUBNET = new Address6('2001:db8::/32');
 const IPV4_MAPPED_SUBNET = new Address6('::ffff:0:0/96');
+const NAT64_WELL_KNOWN_SUBNET = new Address6('64:ff9b::/96');
 //# sourceMappingURL=ipv6.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/dist/v4/constants.js b/deps/npm/node_modules/ip-address/dist/v4/constants.js
index 6fa2518f9649..158288b7de65 100644
--- a/deps/npm/node_modules/ip-address/dist/v4/constants.js
+++ b/deps/npm/node_modules/ip-address/dist/v4/constants.js
@@ -3,6 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RE_SUBNET_STRING = exports.RE_ADDRESS = exports.GROUPS = exports.BITS = void 0;
 exports.BITS = 32;
 exports.GROUPS = 4;
-exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/g;
+// Each octet is 0-255 written without a leading zero. A leading zero is
+// octal to the WHATWG URL parser, inet_aton, and getaddrinfo, but decimal to
+// parseInt(part, 10), so accepting the notation would make this library
+// disagree with the network stack about which host a string names.
+exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/g;
 exports.RE_SUBNET_STRING = /\/\d{1,2}$/;
 //# sourceMappingURL=constants.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/dist/v6/constants.js b/deps/npm/node_modules/ip-address/dist/v6/constants.js
index 1a8cd1dd616e..4616cad66b6a 100644
--- a/deps/npm/node_modules/ip-address/dist/v6/constants.js
+++ b/deps/npm/node_modules/ip-address/dist/v6/constants.js
@@ -44,6 +44,7 @@ exports.TYPES = {
     'ff05::1:3/128': 'Multicast (All DHCP servers in this site)',
     '::/128': 'Unspecified',
     '::1/128': 'Loopback',
+    '::ffff:0:0/96': 'IPv4-mapped',
     'ff00::/8': 'Multicast',
     'fe80::/10': 'Link-local unicast',
     'fc00::/7': 'Unique local',
@@ -76,6 +77,6 @@ exports.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/;
  * @static
  */
 exports.RE_ZONE_STRING = /%.*$/;
-exports.RE_URL = /^\[{0,1}([0-9a-f:]+)\]{0,1}/;
-exports.RE_URL_WITH_PORT = /\[([0-9a-f:]+)\]:([0-9]{1,5})/;
+exports.RE_URL = /^(?:\[([0-9a-f:.]+)\]|([0-9a-f:.]+))(?:[/?#].*)?$/i;
+exports.RE_URL_WITH_PORT = /^\[([0-9a-f:.]+)\]:([0-9]{1,5})(?:[/?#].*)?$/i;
 //# sourceMappingURL=constants.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/package.json b/deps/npm/node_modules/ip-address/package.json
index 47d109ec6f34..6ea2d24bd62b 100644
--- a/deps/npm/node_modules/ip-address/package.json
+++ b/deps/npm/node_modules/ip-address/package.json
@@ -16,7 +16,7 @@
     "bigint",
     "browser"
   ],
-  "version": "10.2.0",
+  "version": "10.5.0",
   "author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
   "license": "MIT",
   "main": "dist/ip-address.js",
@@ -25,6 +25,9 @@
     "docs": "tsx scripts/build-readme.ts",
     "build": "rm -rf dist; mkdir dist; tsc",
     "prepack": "npm run docs && npm run build",
+    "prepare": "git config core.hooksPath hooks || true",
+    "lint": "prettier --check . && eslint . --ext .ts,.js --max-warnings 0",
+    "lint:fix": "prettier --write . && eslint . --ext .ts,.js --max-warnings 0 --fix",
     "test-ci": "c8 --experimental-monocart mocha",
     "test": "mocha",
     "watch": "mocha --watch"
@@ -54,7 +57,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git://github.com/beaugunderson/ip-address.git"
+    "url": "https://github.com/beaugunderson/ip-address.git"
   },
   "overrides": {
     "diff": "^8.0.3",
@@ -70,11 +73,10 @@
     "chai": "^6.2.2",
     "eslint": "^8.57.1",
     "eslint_d": "^14.0.4",
-    "eslint-config-airbnb": "^19.0.4",
+    "eslint-config-airbnb-base": "^15.0.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-filenames": "^1.3.2",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-prettier": "^5.5.5",
     "eslint-plugin-sort-imports-es6-autofix": "^0.6.0",
     "mocha": "^11.7.5",
diff --git a/deps/npm/node_modules/libnpmpack/lib/index.js b/deps/npm/node_modules/libnpmpack/lib/index.js
index 6c8ee3fd6334..ce6707938bb3 100644
--- a/deps/npm/node_modules/libnpmpack/lib/index.js
+++ b/deps/npm/node_modules/libnpmpack/lib/index.js
@@ -12,6 +12,11 @@ async function pack (spec = 'file:.', opts = {}) {
   // gets spec
   spec = npa(spec)
 
+  // An explicit directory is the package being packed, not a dependency fetch.
+  if (spec.type === 'directory') {
+    opts = { ...opts, allowDirectory: 'all' }
+  }
+
   const manifest = await pacote.manifest(spec, { ...opts, Arborist, _isRoot: true })
 
   const stdio = opts.foregroundScripts ? 'inherit' : 'pipe'
diff --git a/deps/npm/node_modules/libnpmpack/package.json b/deps/npm/node_modules/libnpmpack/package.json
index 5741c8522c19..54c31fccd635 100644
--- a/deps/npm/node_modules/libnpmpack/package.json
+++ b/deps/npm/node_modules/libnpmpack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "libnpmpack",
-  "version": "9.1.12",
+  "version": "9.1.13",
   "description": "Programmatic API for the bits behind npm pack",
   "author": "GitHub Inc.",
   "main": "lib/index.js",
diff --git a/deps/npm/node_modules/tar/dist/commonjs/index.min.js b/deps/npm/node_modules/tar/dist/commonjs/index.min.js
index 1a229a01e5a5..c1fe035f48f3 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/index.min.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/index.min.js
@@ -1,4 +1,4 @@
-"use strict";var d=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports);var We=d(F=>{"use strict";var Do=F&&F.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(F,"__esModule",{value:!0});F.Minipass=F.isWritable=F.isReadable=F.isStream=void 0;var kr=typeof process=="object"&&process?process:{stdout:null,stderr:null},ss=require("node:events"),qr=Do(require("node:stream")),Po=require("node:string_decoder"),No=s=>!!s&&typeof s=="object"&&(s instanceof Zt||s instanceof qr.default||(0,F.isReadable)(s)||(0,F.isWritable)(s));F.isStream=No;var Mo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.pipe=="function"&&s.pipe!==qr.default.Writable.prototype.pipe;F.isReadable=Mo;var Lo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.write=="function"&&typeof s.end=="function";F.isWritable=Lo;var ce=Symbol("EOF"),ue=Symbol("maybeEmitEnd"),we=Symbol("emittedEnd"),jt=Symbol("emittingEnd"),dt=Symbol("emittedError"),Ut=Symbol("closed"),xr=Symbol("read"),qt=Symbol("flush"),jr=Symbol("flushChunk"),K=Symbol("encoding"),Ue=Symbol("decoder"),R=Symbol("flowing"),mt=Symbol("paused"),qe=Symbol("resume"),O=Symbol("buffer"),I=Symbol("pipes"),v=Symbol("bufferLength"),Xi=Symbol("bufferPush"),Wt=Symbol("bufferShift"),N=Symbol("objectMode"),y=Symbol("destroyed"),Qi=Symbol("error"),Ji=Symbol("emitData"),Ur=Symbol("emitEnd"),es=Symbol("emitEnd2"),J=Symbol("async"),ts=Symbol("abort"),Ht=Symbol("aborted"),pt=Symbol("signal"),Ne=Symbol("dataListeners"),x=Symbol("discarded"),_t=s=>Promise.resolve().then(s),Ao=s=>s(),Io=s=>s==="end"||s==="finish"||s==="prefinish",Fo=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,Co=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Gt=class{src;dest;opts;ondrain;constructor(e,t,i){this.src=e,this.dest=t,this.opts=i,this.ondrain=()=>e[qe](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(e){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},is=class extends Gt{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(e,t,i){super(e,t,i),this.proxyErrors=r=>this.dest.emit("error",r),e.on("error",this.proxyErrors)}},Bo=s=>!!s.objectMode,zo=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",Zt=class extends ss.EventEmitter{[R]=!1;[mt]=!1;[I]=[];[O]=[];[N];[K];[J];[Ue];[ce]=!1;[we]=!1;[jt]=!1;[Ut]=!1;[dt]=null;[v]=0;[y]=!1;[pt];[Ht]=!1;[Ne]=0;[x]=!1;writable=!0;readable=!0;constructor(...e){let t=e[0]||{};if(super(),t.objectMode&&typeof t.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Bo(t)?(this[N]=!0,this[K]=null):zo(t)?(this[K]=t.encoding,this[N]=!1):(this[N]=!1,this[K]=null),this[J]=!!t.async,this[Ue]=this[K]?new Po.StringDecoder(this[K]):null,t&&t.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[O]}),t&&t.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[I]});let{signal:i}=t;i&&(this[pt]=i,i.aborted?this[ts]():i.addEventListener("abort",()=>this[ts]()))}get bufferLength(){return this[v]}get encoding(){return this[K]}set encoding(e){throw new Error("Encoding must be set at instantiation time")}setEncoding(e){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[N]}set objectMode(e){throw new Error("objectMode must be set at instantiation time")}get async(){return this[J]}set async(e){this[J]=this[J]||!!e}[ts](){this[Ht]=!0,this.emit("abort",this[pt]?.reason),this.destroy(this[pt]?.reason)}get aborted(){return this[Ht]}set aborted(e){}write(e,t,i){if(this[Ht])return!1;if(this[ce])throw new Error("write after end");if(this[y])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof t=="function"&&(i=t,t="utf8"),t||(t="utf8");let r=this[J]?_t:Ao;if(!this[N]&&!Buffer.isBuffer(e)){if(Co(e))e=Buffer.from(e.buffer,e.byteOffset,e.byteLength);else if(Fo(e))e=Buffer.from(e);else if(typeof e!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[N]?(this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):e.length?(typeof e=="string"&&!(t===this[K]&&!this[Ue]?.lastNeed)&&(e=Buffer.from(e,t)),Buffer.isBuffer(e)&&this[K]&&(e=this[Ue].write(e)),this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):(this[v]!==0&&this.emit("readable"),i&&r(i),this[R])}read(e){if(this[y])return null;if(this[x]=!1,this[v]===0||e===0||e&&e>this[v])return this[ue](),null;this[N]&&(e=null),this[O].length>1&&!this[N]&&(this[O]=[this[K]?this[O].join(""):Buffer.concat(this[O],this[v])]);let t=this[xr](e||null,this[O][0]);return this[ue](),t}[xr](e,t){if(this[N])this[Wt]();else{let i=t;e===i.length||e===null?this[Wt]():typeof i=="string"?(this[O][0]=i.slice(e),t=i.slice(0,e),this[v]-=e):(this[O][0]=i.subarray(e),t=i.subarray(0,e),this[v]-=e)}return this.emit("data",t),!this[O].length&&!this[ce]&&this.emit("drain"),t}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t="utf8"),e!==void 0&&this.write(e,t),i&&this.once("end",i),this[ce]=!0,this.writable=!1,(this[R]||!this[mt])&&this[ue](),this}[qe](){this[y]||(!this[Ne]&&!this[I].length&&(this[x]=!0),this[mt]=!1,this[R]=!0,this.emit("resume"),this[O].length?this[qt]():this[ce]?this[ue]():this.emit("drain"))}resume(){return this[qe]()}pause(){this[R]=!1,this[mt]=!0,this[x]=!1}get destroyed(){return this[y]}get flowing(){return this[R]}get paused(){return this[mt]}[Xi](e){this[N]?this[v]+=1:this[v]+=e.length,this[O].push(e)}[Wt](){return this[N]?this[v]-=1:this[v]-=this[O][0].length,this[O].shift()}[qt](e=!1){do;while(this[jr](this[Wt]())&&this[O].length);!e&&!this[O].length&&!this[ce]&&this.emit("drain")}[jr](e){return this.emit("data",e),this[R]}pipe(e,t){if(this[y])return e;this[x]=!1;let i=this[we];return t=t||{},e===kr.stdout||e===kr.stderr?t.end=!1:t.end=t.end!==!1,t.proxyErrors=!!t.proxyErrors,i?t.end&&e.end():(this[I].push(t.proxyErrors?new is(this,e,t):new Gt(this,e,t)),this[J]?_t(()=>this[qe]()):this[qe]()),e}unpipe(e){let t=this[I].find(i=>i.dest===e);t&&(this[I].length===1?(this[R]&&this[Ne]===0&&(this[R]=!1),this[I]=[]):this[I].splice(this[I].indexOf(t),1),t.unpipe())}addListener(e,t){return this.on(e,t)}on(e,t){let i=super.on(e,t);if(e==="data")this[x]=!1,this[Ne]++,!this[I].length&&!this[R]&&this[qe]();else if(e==="readable"&&this[v]!==0)super.emit("readable");else if(Io(e)&&this[we])super.emit(e),this.removeAllListeners(e);else if(e==="error"&&this[dt]){let r=t;this[J]?_t(()=>r.call(this,this[dt])):r.call(this,this[dt])}return i}removeListener(e,t){return this.off(e,t)}off(e,t){let i=super.off(e,t);return e==="data"&&(this[Ne]=this.listeners("data").length,this[Ne]===0&&!this[x]&&!this[I].length&&(this[R]=!1)),i}removeAllListeners(e){let t=super.removeAllListeners(e);return(e==="data"||e===void 0)&&(this[Ne]=0,!this[x]&&!this[I].length&&(this[R]=!1)),t}get emittedEnd(){return this[we]}[ue](){!this[jt]&&!this[we]&&!this[y]&&this[O].length===0&&this[ce]&&(this[jt]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ut]&&this.emit("close"),this[jt]=!1)}emit(e,...t){let i=t[0];if(e!=="error"&&e!=="close"&&e!==y&&this[y])return!1;if(e==="data")return!this[N]&&!i?!1:this[J]?(_t(()=>this[Ji](i)),!0):this[Ji](i);if(e==="end")return this[Ur]();if(e==="close"){if(this[Ut]=!0,!this[we]&&!this[y])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(e==="error"){this[dt]=i,super.emit(Qi,i);let n=!this[pt]||this.listeners("error").length?super.emit("error",i):!1;return this[ue](),n}else if(e==="resume"){let n=super.emit("resume");return this[ue](),n}else if(e==="finish"||e==="prefinish"){let n=super.emit(e);return this.removeAllListeners(e),n}let r=super.emit(e,...t);return this[ue](),r}[Ji](e){for(let i of this[I])i.dest.write(e)===!1&&this.pause();let t=this[x]?!1:super.emit("data",e);return this[ue](),t}[Ur](){return this[we]?!1:(this[we]=!0,this.readable=!1,this[J]?(_t(()=>this[es]()),!0):this[es]())}[es](){if(this[Ue]){let t=this[Ue].end();if(t){for(let i of this[I])i.dest.write(t);this[x]||super.emit("data",t)}}for(let t of this[I])t.end();let e=super.emit("end");return this.removeAllListeners("end"),e}async collect(){let e=Object.assign([],{dataLength:0});this[N]||(e.dataLength=0);let t=this.promise();return this.on("data",i=>{e.push(i),this[N]||(e.dataLength+=i.length)}),await t,e}async concat(){if(this[N])throw new Error("cannot concat in objectMode");let e=await this.collect();return this[K]?e.join(""):Buffer.concat(e,e.dataLength)}async promise(){return new Promise((e,t)=>{this.on(y,()=>t(new Error("stream destroyed"))),this.on("error",i=>t(i)),this.on("end",()=>e())})}[Symbol.asyncIterator](){this[x]=!1;let e=!1,t=async()=>(this.pause(),e=!0,{value:void 0,done:!0});return{next:()=>{if(e)return t();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[ce])return t();let n,o,a=u=>{this.off("data",h),this.off("end",l),this.off(y,c),t(),o(u)},h=u=>{this.off("error",a),this.off("end",l),this.off(y,c),this.pause(),n({value:u,done:!!this[ce]})},l=()=>{this.off("error",a),this.off("data",h),this.off(y,c),t(),n({done:!0,value:void 0})},c=()=>a(new Error("stream destroyed"));return new Promise((u,E)=>{o=E,n=u,this.once(y,c),this.once("error",a),this.once("end",l),this.once("data",h)})},throw:t,return:t,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[x]=!1;let e=!1,t=()=>(this.pause(),this.off(Qi,t),this.off(y,t),this.off("end",t),e=!0,{done:!0,value:void 0}),i=()=>{if(e)return t();let r=this.read();return r===null?t():{done:!1,value:r}};return this.once("end",t),this.once(Qi,t),this.once(y,t),{next:i,throw:t,return:t,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(e){if(this[y])return e?this.emit("error",e):this.emit(y),this;this[y]=!0,this[x]=!0,this[O].length=0,this[v]=0;let t=this;return typeof t.close=="function"&&!this[Ut]&&t.close(),e?this.emit("error",e):this.emit(y),this}static get isStream(){return F.isStream}};F.Minipass=Zt});var Ke=d(W=>{"use strict";var Wr=W&&W.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(W,"__esModule",{value:!0});W.WriteStreamSync=W.WriteStream=W.ReadStreamSync=W.ReadStream=void 0;var ko=Wr(require("events")),z=Wr(require("fs")),xo=We(),jo=z.default.writev,Ee=Symbol("_autoClose"),$=Symbol("_close"),wt=Symbol("_ended"),p=Symbol("_fd"),rs=Symbol("_finished"),de=Symbol("_flags"),ns=Symbol("_flush"),ls=Symbol("_handleChunk"),cs=Symbol("_makeBuf"),Et=Symbol("_mode"),Yt=Symbol("_needDrain"),Ze=Symbol("_onerror"),Ye=Symbol("_onopen"),os=Symbol("_onread"),He=Symbol("_onwrite"),be=Symbol("_open"),V=Symbol("_path"),ye=Symbol("_pos"),ee=Symbol("_queue"),Ge=Symbol("_read"),as=Symbol("_readSize"),fe=Symbol("_reading"),yt=Symbol("_remain"),hs=Symbol("_size"),Kt=Symbol("_write"),Me=Symbol("_writing"),Vt=Symbol("_defaultFlag"),Le=Symbol("_errored"),$t=class extends xo.Minipass{[Le]=!1;[p];[V];[as];[fe]=!1;[hs];[yt];[Ee];constructor(e,t){if(t=t||{},super(t),this.readable=!0,this.writable=!1,typeof e!="string")throw new TypeError("path must be a string");this[Le]=!1,this[p]=typeof t.fd=="number"?t.fd:void 0,this[V]=e,this[as]=t.readSize||16*1024*1024,this[fe]=!1,this[hs]=typeof t.size=="number"?t.size:1/0,this[yt]=this[hs],this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0,typeof this[p]=="number"?this[Ge]():this[be]()}get fd(){return this[p]}get path(){return this[V]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[be](){z.default.open(this[V],"r",(e,t)=>this[Ye](e,t))}[Ye](e,t){e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Ge]())}[cs](){return Buffer.allocUnsafe(Math.min(this[as],this[yt]))}[Ge](){if(!this[fe]){this[fe]=!0;let e=this[cs]();if(e.length===0)return process.nextTick(()=>this[os](null,0,e));z.default.read(this[p],e,0,e.length,null,(t,i,r)=>this[os](t,i,r))}}[os](e,t,i){this[fe]=!1,e?this[Ze](e):this[ls](t,i)&&this[Ge]()}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}[Ze](e){this[fe]=!0,this[$](),this.emit("error",e)}[ls](e,t){let i=!1;return this[yt]-=e,e>0&&(i=super.write(e<t.length?t.subarray(0,e):t)),(e===0||this[yt]<=0)&&(i=!1,this[$](),super.end()),i}emit(e,...t){switch(e){case"prefinish":case"finish":return!1;case"drain":return typeof this[p]=="number"&&this[Ge](),!1;case"error":return this[Le]?!1:(this[Le]=!0,super.emit(e,...t));default:return super.emit(e,...t)}}};W.ReadStream=$t;var us=class extends $t{[be](){let e=!0;try{this[Ye](null,z.default.openSync(this[V],"r")),e=!1}finally{e&&this[$]()}}[Ge](){let e=!0;try{if(!this[fe]){this[fe]=!0;do{let t=this[cs](),i=t.length===0?0:z.default.readSync(this[p],t,0,t.length,null);if(!this[ls](i,t))break}while(!0);this[fe]=!1}e=!1}finally{e&&this[$]()}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}};W.ReadStreamSync=us;var Xt=class extends ko.default{readable=!1;writable=!0;[Le]=!1;[Me]=!1;[wt]=!1;[ee]=[];[Yt]=!1;[V];[Et];[Ee];[p];[Vt];[de];[rs]=!1;[ye];constructor(e,t){t=t||{},super(t),this[V]=e,this[p]=typeof t.fd=="number"?t.fd:void 0,this[Et]=t.mode===void 0?438:t.mode,this[ye]=typeof t.start=="number"?t.start:void 0,this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0;let i=this[ye]!==void 0?"r+":"w";this[Vt]=t.flags===void 0,this[de]=t.flags===void 0?i:t.flags,this[p]===void 0&&this[be]()}emit(e,...t){if(e==="error"){if(this[Le])return!1;this[Le]=!0}return super.emit(e,...t)}get fd(){return this[p]}get path(){return this[V]}[Ze](e){this[$](),this[Me]=!0,this.emit("error",e)}[be](){z.default.open(this[V],this[de],this[Et],(e,t)=>this[Ye](e,t))}[Ye](e,t){this[Vt]&&this[de]==="r+"&&e&&e.code==="ENOENT"?(this[de]="w",this[be]()):e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Me]||this[ns]())}end(e,t){return e&&this.write(e,t),this[wt]=!0,!this[Me]&&!this[ee].length&&typeof this[p]=="number"&&this[He](null,0),this}write(e,t){return typeof e=="string"&&(e=Buffer.from(e,t)),this[wt]?(this.emit("error",new Error("write() after end()")),!1):this[p]===void 0||this[Me]||this[ee].length?(this[ee].push(e),this[Yt]=!0,!1):(this[Me]=!0,this[Kt](e),!0)}[Kt](e){z.default.write(this[p],e,0,e.length,this[ye],(t,i)=>this[He](t,i))}[He](e,t){e?this[Ze](e):(this[ye]!==void 0&&typeof t=="number"&&(this[ye]+=t),this[ee].length?this[ns]():(this[Me]=!1,this[wt]&&!this[rs]?(this[rs]=!0,this[$](),this.emit("finish")):this[Yt]&&(this[Yt]=!1,this.emit("drain"))))}[ns](){if(this[ee].length===0)this[wt]&&this[He](null,0);else if(this[ee].length===1)this[Kt](this[ee].pop());else{let e=this[ee];this[ee]=[],jo(this[p],e,this[ye],(t,i)=>this[He](t,i))}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}};W.WriteStream=Xt;var fs=class extends Xt{[be](){let e;if(this[Vt]&&this[de]==="r+")try{e=z.default.openSync(this[V],this[de],this[Et])}catch(t){if(t?.code==="ENOENT")return this[de]="w",this[be]();throw t}else e=z.default.openSync(this[V],this[de],this[Et]);this[Ye](null,e)}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}[Kt](e){let t=!0;try{this[He](null,z.default.writeSync(this[p],e,0,e.length,this[ye])),t=!1}finally{if(t)try{this[$]()}catch{}}}};W.WriteStreamSync=fs});var Qt=d(b=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});b.dealias=b.isNoFile=b.isFile=b.isAsync=b.isSync=b.isAsyncNoFile=b.isSyncNoFile=b.isAsyncFile=b.isSyncFile=void 0;var Uo=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),qo=s=>!!s.sync&&!!s.file;b.isSyncFile=qo;var Wo=s=>!s.sync&&!!s.file;b.isAsyncFile=Wo;var Ho=s=>!!s.sync&&!s.file;b.isSyncNoFile=Ho;var Go=s=>!s.sync&&!s.file;b.isAsyncNoFile=Go;var Zo=s=>!!s.sync;b.isSync=Zo;var Yo=s=>!s.sync;b.isAsync=Yo;var Ko=s=>!!s.file;b.isFile=Ko;var Vo=s=>!s.file;b.isNoFile=Vo;var $o=s=>{let e=Uo.get(s);return e||s},Xo=(s={})=>{if(!s)return{};let e={};for(let[t,i]of Object.entries(s)){let r=$o(t);e[r]=i}return e.chmod===void 0&&e.noChmod===!1&&(e.chmod=!0),delete e.noChmod,e};b.dealias=Xo});var Ve=d(Jt=>{"use strict";Object.defineProperty(Jt,"__esModule",{value:!0});Jt.makeCommand=void 0;var bt=Qt(),Qo=(s,e,t,i,r)=>Object.assign((n=[],o,a)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(a=o,o=void 0),o=o?Array.from(o):[];let h=(0,bt.dealias)(n);if(r?.(h,o),(0,bt.isSyncFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return s(h,o)}else if((0,bt.isAsyncFile)(h)){let l=e(h,o);return a?l.then(()=>a(),a):l}else if((0,bt.isSyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return t(h,o)}else if((0,bt.isAsyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback only supported with file option");return i(h,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:e,syncNoFile:t,asyncNoFile:i,validate:r});Jt.makeCommand=Qo});var ds=d($e=>{"use strict";var Jo=$e&&$e.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty($e,"__esModule",{value:!0});$e.constants=void 0;var ea=Jo(require("zlib")),ta=ea.default.constants||{ZLIB_VERNUM:4736};$e.constants=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},ta))});var Ps=d(f=>{"use strict";var ia=f&&f.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),sa=f&&f.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),ra=f&&f.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ia(t,e,i[r]);return sa(t,e),t}})(),na=f&&f.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(f,"__esModule",{value:!0});f.ZstdDecompress=f.ZstdCompress=f.BrotliDecompress=f.BrotliCompress=f.Unzip=f.InflateRaw=f.DeflateRaw=f.Gunzip=f.Gzip=f.Inflate=f.Deflate=f.Zlib=f.ZlibError=f.constants=void 0;var _s=na(require("assert")),Ae=require("buffer"),oa=We(),Hr=ra(require("zlib")),te=ds(),aa=ds();Object.defineProperty(f,"constants",{enumerable:!0,get:function(){return aa.constants}});var ha=Ae.Buffer.concat,Gr=Object.getOwnPropertyDescriptor(Ae.Buffer,"concat"),la=s=>s,ms=Gr?.writable===!0||Gr?.set!==void 0?s=>{Ae.Buffer.concat=s?la:ha}:s=>{},Ie=Symbol("_superWrite"),Fe=class extends Error{code;errno;constructor(e,t){super("zlib: "+e.message,{cause:e}),this.code=e.code,this.errno=e.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+e.message,Error.captureStackTrace(this,t??this.constructor)}get name(){return"ZlibError"}};f.ZlibError=Fe;var ps=Symbol("flushFlag"),St=class extends oa.Minipass{#e=!1;#i=!1;#s;#n;#r;#t;#o;get sawError(){return this.#e}get handle(){return this.#t}get flushFlag(){return this.#s}constructor(e,t){if(!e||typeof e!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(e),this.#s=e.flush??0,this.#n=e.finishFlush??0,this.#r=e.fullFlushFlag??0,typeof Hr[t]!="function")throw new TypeError("Compression method not supported: "+t);try{this.#t=new Hr[t](e)}catch(i){throw new Fe(i,this.constructor)}this.#o=i=>{this.#e||(this.#e=!0,this.close(),this.emit("error",i))},this.#t?.on("error",i=>this.#o(new Fe(i))),this.once("end",()=>this.close)}close(){this.#t&&(this.#t.close(),this.#t=void 0,this.emit("close"))}reset(){if(!this.#e)return(0,_s.default)(this.#t,"zlib binding closed"),this.#t.reset?.()}flush(e){this.ended||(typeof e!="number"&&(e=this.#r),this.write(Object.assign(Ae.Buffer.alloc(0),{[ps]:e})))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&(t?this.write(e,t):this.write(e)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Ie](e){return super.write(e)}write(e,t,i){if(typeof t=="function"&&(i=t,t="utf8"),typeof e=="string"&&(e=Ae.Buffer.from(e,t)),this.#e)return;(0,_s.default)(this.#t,"zlib binding closed");let r=this.#t._handle,n=r.close;r.close=()=>{};let o=this.#t.close;this.#t.close=()=>{},ms(!0);let a;try{let l=typeof e[ps]=="number"?e[ps]:this.#s;a=this.#t._processChunk(e,l),ms(!1)}catch(l){ms(!1),this.#o(new Fe(l,this.write))}finally{this.#t&&(this.#t._handle=r,r.close=n,this.#t.close=o,this.#t.removeAllListeners("error"))}this.#t&&this.#t.on("error",l=>this.#o(new Fe(l,this.write)));let h;if(a)if(Array.isArray(a)&&a.length>0){let l=a[0];h=this[Ie](Ae.Buffer.from(l));for(let c=1;c<a.length;c++)h=this[Ie](a[c])}else h=this[Ie](Ae.Buffer.from(a));return i&&i(),h}},ie=class extends St{#e;#i;constructor(e,t){e=e||{},e.flush=e.flush||te.constants.Z_NO_FLUSH,e.finishFlush=e.finishFlush||te.constants.Z_FINISH,e.fullFlushFlag=te.constants.Z_FULL_FLUSH,super(e,t),this.#e=e.level,this.#i=e.strategy}params(e,t){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#e!==e||this.#i!==t){this.flush(te.constants.Z_SYNC_FLUSH),(0,_s.default)(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(e,t)}finally{this.handle.flush=i}this.handle&&(this.#e=e,this.#i=t)}}}};f.Zlib=ie;var ws=class extends ie{constructor(e){super(e,"Deflate")}};f.Deflate=ws;var ys=class extends ie{constructor(e){super(e,"Inflate")}};f.Inflate=ys;var Es=class extends ie{#e;constructor(e){super(e,"Gzip"),this.#e=e&&!!e.portable}[Ie](e){return this.#e?(this.#e=!1,e[9]=255,super[Ie](e)):super[Ie](e)}};f.Gzip=Es;var bs=class extends ie{constructor(e){super(e,"Gunzip")}};f.Gunzip=bs;var Ss=class extends ie{constructor(e){super(e,"DeflateRaw")}};f.DeflateRaw=Ss;var gs=class extends ie{constructor(e){super(e,"InflateRaw")}};f.InflateRaw=gs;var Rs=class extends ie{constructor(e){super(e,"Unzip")}};f.Unzip=Rs;var ei=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.BROTLI_OPERATION_PROCESS,e.finishFlush=e.finishFlush||te.constants.BROTLI_OPERATION_FINISH,e.fullFlushFlag=te.constants.BROTLI_OPERATION_FLUSH,super(e,t)}},Os=class extends ei{constructor(e){super(e,"BrotliCompress")}};f.BrotliCompress=Os;var vs=class extends ei{constructor(e){super(e,"BrotliDecompress")}};f.BrotliDecompress=vs;var ti=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.ZSTD_e_continue,e.finishFlush=e.finishFlush||te.constants.ZSTD_e_end,e.fullFlushFlag=te.constants.ZSTD_e_flush,super(e,t)}},Ts=class extends ti{constructor(e){super(e,"ZstdCompress")}};f.ZstdCompress=Ts;var Ds=class extends ti{constructor(e){super(e,"ZstdDecompress")}};f.ZstdDecompress=Ds});var Kr=d(Xe=>{"use strict";Object.defineProperty(Xe,"__esModule",{value:!0});Xe.parse=Xe.encode=void 0;var ca=(s,e)=>{if(Number.isSafeInteger(s))s<0?fa(s,e):ua(s,e);else throw Error("cannot encode number outside of javascript safe integer range");return e};Xe.encode=ca;var ua=(s,e)=>{e[0]=128;for(var t=e.length;t>1;t--)e[t-1]=s&255,s=Math.floor(s/256)},fa=(s,e)=>{e[0]=255;var t=!1;s=s*-1;for(var i=e.length;i>1;i--){var r=s&255;s=Math.floor(s/256),t?e[i-1]=Zr(r):r===0?e[i-1]=0:(t=!0,e[i-1]=Yr(r))}},da=s=>{let e=s[0],t=e===128?pa(s.subarray(1,s.length)):e===255?ma(s):null;if(t===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(t))throw Error("parsed number outside of javascript safe integer range");return t};Xe.parse=da;var ma=s=>{for(var e=s.length,t=0,i=!1,r=e-1;r>-1;r--){var n=Number(s[r]),o;i?o=Zr(n):n===0?o=n:(i=!0,o=Yr(n)),o!==0&&(t-=o*Math.pow(256,e-r-1))}return t},pa=s=>{for(var e=s.length,t=0,i=e-1;i>-1;i--){var r=Number(s[i]);r!==0&&(t+=r*Math.pow(256,e-i-1))}return t},Zr=s=>(255^s)&255,Yr=s=>(255^s)+1&255});var Ns=d(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.code=C.name=C.normalFsTypes=C.isName=C.isCode=void 0;var _a=s=>C.name.has(s);C.isCode=_a;var wa=s=>C.code.has(s);C.isName=wa;C.normalFsTypes=new Set(["0","","1","2","3","4","5","6","7","D"]);C.name=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]);C.code=new Map(Array.from(C.name).map(s=>[s[1],s[0]]))});var et=d(se=>{"use strict";var ya=se&&se.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ea=se&&se.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Vr=se&&se.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ya(t,e,i[r]);return Ea(t,e),t}})();Object.defineProperty(se,"__esModule",{value:!0});se.Header=void 0;var Qe=require("node:path"),$r=Vr(Kr()),Je=Vr(Ns()),ba=s=>s===void 0||s<0?void 0:s,As=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#e="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(e,t=0,i,r){Buffer.isBuffer(e)?this.decode(e,t||0,i,r):e&&this.#i(e)}decode(e,t,i,r){if(t||(t=0),!e||!(e.length>=t+512))throw new Error("need 512 bytes for header");let n=Ce(e,t+156,1),o=Je.normalFsTypes.has(n),a=o?i:void 0,h=o?r:void 0;if(this.path=a?.path??Ce(e,t,100),this.mode=a?.mode??h?.mode??Se(e,t+100,8),this.uid=a?.uid??h?.uid??Se(e,t+108,8),this.gid=a?.gid??h?.gid??Se(e,t+116,8),this.size=ba(a?.size??h?.size??Se(e,t+124,12)),this.mtime=a?.mtime??h?.mtime??Ms(e,t+136,12),this.cksum=Se(e,t+148,12),h&&this.#i(h,!0),a&&this.#i(a),Je.isCode(n)&&(this.#e=n||"0"),this.#e==="0"&&this.path.slice(-1)==="/"&&(this.#e="5"),this.#e==="5"&&(this.size=0),this.linkpath=Ce(e,t+157,100),e.subarray(t+257,t+265).toString()==="ustar\x0000")if(this.uname=a?.uname??h?.uname??Ce(e,t+265,32),this.gname=a?.gname??h?.gname??Ce(e,t+297,32),this.devmaj=a?.devmaj??h?.devmaj??Se(e,t+329,8)??0,this.devmin=a?.devmin??h?.devmin??Se(e,t+337,8)??0,e[t+475]!==0){let c=Ce(e,t+345,155);this.path=c+"/"+this.path}else{let c=Ce(e,t+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Ms(e,t+476,12),this.ctime=i?.ctime??r?.ctime??Ms(e,t+488,12)}let l=256;for(let c=t;c<t+148;c++)l+=e[c];for(let c=t+156;c<t+512;c++)l+=e[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(e,t=!1){Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&t||i==="linkpath"&&t||i==="global"))))}encode(e,t=0){if(e||(e=this.block=Buffer.alloc(512)),this.#e==="Unsupported"&&(this.#e="0"),!(e.length>=t+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=Sa(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Be(e,t,100,n)||this.needPax,this.needPax=ge(e,t+100,8,this.mode)||this.needPax,this.needPax=ge(e,t+108,8,this.uid)||this.needPax,this.needPax=ge(e,t+116,8,this.gid)||this.needPax,this.needPax=ge(e,t+124,12,this.size)||this.needPax,this.needPax=Ls(e,t+136,12,this.mtime)||this.needPax,e[t+156]=Number(this.#e.codePointAt(0)),this.needPax=Be(e,t+157,100,this.linkpath)||this.needPax,e.write("ustar\x0000",t+257,8),this.needPax=Be(e,t+265,32,this.uname)||this.needPax,this.needPax=Be(e,t+297,32,this.gname)||this.needPax,this.needPax=ge(e,t+329,8,this.devmaj)||this.needPax,this.needPax=ge(e,t+337,8,this.devmin)||this.needPax,this.needPax=Be(e,t+345,i,o)||this.needPax,e[t+475]!==0?this.needPax=Be(e,t+345,155,o)||this.needPax:(this.needPax=Be(e,t+345,130,o)||this.needPax,this.needPax=Ls(e,t+476,12,this.atime)||this.needPax,this.needPax=Ls(e,t+488,12,this.ctime)||this.needPax);let a=256;for(let h=t;h<t+148;h++)a+=e[h];for(let h=t+156;h<t+512;h++)a+=e[h];return this.cksum=a,ge(e,t+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#e==="Unsupported"?this.#e:Je.name.get(this.#e)}get typeKey(){return this.#e}set type(e){let t=String(Je.code.get(e));if(Je.isCode(t)||t==="Unsupported")this.#e=t;else if(Je.isCode(e))this.#e=e;else throw new TypeError("invalid entry type: "+e)}};se.Header=As;var Sa=(s,e)=>{let i=s,r="",n,o=Qe.posix.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Qe.posix.dirname(i),i=Qe.posix.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=e?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=e?n=[i.slice(0,99),r,!0]:(i=Qe.posix.join(Qe.posix.basename(r),i),r=Qe.posix.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},Ce=(s,e,t)=>s.subarray(e,e+t).toString("utf8").replace(/\0.*/,""),Ms=(s,e,t)=>ga(Se(s,e,t)),ga=s=>s===void 0?void 0:new Date(s*1e3),Se=(s,e,t)=>Number(s[e])&128?$r.parse(s.subarray(e,e+t)):Oa(s,e,t),Ra=s=>isNaN(s)?void 0:s,Oa=(s,e,t)=>Ra(parseInt(s.subarray(e,e+t).toString("utf8").replace(/\0.*$/,"").trim(),8)),va={12:8589934591,8:2097151},ge=(s,e,t,i)=>i===void 0?!1:i>va[t]||i<0?($r.encode(i,s.subarray(e,e+t)),!0):(Ta(s,e,t,i),!1),Ta=(s,e,t,i)=>s.write(Da(i,t),e,t,"ascii"),Da=(s,e)=>Pa(Math.floor(s).toString(8),e),Pa=(s,e)=>(s.length===e-1?s:new Array(e-s.length-1).join("0")+s+" ")+"\0",Ls=(s,e,t,i)=>i===void 0?!1:ge(s,e,t,i.getTime()/1e3),Na=new Array(156).join("\0"),Be=(s,e,t,i)=>i===void 0?!1:(s.write(i+Na,e,t,"utf8"),i.length!==Buffer.byteLength(i)||i.length>t)});var si=d(ii=>{"use strict";Object.defineProperty(ii,"__esModule",{value:!0});ii.Pax=void 0;var Ma=require("node:path"),La=et(),Is=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(e,t=!1){this.atime=e.atime,this.charset=e.charset,this.comment=e.comment,this.ctime=e.ctime,this.dev=e.dev,this.gid=e.gid,this.global=t,this.gname=e.gname,this.ino=e.ino,this.linkpath=e.linkpath,this.mtime=e.mtime,this.nlink=e.nlink,this.path=e.path,this.size=e.size,this.uid=e.uid,this.uname=e.uname}encode(){let e=this.encodeBody();if(e==="")return Buffer.allocUnsafe(0);let t=Buffer.byteLength(e),i=512*Math.ceil(1+t/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new La.Header({path:("PaxHeader/"+(0,Ma.basename)(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:t,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(e,512,t,"utf8");for(let n=t+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(e){if(this[e]===void 0)return"";let t=this[e],i=t instanceof Date?t.getTime()/1e3:t,r=" "+(e==="dev"||e==="ino"||e==="nlink"?"SCHILY.":"")+e+"="+i+`
+"use strict";var d=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports);var We=d(F=>{"use strict";var Do=F&&F.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(F,"__esModule",{value:!0});F.Minipass=F.isWritable=F.isReadable=F.isStream=void 0;var kr=typeof process=="object"&&process?process:{stdout:null,stderr:null},ss=require("node:events"),qr=Do(require("node:stream")),Po=require("node:string_decoder"),No=s=>!!s&&typeof s=="object"&&(s instanceof Zt||s instanceof qr.default||(0,F.isReadable)(s)||(0,F.isWritable)(s));F.isStream=No;var Mo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.pipe=="function"&&s.pipe!==qr.default.Writable.prototype.pipe;F.isReadable=Mo;var Lo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.write=="function"&&typeof s.end=="function";F.isWritable=Lo;var ce=Symbol("EOF"),ue=Symbol("maybeEmitEnd"),we=Symbol("emittedEnd"),jt=Symbol("emittingEnd"),dt=Symbol("emittedError"),Ut=Symbol("closed"),xr=Symbol("read"),qt=Symbol("flush"),jr=Symbol("flushChunk"),K=Symbol("encoding"),Ue=Symbol("decoder"),R=Symbol("flowing"),mt=Symbol("paused"),qe=Symbol("resume"),O=Symbol("buffer"),I=Symbol("pipes"),v=Symbol("bufferLength"),Xi=Symbol("bufferPush"),Wt=Symbol("bufferShift"),N=Symbol("objectMode"),E=Symbol("destroyed"),Qi=Symbol("error"),Ji=Symbol("emitData"),Ur=Symbol("emitEnd"),es=Symbol("emitEnd2"),J=Symbol("async"),ts=Symbol("abort"),Ht=Symbol("aborted"),pt=Symbol("signal"),Ne=Symbol("dataListeners"),x=Symbol("discarded"),_t=s=>Promise.resolve().then(s),Ao=s=>s(),Io=s=>s==="end"||s==="finish"||s==="prefinish",Fo=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,Co=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Gt=class{src;dest;opts;ondrain;constructor(e,t,i){this.src=e,this.dest=t,this.opts=i,this.ondrain=()=>e[qe](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(e){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},is=class extends Gt{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(e,t,i){super(e,t,i),this.proxyErrors=r=>this.dest.emit("error",r),e.on("error",this.proxyErrors)}},Bo=s=>!!s.objectMode,zo=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",Zt=class extends ss.EventEmitter{[R]=!1;[mt]=!1;[I]=[];[O]=[];[N];[K];[J];[Ue];[ce]=!1;[we]=!1;[jt]=!1;[Ut]=!1;[dt]=null;[v]=0;[E]=!1;[pt];[Ht]=!1;[Ne]=0;[x]=!1;writable=!0;readable=!0;constructor(...e){let t=e[0]||{};if(super(),t.objectMode&&typeof t.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Bo(t)?(this[N]=!0,this[K]=null):zo(t)?(this[K]=t.encoding,this[N]=!1):(this[N]=!1,this[K]=null),this[J]=!!t.async,this[Ue]=this[K]?new Po.StringDecoder(this[K]):null,t&&t.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[O]}),t&&t.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[I]});let{signal:i}=t;i&&(this[pt]=i,i.aborted?this[ts]():i.addEventListener("abort",()=>this[ts]()))}get bufferLength(){return this[v]}get encoding(){return this[K]}set encoding(e){throw new Error("Encoding must be set at instantiation time")}setEncoding(e){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[N]}set objectMode(e){throw new Error("objectMode must be set at instantiation time")}get async(){return this[J]}set async(e){this[J]=this[J]||!!e}[ts](){this[Ht]=!0,this.emit("abort",this[pt]?.reason),this.destroy(this[pt]?.reason)}get aborted(){return this[Ht]}set aborted(e){}write(e,t,i){if(this[Ht])return!1;if(this[ce])throw new Error("write after end");if(this[E])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof t=="function"&&(i=t,t="utf8"),t||(t="utf8");let r=this[J]?_t:Ao;if(!this[N]&&!Buffer.isBuffer(e)){if(Co(e))e=Buffer.from(e.buffer,e.byteOffset,e.byteLength);else if(Fo(e))e=Buffer.from(e);else if(typeof e!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[N]?(this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):e.length?(typeof e=="string"&&!(t===this[K]&&!this[Ue]?.lastNeed)&&(e=Buffer.from(e,t)),Buffer.isBuffer(e)&&this[K]&&(e=this[Ue].write(e)),this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):(this[v]!==0&&this.emit("readable"),i&&r(i),this[R])}read(e){if(this[E])return null;if(this[x]=!1,this[v]===0||e===0||e&&e>this[v])return this[ue](),null;this[N]&&(e=null),this[O].length>1&&!this[N]&&(this[O]=[this[K]?this[O].join(""):Buffer.concat(this[O],this[v])]);let t=this[xr](e||null,this[O][0]);return this[ue](),t}[xr](e,t){if(this[N])this[Wt]();else{let i=t;e===i.length||e===null?this[Wt]():typeof i=="string"?(this[O][0]=i.slice(e),t=i.slice(0,e),this[v]-=e):(this[O][0]=i.subarray(e),t=i.subarray(0,e),this[v]-=e)}return this.emit("data",t),!this[O].length&&!this[ce]&&this.emit("drain"),t}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t="utf8"),e!==void 0&&this.write(e,t),i&&this.once("end",i),this[ce]=!0,this.writable=!1,(this[R]||!this[mt])&&this[ue](),this}[qe](){this[E]||(!this[Ne]&&!this[I].length&&(this[x]=!0),this[mt]=!1,this[R]=!0,this.emit("resume"),this[O].length?this[qt]():this[ce]?this[ue]():this.emit("drain"))}resume(){return this[qe]()}pause(){this[R]=!1,this[mt]=!0,this[x]=!1}get destroyed(){return this[E]}get flowing(){return this[R]}get paused(){return this[mt]}[Xi](e){this[N]?this[v]+=1:this[v]+=e.length,this[O].push(e)}[Wt](){return this[N]?this[v]-=1:this[v]-=this[O][0].length,this[O].shift()}[qt](e=!1){do;while(this[jr](this[Wt]())&&this[O].length);!e&&!this[O].length&&!this[ce]&&this.emit("drain")}[jr](e){return this.emit("data",e),this[R]}pipe(e,t){if(this[E])return e;this[x]=!1;let i=this[we];return t=t||{},e===kr.stdout||e===kr.stderr?t.end=!1:t.end=t.end!==!1,t.proxyErrors=!!t.proxyErrors,i?t.end&&e.end():(this[I].push(t.proxyErrors?new is(this,e,t):new Gt(this,e,t)),this[J]?_t(()=>this[qe]()):this[qe]()),e}unpipe(e){let t=this[I].find(i=>i.dest===e);t&&(this[I].length===1?(this[R]&&this[Ne]===0&&(this[R]=!1),this[I]=[]):this[I].splice(this[I].indexOf(t),1),t.unpipe())}addListener(e,t){return this.on(e,t)}on(e,t){let i=super.on(e,t);if(e==="data")this[x]=!1,this[Ne]++,!this[I].length&&!this[R]&&this[qe]();else if(e==="readable"&&this[v]!==0)super.emit("readable");else if(Io(e)&&this[we])super.emit(e),this.removeAllListeners(e);else if(e==="error"&&this[dt]){let r=t;this[J]?_t(()=>r.call(this,this[dt])):r.call(this,this[dt])}return i}removeListener(e,t){return this.off(e,t)}off(e,t){let i=super.off(e,t);return e==="data"&&(this[Ne]=this.listeners("data").length,this[Ne]===0&&!this[x]&&!this[I].length&&(this[R]=!1)),i}removeAllListeners(e){let t=super.removeAllListeners(e);return(e==="data"||e===void 0)&&(this[Ne]=0,!this[x]&&!this[I].length&&(this[R]=!1)),t}get emittedEnd(){return this[we]}[ue](){!this[jt]&&!this[we]&&!this[E]&&this[O].length===0&&this[ce]&&(this[jt]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ut]&&this.emit("close"),this[jt]=!1)}emit(e,...t){let i=t[0];if(e!=="error"&&e!=="close"&&e!==E&&this[E])return!1;if(e==="data")return!this[N]&&!i?!1:this[J]?(_t(()=>this[Ji](i)),!0):this[Ji](i);if(e==="end")return this[Ur]();if(e==="close"){if(this[Ut]=!0,!this[we]&&!this[E])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(e==="error"){this[dt]=i,super.emit(Qi,i);let n=!this[pt]||this.listeners("error").length?super.emit("error",i):!1;return this[ue](),n}else if(e==="resume"){let n=super.emit("resume");return this[ue](),n}else if(e==="finish"||e==="prefinish"){let n=super.emit(e);return this.removeAllListeners(e),n}let r=super.emit(e,...t);return this[ue](),r}[Ji](e){for(let i of this[I])i.dest.write(e)===!1&&this.pause();let t=this[x]?!1:super.emit("data",e);return this[ue](),t}[Ur](){return this[we]?!1:(this[we]=!0,this.readable=!1,this[J]?(_t(()=>this[es]()),!0):this[es]())}[es](){if(this[Ue]){let t=this[Ue].end();if(t){for(let i of this[I])i.dest.write(t);this[x]||super.emit("data",t)}}for(let t of this[I])t.end();let e=super.emit("end");return this.removeAllListeners("end"),e}async collect(){let e=Object.assign([],{dataLength:0});this[N]||(e.dataLength=0);let t=this.promise();return this.on("data",i=>{e.push(i),this[N]||(e.dataLength+=i.length)}),await t,e}async concat(){if(this[N])throw new Error("cannot concat in objectMode");let e=await this.collect();return this[K]?e.join(""):Buffer.concat(e,e.dataLength)}async promise(){return new Promise((e,t)=>{this.on(E,()=>t(new Error("stream destroyed"))),this.on("error",i=>t(i)),this.on("end",()=>e())})}[Symbol.asyncIterator](){this[x]=!1;let e=!1,t=async()=>(this.pause(),e=!0,{value:void 0,done:!0});return{next:()=>{if(e)return t();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[ce])return t();let n,o,a=u=>{this.off("data",h),this.off("end",l),this.off(E,c),t(),o(u)},h=u=>{this.off("error",a),this.off("end",l),this.off(E,c),this.pause(),n({value:u,done:!!this[ce]})},l=()=>{this.off("error",a),this.off("data",h),this.off(E,c),t(),n({done:!0,value:void 0})},c=()=>a(new Error("stream destroyed"));return new Promise((u,b)=>{o=b,n=u,this.once(E,c),this.once("error",a),this.once("end",l),this.once("data",h)})},throw:t,return:t,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[x]=!1;let e=!1,t=()=>(this.pause(),this.off(Qi,t),this.off(E,t),this.off("end",t),e=!0,{done:!0,value:void 0}),i=()=>{if(e)return t();let r=this.read();return r===null?t():{done:!1,value:r}};return this.once("end",t),this.once(Qi,t),this.once(E,t),{next:i,throw:t,return:t,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(e){if(this[E])return e?this.emit("error",e):this.emit(E),this;this[E]=!0,this[x]=!0,this[O].length=0,this[v]=0;let t=this;return typeof t.close=="function"&&!this[Ut]&&t.close(),e?this.emit("error",e):this.emit(E),this}static get isStream(){return F.isStream}};F.Minipass=Zt});var Ke=d(W=>{"use strict";var Wr=W&&W.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(W,"__esModule",{value:!0});W.WriteStreamSync=W.WriteStream=W.ReadStreamSync=W.ReadStream=void 0;var ko=Wr(require("events")),z=Wr(require("fs")),xo=We(),jo=z.default.writev,Ee=Symbol("_autoClose"),$=Symbol("_close"),wt=Symbol("_ended"),p=Symbol("_fd"),rs=Symbol("_finished"),de=Symbol("_flags"),ns=Symbol("_flush"),ls=Symbol("_handleChunk"),cs=Symbol("_makeBuf"),Et=Symbol("_mode"),Yt=Symbol("_needDrain"),Ze=Symbol("_onerror"),Ye=Symbol("_onopen"),os=Symbol("_onread"),He=Symbol("_onwrite"),be=Symbol("_open"),V=Symbol("_path"),ye=Symbol("_pos"),ee=Symbol("_queue"),Ge=Symbol("_read"),as=Symbol("_readSize"),fe=Symbol("_reading"),yt=Symbol("_remain"),hs=Symbol("_size"),Kt=Symbol("_write"),Me=Symbol("_writing"),Vt=Symbol("_defaultFlag"),Le=Symbol("_errored"),$t=class extends xo.Minipass{[Le]=!1;[p];[V];[as];[fe]=!1;[hs];[yt];[Ee];constructor(e,t){if(t=t||{},super(t),this.readable=!0,this.writable=!1,typeof e!="string")throw new TypeError("path must be a string");this[Le]=!1,this[p]=typeof t.fd=="number"?t.fd:void 0,this[V]=e,this[as]=t.readSize||16*1024*1024,this[fe]=!1,this[hs]=typeof t.size=="number"?t.size:1/0,this[yt]=this[hs],this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0,typeof this[p]=="number"?this[Ge]():this[be]()}get fd(){return this[p]}get path(){return this[V]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[be](){z.default.open(this[V],"r",(e,t)=>this[Ye](e,t))}[Ye](e,t){e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Ge]())}[cs](){return Buffer.allocUnsafe(Math.min(this[as],this[yt]))}[Ge](){if(!this[fe]){this[fe]=!0;let e=this[cs]();if(e.length===0)return process.nextTick(()=>this[os](null,0,e));z.default.read(this[p],e,0,e.length,null,(t,i,r)=>this[os](t,i,r))}}[os](e,t,i){this[fe]=!1,e?this[Ze](e):this[ls](t,i)&&this[Ge]()}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}[Ze](e){this[fe]=!0,this[$](),this.emit("error",e)}[ls](e,t){let i=!1;return this[yt]-=e,e>0&&(i=super.write(e<t.length?t.subarray(0,e):t)),(e===0||this[yt]<=0)&&(i=!1,this[$](),super.end()),i}emit(e,...t){switch(e){case"prefinish":case"finish":return!1;case"drain":return typeof this[p]=="number"&&this[Ge](),!1;case"error":return this[Le]?!1:(this[Le]=!0,super.emit(e,...t));default:return super.emit(e,...t)}}};W.ReadStream=$t;var us=class extends $t{[be](){let e=!0;try{this[Ye](null,z.default.openSync(this[V],"r")),e=!1}finally{e&&this[$]()}}[Ge](){let e=!0;try{if(!this[fe]){this[fe]=!0;do{let t=this[cs](),i=t.length===0?0:z.default.readSync(this[p],t,0,t.length,null);if(!this[ls](i,t))break}while(!0);this[fe]=!1}e=!1}finally{e&&this[$]()}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}};W.ReadStreamSync=us;var Xt=class extends ko.default{readable=!1;writable=!0;[Le]=!1;[Me]=!1;[wt]=!1;[ee]=[];[Yt]=!1;[V];[Et];[Ee];[p];[Vt];[de];[rs]=!1;[ye];constructor(e,t){t=t||{},super(t),this[V]=e,this[p]=typeof t.fd=="number"?t.fd:void 0,this[Et]=t.mode===void 0?438:t.mode,this[ye]=typeof t.start=="number"?t.start:void 0,this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0;let i=this[ye]!==void 0?"r+":"w";this[Vt]=t.flags===void 0,this[de]=t.flags===void 0?i:t.flags,this[p]===void 0&&this[be]()}emit(e,...t){if(e==="error"){if(this[Le])return!1;this[Le]=!0}return super.emit(e,...t)}get fd(){return this[p]}get path(){return this[V]}[Ze](e){this[$](),this[Me]=!0,this.emit("error",e)}[be](){z.default.open(this[V],this[de],this[Et],(e,t)=>this[Ye](e,t))}[Ye](e,t){this[Vt]&&this[de]==="r+"&&e&&e.code==="ENOENT"?(this[de]="w",this[be]()):e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Me]||this[ns]())}end(e,t){return e&&this.write(e,t),this[wt]=!0,!this[Me]&&!this[ee].length&&typeof this[p]=="number"&&this[He](null,0),this}write(e,t){return typeof e=="string"&&(e=Buffer.from(e,t)),this[wt]?(this.emit("error",new Error("write() after end()")),!1):this[p]===void 0||this[Me]||this[ee].length?(this[ee].push(e),this[Yt]=!0,!1):(this[Me]=!0,this[Kt](e),!0)}[Kt](e){z.default.write(this[p],e,0,e.length,this[ye],(t,i)=>this[He](t,i))}[He](e,t){e?this[Ze](e):(this[ye]!==void 0&&typeof t=="number"&&(this[ye]+=t),this[ee].length?this[ns]():(this[Me]=!1,this[wt]&&!this[rs]?(this[rs]=!0,this[$](),this.emit("finish")):this[Yt]&&(this[Yt]=!1,this.emit("drain"))))}[ns](){if(this[ee].length===0)this[wt]&&this[He](null,0);else if(this[ee].length===1)this[Kt](this[ee].pop());else{let e=this[ee];this[ee]=[],jo(this[p],e,this[ye],(t,i)=>this[He](t,i))}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}};W.WriteStream=Xt;var fs=class extends Xt{[be](){let e;if(this[Vt]&&this[de]==="r+")try{e=z.default.openSync(this[V],this[de],this[Et])}catch(t){if(t?.code==="ENOENT")return this[de]="w",this[be]();throw t}else e=z.default.openSync(this[V],this[de],this[Et]);this[Ye](null,e)}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}[Kt](e){let t=!0;try{this[He](null,z.default.writeSync(this[p],e,0,e.length,this[ye])),t=!1}finally{if(t)try{this[$]()}catch{}}}};W.WriteStreamSync=fs});var Qt=d(S=>{"use strict";Object.defineProperty(S,"__esModule",{value:!0});S.dealias=S.isNoFile=S.isFile=S.isAsync=S.isSync=S.isAsyncNoFile=S.isSyncNoFile=S.isAsyncFile=S.isSyncFile=void 0;var Uo=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),qo=s=>!!s.sync&&!!s.file;S.isSyncFile=qo;var Wo=s=>!s.sync&&!!s.file;S.isAsyncFile=Wo;var Ho=s=>!!s.sync&&!s.file;S.isSyncNoFile=Ho;var Go=s=>!s.sync&&!s.file;S.isAsyncNoFile=Go;var Zo=s=>!!s.sync;S.isSync=Zo;var Yo=s=>!s.sync;S.isAsync=Yo;var Ko=s=>!!s.file;S.isFile=Ko;var Vo=s=>!s.file;S.isNoFile=Vo;var $o=s=>{let e=Uo.get(s);return e||s},Xo=(s={})=>{if(!s)return{};let e={};for(let[t,i]of Object.entries(s)){let r=$o(t);e[r]=i}return e.chmod===void 0&&e.noChmod===!1&&(e.chmod=!0),delete e.noChmod,e};S.dealias=Xo});var Ve=d(Jt=>{"use strict";Object.defineProperty(Jt,"__esModule",{value:!0});Jt.makeCommand=void 0;var bt=Qt(),Qo=(s,e,t,i,r)=>Object.assign((n=[],o,a)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(a=o,o=void 0),o=o?Array.from(o):[];let h=(0,bt.dealias)(n);if(r?.(h,o),(0,bt.isSyncFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return s(h,o)}else if((0,bt.isAsyncFile)(h)){let l=e(h,o);return a?l.then(()=>a(),a):l}else if((0,bt.isSyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return t(h,o)}else if((0,bt.isAsyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback only supported with file option");return i(h,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:e,syncNoFile:t,asyncNoFile:i,validate:r});Jt.makeCommand=Qo});var ds=d($e=>{"use strict";var Jo=$e&&$e.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty($e,"__esModule",{value:!0});$e.constants=void 0;var ea=Jo(require("zlib")),ta=ea.default.constants||{ZLIB_VERNUM:4736};$e.constants=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},ta))});var Ps=d(f=>{"use strict";var ia=f&&f.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),sa=f&&f.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),ra=f&&f.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ia(t,e,i[r]);return sa(t,e),t}})(),na=f&&f.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(f,"__esModule",{value:!0});f.ZstdDecompress=f.ZstdCompress=f.BrotliDecompress=f.BrotliCompress=f.Unzip=f.InflateRaw=f.DeflateRaw=f.Gunzip=f.Gzip=f.Inflate=f.Deflate=f.Zlib=f.ZlibError=f.constants=void 0;var _s=na(require("assert")),Ae=require("buffer"),oa=We(),Hr=ra(require("zlib")),te=ds(),aa=ds();Object.defineProperty(f,"constants",{enumerable:!0,get:function(){return aa.constants}});var ha=Ae.Buffer.concat,Gr=Object.getOwnPropertyDescriptor(Ae.Buffer,"concat"),la=s=>s,ms=Gr?.writable===!0||Gr?.set!==void 0?s=>{Ae.Buffer.concat=s?la:ha}:s=>{},Ie=Symbol("_superWrite"),Fe=class extends Error{code;errno;constructor(e,t){super("zlib: "+e.message,{cause:e}),this.code=e.code,this.errno=e.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+e.message,Error.captureStackTrace(this,t??this.constructor)}get name(){return"ZlibError"}};f.ZlibError=Fe;var ps=Symbol("flushFlag"),St=class extends oa.Minipass{#e=!1;#i=!1;#s;#n;#r;#t;#o;get sawError(){return this.#e}get handle(){return this.#t}get flushFlag(){return this.#s}constructor(e,t){if(!e||typeof e!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(e),this.#s=e.flush??0,this.#n=e.finishFlush??0,this.#r=e.fullFlushFlag??0,typeof Hr[t]!="function")throw new TypeError("Compression method not supported: "+t);try{this.#t=new Hr[t](e)}catch(i){throw new Fe(i,this.constructor)}this.#o=i=>{this.#e||(this.#e=!0,this.close(),this.emit("error",i))},this.#t?.on("error",i=>this.#o(new Fe(i))),this.once("end",()=>this.close)}close(){this.#t&&(this.#t.close(),this.#t=void 0,this.emit("close"))}reset(){if(!this.#e)return(0,_s.default)(this.#t,"zlib binding closed"),this.#t.reset?.()}flush(e){this.ended||(typeof e!="number"&&(e=this.#r),this.write(Object.assign(Ae.Buffer.alloc(0),{[ps]:e})))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&(t?this.write(e,t):this.write(e)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Ie](e){return super.write(e)}write(e,t,i){if(typeof t=="function"&&(i=t,t="utf8"),typeof e=="string"&&(e=Ae.Buffer.from(e,t)),this.#e)return;(0,_s.default)(this.#t,"zlib binding closed");let r=this.#t._handle,n=r.close;r.close=()=>{};let o=this.#t.close;this.#t.close=()=>{},ms(!0);let a;try{let l=typeof e[ps]=="number"?e[ps]:this.#s;a=this.#t._processChunk(e,l),ms(!1)}catch(l){ms(!1),this.#o(new Fe(l,this.write))}finally{this.#t&&(this.#t._handle=r,r.close=n,this.#t.close=o,this.#t.removeAllListeners("error"))}this.#t&&this.#t.on("error",l=>this.#o(new Fe(l,this.write)));let h;if(a)if(Array.isArray(a)&&a.length>0){let l=a[0];h=this[Ie](Ae.Buffer.from(l));for(let c=1;c<a.length;c++)h=this[Ie](a[c])}else h=this[Ie](Ae.Buffer.from(a));return i&&i(),h}},ie=class extends St{#e;#i;constructor(e,t){e=e||{},e.flush=e.flush||te.constants.Z_NO_FLUSH,e.finishFlush=e.finishFlush||te.constants.Z_FINISH,e.fullFlushFlag=te.constants.Z_FULL_FLUSH,super(e,t),this.#e=e.level,this.#i=e.strategy}params(e,t){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#e!==e||this.#i!==t){this.flush(te.constants.Z_SYNC_FLUSH),(0,_s.default)(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(e,t)}finally{this.handle.flush=i}this.handle&&(this.#e=e,this.#i=t)}}}};f.Zlib=ie;var ws=class extends ie{constructor(e){super(e,"Deflate")}};f.Deflate=ws;var ys=class extends ie{constructor(e){super(e,"Inflate")}};f.Inflate=ys;var Es=class extends ie{#e;constructor(e){super(e,"Gzip"),this.#e=e&&!!e.portable}[Ie](e){return this.#e?(this.#e=!1,e[9]=255,super[Ie](e)):super[Ie](e)}};f.Gzip=Es;var bs=class extends ie{constructor(e){super(e,"Gunzip")}};f.Gunzip=bs;var Ss=class extends ie{constructor(e){super(e,"DeflateRaw")}};f.DeflateRaw=Ss;var gs=class extends ie{constructor(e){super(e,"InflateRaw")}};f.InflateRaw=gs;var Rs=class extends ie{constructor(e){super(e,"Unzip")}};f.Unzip=Rs;var ei=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.BROTLI_OPERATION_PROCESS,e.finishFlush=e.finishFlush||te.constants.BROTLI_OPERATION_FINISH,e.fullFlushFlag=te.constants.BROTLI_OPERATION_FLUSH,super(e,t)}},Os=class extends ei{constructor(e){super(e,"BrotliCompress")}};f.BrotliCompress=Os;var vs=class extends ei{constructor(e){super(e,"BrotliDecompress")}};f.BrotliDecompress=vs;var ti=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.ZSTD_e_continue,e.finishFlush=e.finishFlush||te.constants.ZSTD_e_end,e.fullFlushFlag=te.constants.ZSTD_e_flush,super(e,t)}},Ts=class extends ti{constructor(e){super(e,"ZstdCompress")}};f.ZstdCompress=Ts;var Ds=class extends ti{constructor(e){super(e,"ZstdDecompress")}};f.ZstdDecompress=Ds});var Kr=d(Xe=>{"use strict";Object.defineProperty(Xe,"__esModule",{value:!0});Xe.parse=Xe.encode=void 0;var ca=(s,e)=>{if(Number.isSafeInteger(s))s<0?fa(s,e):ua(s,e);else throw Error("cannot encode number outside of javascript safe integer range");return e};Xe.encode=ca;var ua=(s,e)=>{e[0]=128;for(var t=e.length;t>1;t--)e[t-1]=s&255,s=Math.floor(s/256)},fa=(s,e)=>{e[0]=255;var t=!1;s=s*-1;for(var i=e.length;i>1;i--){var r=s&255;s=Math.floor(s/256),t?e[i-1]=Zr(r):r===0?e[i-1]=0:(t=!0,e[i-1]=Yr(r))}},da=s=>{let e=s[0],t=e===128?pa(s.subarray(1,s.length)):e===255?ma(s):null;if(t===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(t))throw Error("parsed number outside of javascript safe integer range");return t};Xe.parse=da;var ma=s=>{for(var e=s.length,t=0,i=!1,r=e-1;r>-1;r--){var n=Number(s[r]),o;i?o=Zr(n):n===0?o=n:(i=!0,o=Yr(n)),o!==0&&(t-=o*Math.pow(256,e-r-1))}return t},pa=s=>{for(var e=s.length,t=0,i=e-1;i>-1;i--){var r=Number(s[i]);r!==0&&(t+=r*Math.pow(256,e-i-1))}return t},Zr=s=>(255^s)&255,Yr=s=>(255^s)+1&255});var Ns=d(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.code=C.name=C.normalFsTypes=C.isName=C.isCode=void 0;var _a=s=>C.name.has(s);C.isCode=_a;var wa=s=>C.code.has(s);C.isName=wa;C.normalFsTypes=new Set(["0","","1","2","3","4","5","6","7","D"]);C.name=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]);C.code=new Map(Array.from(C.name).map(s=>[s[1],s[0]]))});var et=d(se=>{"use strict";var ya=se&&se.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ea=se&&se.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Vr=se&&se.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ya(t,e,i[r]);return Ea(t,e),t}})();Object.defineProperty(se,"__esModule",{value:!0});se.Header=void 0;var Qe=require("node:path"),$r=Vr(Kr()),Je=Vr(Ns()),ba=s=>s===void 0||s<0?void 0:s,As=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#e="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(e,t=0,i,r){Buffer.isBuffer(e)?this.decode(e,t||0,i,r):e&&this.#i(e)}decode(e,t,i,r){if(t||(t=0),!e||!(e.length>=t+512))throw new Error("need 512 bytes for header");let n=Ce(e,t+156,1),o=Je.normalFsTypes.has(n),a=o?i:void 0,h=o?r:void 0;if(this.path=a?.path??Ce(e,t,100),this.mode=a?.mode??h?.mode??Se(e,t+100,8),this.uid=a?.uid??h?.uid??Se(e,t+108,8),this.gid=a?.gid??h?.gid??Se(e,t+116,8),this.size=ba(a?.size??h?.size??Se(e,t+124,12)),this.mtime=a?.mtime??h?.mtime??Ms(e,t+136,12),this.cksum=Se(e,t+148,12),h&&this.#i(h,!0),a&&this.#i(a),Je.isCode(n)&&(this.#e=n||"0"),this.#e==="0"&&this.path.slice(-1)==="/"&&(this.#e="5"),this.#e==="5"&&(this.size=0),this.linkpath=Ce(e,t+157,100),e.subarray(t+257,t+265).toString()==="ustar\x0000")if(this.uname=a?.uname??h?.uname??Ce(e,t+265,32),this.gname=a?.gname??h?.gname??Ce(e,t+297,32),this.devmaj=a?.devmaj??h?.devmaj??Se(e,t+329,8)??0,this.devmin=a?.devmin??h?.devmin??Se(e,t+337,8)??0,e[t+475]!==0){let c=Ce(e,t+345,155);this.path=c+"/"+this.path}else{let c=Ce(e,t+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Ms(e,t+476,12),this.ctime=i?.ctime??r?.ctime??Ms(e,t+488,12)}let l=256;for(let c=t;c<t+148;c++)l+=e[c];for(let c=t+156;c<t+512;c++)l+=e[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(e,t=!1){Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&t||i==="linkpath"&&t||i==="global"))))}encode(e,t=0){if(e||(e=this.block=Buffer.alloc(512)),this.#e==="Unsupported"&&(this.#e="0"),!(e.length>=t+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=Sa(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Be(e,t,100,n)||this.needPax,this.needPax=ge(e,t+100,8,this.mode)||this.needPax,this.needPax=ge(e,t+108,8,this.uid)||this.needPax,this.needPax=ge(e,t+116,8,this.gid)||this.needPax,this.needPax=ge(e,t+124,12,this.size)||this.needPax,this.needPax=Ls(e,t+136,12,this.mtime)||this.needPax,e[t+156]=Number(this.#e.codePointAt(0)),this.needPax=Be(e,t+157,100,this.linkpath)||this.needPax,e.write("ustar\x0000",t+257,8),this.needPax=Be(e,t+265,32,this.uname)||this.needPax,this.needPax=Be(e,t+297,32,this.gname)||this.needPax,this.needPax=ge(e,t+329,8,this.devmaj)||this.needPax,this.needPax=ge(e,t+337,8,this.devmin)||this.needPax,this.needPax=Be(e,t+345,i,o)||this.needPax,e[t+475]!==0?this.needPax=Be(e,t+345,155,o)||this.needPax:(this.needPax=Be(e,t+345,130,o)||this.needPax,this.needPax=Ls(e,t+476,12,this.atime)||this.needPax,this.needPax=Ls(e,t+488,12,this.ctime)||this.needPax);let a=256;for(let h=t;h<t+148;h++)a+=e[h];for(let h=t+156;h<t+512;h++)a+=e[h];return this.cksum=a,ge(e,t+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#e==="Unsupported"?this.#e:Je.name.get(this.#e)}get typeKey(){return this.#e}set type(e){let t=String(Je.code.get(e));if(Je.isCode(t)||t==="Unsupported")this.#e=t;else if(Je.isCode(e))this.#e=e;else throw new TypeError("invalid entry type: "+e)}};se.Header=As;var Sa=(s,e)=>{let i=s,r="",n,o=Qe.posix.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Qe.posix.dirname(i),i=Qe.posix.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=e?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=e?n=[i.slice(0,99),r,!0]:(i=Qe.posix.join(Qe.posix.basename(r),i),r=Qe.posix.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},Ce=(s,e,t)=>s.subarray(e,e+t).toString("utf8").replace(/\0.*/,""),Ms=(s,e,t)=>ga(Se(s,e,t)),ga=s=>s===void 0?void 0:new Date(s*1e3),Se=(s,e,t)=>Number(s[e])&128?$r.parse(s.subarray(e,e+t)):Oa(s,e,t),Ra=s=>isNaN(s)?void 0:s,Oa=(s,e,t)=>Ra(parseInt(s.subarray(e,e+t).toString("utf8").replace(/\0.*$/,"").trim(),8)),va={12:8589934591,8:2097151},ge=(s,e,t,i)=>i===void 0?!1:i>va[t]||i<0?($r.encode(i,s.subarray(e,e+t)),!0):(Ta(s,e,t,i),!1),Ta=(s,e,t,i)=>s.write(Da(i,t),e,t,"ascii"),Da=(s,e)=>Pa(Math.floor(s).toString(8),e),Pa=(s,e)=>(s.length===e-1?s:new Array(e-s.length-1).join("0")+s+" ")+"\0",Ls=(s,e,t,i)=>i===void 0?!1:ge(s,e,t,i.getTime()/1e3),Na=new Array(156).join("\0"),Be=(s,e,t,i)=>i===void 0?!1:(s.write(i+Na,e,t,"utf8"),i.length!==Buffer.byteLength(i)||i.length>t)});var si=d(ii=>{"use strict";Object.defineProperty(ii,"__esModule",{value:!0});ii.Pax=void 0;var Ma=require("node:path"),La=et(),Is=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(e,t=!1){this.atime=e.atime,this.charset=e.charset,this.comment=e.comment,this.ctime=e.ctime,this.dev=e.dev,this.gid=e.gid,this.global=t,this.gname=e.gname,this.ino=e.ino,this.linkpath=e.linkpath,this.mtime=e.mtime,this.nlink=e.nlink,this.path=e.path,this.size=e.size,this.uid=e.uid,this.uname=e.uname}encode(){let e=this.encodeBody();if(e==="")return Buffer.allocUnsafe(0);let t=Buffer.byteLength(e),i=512*Math.ceil(1+t/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new La.Header({path:("PaxHeader/"+(0,Ma.basename)(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:t,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(e,512,t,"utf8");for(let n=t+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(e){if(this[e]===void 0)return"";let t=this[e],i=t instanceof Date?t.getTime()/1e3:t,r=" "+(e==="dev"||e==="ino"||e==="nlink"?"SCHILY.":"")+e+"="+i+`
 `,n=Buffer.byteLength(r),o=Math.floor(Math.log(n)/Math.log(10))+1;return n+o>=Math.pow(10,o)&&(o+=1),o+n+r}static parse(e,t,i=!1){return new s(Aa(Ia(e),t),i)}};ii.Pax=Is;var Aa=(s,e)=>e?Object.assign({},e,s):s,Ia=s=>s.replace(/\n$/,"").split(`
-`).reduce(Fa,Object.create(null)),Fa=(s,e)=>{let t=parseInt(e,10);if(t!==Buffer.byteLength(e)+1)return s;e=e.slice((t+" ").length);let i=e.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let a=+o;a>=0&&(s[n]=a);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s}});var tt=d(ri=>{"use strict";Object.defineProperty(ri,"__esModule",{value:!0});ri.normalizeWindowsPath=void 0;var Ca=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform;ri.normalizeWindowsPath=Ca!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/")});var Cs=d(oi=>{"use strict";Object.defineProperty(oi,"__esModule",{value:!0});oi.ReadEntry=void 0;var Ba=We(),ni=tt(),Fs=class extends Ba.Minipass{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(e,t,i){switch(super({}),this.pause(),this.extended=t,this.globalExtended=i,this.header=e,this.remain=e.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=e.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!e.path)throw new Error("no path provided for tar.ReadEntry");this.path=(0,ni.normalizeWindowsPath)(e.path),this.mode=e.mode,this.mode&&(this.mode=this.mode&4095),this.uid=e.uid,this.gid=e.gid,this.uname=e.uname,this.gname=e.gname,this.size=this.remain,this.mtime=e.mtime,this.atime=e.atime,this.ctime=e.ctime,this.linkpath=e.linkpath?(0,ni.normalizeWindowsPath)(e.linkpath):void 0,this.uname=e.uname,this.gname=e.gname,t&&this.#e(t),i&&this.#e(i,!0)}write(e){let t=e.length;if(t>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-t),this.blockRemain=Math.max(0,r-t),this.ignore?!0:i>=t?super.write(e):super.write(e.subarray(0,i))}#e(e,t=!1){e.path&&(e.path=(0,ni.normalizeWindowsPath)(e.path)),e.linkpath&&(e.linkpath=(0,ni.normalizeWindowsPath)(e.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="path"&&t))))}};oi.ReadEntry=Fs});var hi=d(ai=>{"use strict";Object.defineProperty(ai,"__esModule",{value:!0});ai.warnMethod=void 0;var za=(s,e,t,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=t instanceof Error&&t.code||e,i.tarCode=e,!s.strict&&i.recoverable!==!1?(t instanceof Error&&(i=Object.assign(t,i),t=t.message),s.emit("warn",e,t,i)):t instanceof Error?s.emit("error",Object.assign(t,i)):s.emit("error",Object.assign(new Error(`${e}: ${t}`),i))};ai.warnMethod=za});var _i=d(pi=>{"use strict";Object.defineProperty(pi,"__esModule",{value:!0});pi.Parser=void 0;var ka=require("events"),Bs=Ps(),Xr=et(),Qr=si(),xa=Cs(),ja=hi(),Ua=1024*1024,qs=Buffer.from([31,139]),Ws=Buffer.from([40,181,47,253]),qa=Math.max(qs.length,Ws.length),H=Symbol("state"),ze=Symbol("writeEntry"),me=Symbol("readEntry"),zs=Symbol("nextEntry"),Jr=Symbol("processEntry"),re=Symbol("extendedHeader"),gt=Symbol("globalExtendedHeader"),Re=Symbol("meta"),en=Symbol("emitMeta"),_=Symbol("buffer"),pe=Symbol("queue"),Oe=Symbol("ended"),ks=Symbol("emittedEnd"),ke=Symbol("emit"),S=Symbol("unzip"),li=Symbol("consumeChunk"),ci=Symbol("consumeChunkSub"),xs=Symbol("consumeBody"),tn=Symbol("consumeMeta"),sn=Symbol("consumeHeader"),Rt=Symbol("consuming"),js=Symbol("bufferConcat"),ui=Symbol("maybeEnd"),it=Symbol("writing"),ne=Symbol("aborted"),fi=Symbol("onDone"),xe=Symbol("sawValidEntry"),di=Symbol("sawNullBlock"),mi=Symbol("sawEOF"),rn=Symbol("closeStream"),Wa=1e3,Ot=Symbol("compressedBytesRead"),Us=Symbol("decompressedBytesRead"),nn=Symbol("checkDecompressionRatio"),Ha=()=>!0,Hs=class extends ka.EventEmitter{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[pe]=[];[_];[me];[ze];[H]="begin";[Re]="";[re];[gt];[Oe]=!1;[S];[ne]=!1;[xe];[di]=!1;[mi]=!1;[it]=!1;[Rt]=!1;[ks]=!1;[Ot]=0;[Us]=0;constructor(e={}){super(),this.file=e.file||"",this.on(fi,()=>{(this[H]==="begin"||this[xe]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),e.ondone?this.on(fi,e.ondone):this.on(fi,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!e.strict,this.maxDecompressionRatio=typeof e.maxDecompressionRatio=="number"?e.maxDecompressionRatio:Wa,this.maxMetaEntrySize=e.maxMetaEntrySize||Ua,this.filter=typeof e.filter=="function"?e.filter:Ha;let t=e.file&&(e.file.endsWith(".tar.br")||e.file.endsWith(".tbr"));this.brotli=!(e.gzip||e.zstd)&&e.brotli!==void 0?e.brotli:t?void 0:!1;let i=e.file&&(e.file.endsWith(".tar.zst")||e.file.endsWith(".tzst"));this.zstd=!(e.gzip||e.brotli)&&e.zstd!==void 0?e.zstd:i?!0:void 0,this.on("end",()=>this[rn]()),typeof e.onwarn=="function"&&this.on("warn",e.onwarn),typeof e.onReadEntry=="function"&&this.on("entry",e.onReadEntry)}warn(e,t,i={}){(0,ja.warnMethod)(this,e,t,i)}[sn](e,t){this[xe]===void 0&&(this[xe]=!1);let i;try{i=new Xr.Header(e,t,this[re],this[gt])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[di]?(this[mi]=!0,this[H]==="begin"&&(this[H]="header"),this[ke]("eof")):(this[di]=!0,this[ke]("nullBlock"));else if(this[di]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[ze]=new xa.ReadEntry(i,this[re],this[gt]);if(!this[xe])if(n.remain){let o=()=>{n.invalid||(this[xe]=!0)};n.on("end",o)}else this[xe]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[ke]("ignoredEntry",n),this[H]="ignore",n.resume()):n.size>0&&(this[Re]="",n.on("data",o=>this[Re]+=o),this[H]="meta"):(this[re]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[ke]("ignoredEntry",n),this[H]=n.remain?"ignore":"header",n.resume()):(n.remain?this[H]="body":(this[H]="header",n.end()),this[me]?this[pe].push(n):(this[pe].push(n),this[zs]())))}}}[rn](){queueMicrotask(()=>this.emit("close"))}[Jr](e){let t=!0;if(!e)this[me]=void 0,t=!1;else if(Array.isArray(e)){let[i,...r]=e;this.emit(i,...r)}else this[me]=e,this.emit("entry",e),e.emittedEnd||(e.on("end",()=>this[zs]()),t=!1);return t}[zs](){do;while(this[Jr](this[pe].shift()));if(this[pe].length===0){let e=this[me];!e||e.flowing||e.size===e.remain?this[it]||this.emit("drain"):e.once("drain",()=>this.emit("drain"))}}[xs](e,t){let i=this[ze];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=e.length&&t===0?e:e.subarray(t,t+r);return i.write(n),i.blockRemain||(this[H]="header",this[ze]=void 0,i.end()),n.length}[tn](e,t){let i=this[ze],r=this[xs](e,t);return!this[ze]&&i&&this[en](i),r}[ke](e,t,i){this[pe].length===0&&!this[me]?this.emit(e,t,i):this[pe].push([e,t,i])}[en](e){switch(this[ke]("meta",this[Re]),e.type){case"ExtendedHeader":case"OldExtendedHeader":this[re]=Qr.Pax.parse(this[Re],this[re],!1);break;case"GlobalExtendedHeader":this[gt]=Qr.Pax.parse(this[Re],this[gt],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let t=this[re]??Object.create(null);this[re]=t,t.path=this[Re].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let t=this[re]||Object.create(null);this[re]=t,t.linkpath=this[Re].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+e.type)}}abort(e){this[ne]||(this[ne]=!0,this.emit("abort",e),this.warn("TAR_ABORT",e,{recoverable:!1}))}[nn](e){this[Us]+=e.length;let t=this[Us]/this[Ot];return t>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${t.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this[ne])return i?.(),!1;if((this[S]===void 0||this.brotli===void 0&&this[S]===!1)&&e){if(this[_]&&(e=Buffer.concat([this[_],e]),this[_]=void 0),e.length<qa)return this[_]=e,i?.(),!0;for(let h=0;this[S]===void 0&&h<qs.length;h++)e[h]!==qs[h]&&(this[S]=!1);let o=!1;if(this[S]===!1&&this.zstd!==!1){o=!0;for(let h=0;h<Ws.length;h++)if(e[h]!==Ws[h]){o=!1;break}}let a=this.brotli===void 0&&!o;if(this[S]===!1&&a)if(e.length<512)if(this[Oe])this.brotli=!0;else return this[_]=e,i?.(),!0;else try{new Xr.Header(e.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[S]===void 0||this[S]===!1&&(this.brotli||o)){let h=this[Oe];this[Oe]=!1,this[S]=this[S]===void 0?new Bs.Unzip({}):o?new Bs.ZstdDecompress({}):new Bs.BrotliDecompress({}),this[S].on("data",c=>{this[nn](c)&&this[li](c)}),this[S].on("error",c=>{this[ne]||this.abort(c)}),this[S].on("end",()=>{this[Oe]=!0,this[li]()}),this[it]=!0,this[Ot]+=e.length;let l=!!this[S][h?"end":"write"](e);return this[it]=!1,i?.(),l}}this[it]=!0,this[S]?(this[Ot]+=e.length,this[S].write(e)):this[li](e),this[it]=!1;let n=this[pe].length>0?!1:this[me]?this[me].flowing:!0;return!n&&this[pe].length===0&&this[me]?.once("drain",()=>this.emit("drain")),i?.(),n}[js](e){e&&!this[ne]&&(this[_]=this[_]?Buffer.concat([this[_],e]):e)}[ui](){if(this[Oe]&&!this[ks]&&!this[ne]&&!this[Rt]){this[ks]=!0;let e=this[ze];if(e?.blockRemain){let t=this[_]?this[_].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${e.blockRemain} more bytes, only ${t} available)`,{entry:e}),this[_]&&e.write(this[_]),e.end()}this[ke](fi)}}[li](e){if(this[Rt]&&e)this[js](e);else if(!e&&!this[_])this[ui]();else if(e){if(this[Rt]=!0,this[_]){this[js](e);let t=this[_];this[_]=void 0,this[ci](t)}else this[ci](e);for(;this[_]&&this[_]?.length>=512&&!this[ne]&&!this[mi];){let t=this[_];this[_]=void 0,this[ci](t)}this[Rt]=!1}(!this[_]||this[Oe])&&this[ui]()}[ci](e){let t=0,i=e.length;for(;t+512<=i&&!this[ne]&&!this[mi];)switch(this[H]){case"begin":case"header":this[sn](e,t),t+=512;break;case"ignore":case"body":t+=this[xs](e,t);break;case"meta":t+=this[tn](e,t);break;default:throw new Error("invalid state: "+this[H])}t<i&&(this[_]=this[_]?Buffer.concat([e.subarray(t),this[_]]):e.subarray(t))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t)),i&&this.once("finish",i),this[ne]||(this[S]?(e&&(this[Ot]+=e.length,this[S].write(e)),this[S].end()):(this[Oe]=!0,(this.brotli===void 0||this.zstd===void 0)&&(e=e||Buffer.alloc(0)),e&&this.write(e),this[ui]())),this}};pi.Parser=Hs});var yi=d(wi=>{"use strict";Object.defineProperty(wi,"__esModule",{value:!0});wi.stripTrailingSlashes=void 0;var Ga=s=>{let e=s.length-1,t=-1;for(;e>-1&&s.charAt(e)==="/";)t=e,e--;return t===-1?s:s.slice(0,t)};wi.stripTrailingSlashes=Ga});var rt=d(B=>{"use strict";var Za=B&&B.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ya=B&&B.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Ka=B&&B.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Za(t,e,i[r]);return Ya(t,e),t}})(),Va=B&&B.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(B,"__esModule",{value:!0});B.list=B.filesFilter=void 0;var $a=Ka(Ke()),st=Va(require("node:fs")),on=require("path"),Xa=Ve(),Ei=_i(),Gs=yi(),Qa=s=>{let e=s.onReadEntry;s.onReadEntry=e?t=>{e(t),t.resume()}:t=>t.resume()},Ja=(s,e)=>{let t=new Map(e.map(n=>[(0,Gs.stripTrailingSlashes)(n),!0])),i=s.filter,r=(n,o="")=>{let a=o||(0,on.parse)(n).root||".",h;if(n===a)h=!1;else{let l=t.get(n);h=l!==void 0?l:r((0,on.dirname)(n),a)}return t.set(n,h),h};s.filter=i?(n,o)=>i(n,o)&&r((0,Gs.stripTrailingSlashes)(n)):n=>r((0,Gs.stripTrailingSlashes)(n))};B.filesFilter=Ja;var eh=s=>{let e=new Ei.Parser(s),t=s.file,i;try{i=st.default.openSync(t,"r");let r=st.default.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),a=st.default.readSync(i,o,0,r.size,0);e.end(a===o.byteLength?o:o.subarray(0,a))}else{let o=0,a=Buffer.allocUnsafe(n);for(;o<r.size;){let h=st.default.readSync(i,a,0,n,o);if(h===0)break;o+=h,e.write(a.subarray(0,h))}e.end()}}finally{if(typeof i=="number")try{st.default.closeSync(i)}catch{}}},th=(s,e)=>{let t=new Ei.Parser(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("end",o),st.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new $a.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};B.list=(0,Xa.makeCommand)(eh,th,s=>new Ei.Parser(s),s=>new Ei.Parser(s),(s,e)=>{e?.length&&(0,B.filesFilter)(s,e),s.noResume||Qa(s)})});var an=d(bi=>{"use strict";Object.defineProperty(bi,"__esModule",{value:!0});bi.modeFix=void 0;var ih=(s,e,t)=>(s&=4095,t&&(s=(s|384)&-19),e&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);bi.modeFix=ih});var Zs=d(Si=>{"use strict";Object.defineProperty(Si,"__esModule",{value:!0});Si.stripAbsolutePath=void 0;var sh=require("node:path"),{isAbsolute:rh,parse:hn}=sh.win32,nh=s=>{let e="",t=hn(s);for(;rh(s)||t.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":t.root;s=s.slice(i.length),e+=i,t=hn(s)}return[e,s]};Si.stripAbsolutePath=nh});var Ks=d(nt=>{"use strict";Object.defineProperty(nt,"__esModule",{value:!0});nt.decode=nt.encode=void 0;var gi=["|","<",">","?",":"],Ys=gi.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),oh=new Map(gi.map((s,e)=>[s,Ys[e]])),ah=new Map(Ys.map((s,e)=>[s,gi[e]])),hh=s=>gi.reduce((e,t)=>e.split(t).join(oh.get(t)),s);nt.encode=hh;var lh=s=>Ys.reduce((e,t)=>e.split(t).join(ah.get(t)),s);nt.decode=lh});var nr=d(M=>{"use strict";var ch=M&&M.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),uh=M&&M.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fh=M&&M.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ch(t,e,i[r]);return uh(t,e),t}})(),mn=M&&M.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(M,"__esModule",{value:!0});M.WriteEntryTar=M.WriteEntrySync=M.WriteEntry=void 0;var ae=mn(require("fs")),pn=We(),ln=mn(require("path")),_n=et(),wn=an(),oe=tt(),yn=Qt(),En=si(),bn=Zs(),dh=yi(),Sn=hi(),mh=fh(Ks()),gn=(s,e)=>e?(s=(0,oe.normalizeWindowsPath)(s).replace(/^\.(\/|$)/,""),(0,dh.stripTrailingSlashes)(e)+"/"+s):(0,oe.normalizeWindowsPath)(s),ph=16*1024*1024,cn=Symbol("process"),un=Symbol("file"),fn=Symbol("directory"),$s=Symbol("symlink"),dn=Symbol("hardlink"),vt=Symbol("header"),Ri=Symbol("read"),Xs=Symbol("lstat"),Oi=Symbol("onlstat"),Qs=Symbol("onread"),Js=Symbol("onreadlink"),er=Symbol("openfile"),tr=Symbol("onopenfile"),ve=Symbol("close"),vi=Symbol("mode"),ir=Symbol("awaitDrain"),Vs=Symbol("ondrain"),he=Symbol("prefix"),Ti=class extends pn.Minipass{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#e=!1;constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.path=(0,oe.normalizeWindowsPath)(e),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||ph,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=(0,oe.normalizeWindowsPath)(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?(0,oe.normalizeWindowsPath)(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,a]=(0,bn.stripAbsolutePath)(this.path);o&&typeof a=="string"&&(this.path=a,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=mh.decode(this.path.replaceAll(/\\/g,"/")),e=e.replaceAll(/\\/g,"/")),this.absolute=(0,oe.normalizeWindowsPath)(i.absolute||ln.default.resolve(this.cwd,e)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[Oi](n):this[Xs]()}warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}emit(e,...t){return e==="error"&&(this.#e=!0),super.emit(e,...t)}[Xs](){ae.default.lstat(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Oi](t)})}[Oi](e){this.statCache.set(this.absolute,e),this.stat=e,e.isFile()||(e.size=0),this.type=_h(e),this.emit("stat",e),this[cn]()}[cn](){switch(this.type){case"File":return this[un]();case"Directory":return this[fn]();case"SymbolicLink":return this[$s]();default:return this.end()}}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}[he](e){return gn(e,this.prefix)}[vt](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this[vi](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let e=this.header?.block;if(!e)throw new Error("failed to encode header");super.write(e)}[fn](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[vt](),this.end()}[$s](){ae.default.readlink(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Js](t)})}[Js](e){this.linkpath=(0,oe.normalizeWindowsPath)(e),this[vt](),this.end()}[dn](e){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=(0,oe.normalizeWindowsPath)(ln.default.relative(this.cwd,e)),this.stat.size=0,this[vt](),this.end()}[un](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let e=`${this.stat.dev}:${this.stat.ino}`,t=this.linkCache.get(e);if(t?.indexOf(this.cwd)===0)return this[dn](t);this.linkCache.set(e,this.absolute)}if(this[vt](),this.stat.size===0)return this.end();this[er]()}[er](){ae.default.open(this.absolute,"r",(e,t)=>{if(e)return this.emit("error",e);this[tr](t)})}[tr](e){if(this.fd=e,this.#e)return this[ve]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let t=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(t),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[Ri]()}[Ri](){let{fd:e,buf:t,offset:i,length:r,pos:n}=this;if(e===void 0||t===void 0)throw new Error("cannot read file without first opening");ae.default.read(e,t,i,r,n,(o,a)=>{if(o)return this[ve](()=>this.emit("error",o));this[Qs](a)})}[ve](e=()=>{}){this.fd!==void 0&&ae.default.close(this.fd,e)}[Qs](e){if(e<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(e>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(e===this.remain)for(let r=e;r<this.length&&e<this.blockRemain;r++)this.buf[r+this.offset]=0,e++,this.remain++;let t=this.offset===0&&e===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+e);this.write(t)?this[Vs]():this[ir](()=>this[Vs]())}[ir](e){this.once("drain",e)}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this.blockRemain<e.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=e.length,this.blockRemain-=e.length,this.pos+=e.length,this.offset+=e.length,super.write(e,null,i)}[Vs](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[ve](e=>e?this.emit("error",e):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[Ri]()}};M.WriteEntry=Ti;var sr=class extends Ti{sync=!0;[Xs](){this[Oi](ae.default.lstatSync(this.absolute))}[$s](){this[Js](ae.default.readlinkSync(this.absolute))}[er](){this[tr](ae.default.openSync(this.absolute,"r"))}[Ri](){let e=!0;try{let{fd:t,buf:i,offset:r,length:n,pos:o}=this;if(t===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let a=ae.default.readSync(t,i,r,n,o);this[Qs](a),e=!1}finally{if(e)try{this[ve](()=>{})}catch{}}}[ir](e){e()}[ve](e=()=>{}){this.fd!==void 0&&ae.default.closeSync(this.fd),e()}};M.WriteEntrySync=sr;var rr=class extends pn.Minipass{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=e;let{type:r}=e;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=(0,oe.normalizeWindowsPath)(e.path),this.mode=e.mode!==void 0?this[vi](e.mode):void 0,this.uid=this.portable?void 0:e.uid,this.gid=this.portable?void 0:e.gid,this.uname=this.portable?void 0:e.uname,this.gname=this.portable?void 0:e.gname,this.size=e.size,this.mtime=this.noMtime?void 0:i.mtime||e.mtime,this.atime=this.portable?void 0:e.atime,this.ctime=this.portable?void 0:e.ctime,this.linkpath=e.linkpath!==void 0?(0,oe.normalizeWindowsPath)(e.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[a,h]=(0,bn.stripAbsolutePath)(this.path);a&&typeof h=="string"&&(this.path=h,n=a)}this.remain=e.size,this.blockRemain=e.startBlockSize,this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),e.pipe(this)}[he](e){return gn(e,this.prefix)}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}write(e,t,i){typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8"));let r=e.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(e,i)}end(e,t,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t??"utf8")),i&&this.once("finish",i),e?super.end(e,i):super.end(i),this}};M.WriteEntryTar=rr;var _h=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported"});var Rn=d(at=>{"use strict";Object.defineProperty(at,"__esModule",{value:!0});at.Node=at.Yallist=void 0;var or=class s{tail;head;length=0;static create(e=[]){return new s(e)}constructor(e=[]){for(let t of e)this.push(t)}*[Symbol.iterator](){for(let e=this.head;e;e=e.next)yield e.value}removeNode(e){if(e.list!==this)throw new Error("removing node which does not belong to this list");let t=e.next,i=e.prev;return t&&(t.prev=i),i&&(i.next=t),e===this.head&&(this.head=t),e===this.tail&&(this.tail=i),this.length--,e.next=void 0,e.prev=void 0,e.list=void 0,t}unshiftNode(e){if(e===this.head)return;e.list&&e.list.removeNode(e);let t=this.head;e.list=this,e.next=t,t&&(t.prev=e),this.head=e,this.tail||(this.tail=e),this.length++}pushNode(e){if(e===this.tail)return;e.list&&e.list.removeNode(e);let t=this.tail;e.list=this,e.prev=t,t&&(t.next=e),this.tail=e,this.head||(this.head=e),this.length++}push(...e){for(let t=0,i=e.length;t<i;t++)yh(this,e[t]);return this.length}unshift(...e){for(var t=0,i=e.length;t<i;t++)Eh(this,e[t]);return this.length}pop(){if(!this.tail)return;let e=this.tail.value,t=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,t.list=void 0,this.length--,e}shift(){if(!this.head)return;let e=this.head.value,t=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,t.list=void 0,this.length--,e}forEach(e,t){t=t||this;for(let i=this.head,r=0;i;r++)e.call(t,i.value,r,this),i=i.next}forEachReverse(e,t){t=t||this;for(let i=this.tail,r=this.length-1;i;r--)e.call(t,i.value,r,this),i=i.prev}get(e){let t=0,i=this.head;for(;i&&t<e;t++)i=i.next;if(t===e&&i)return i.value}getReverse(e){let t=0,i=this.tail;for(;i&&t<e;t++)i=i.prev;if(t===e&&i)return i.value}map(e,t){t=t||this;let i=new s;for(let r=this.head;r;)i.push(e.call(t,r.value,this)),r=r.next;return i}mapReverse(e,t){t=t||this;var i=new s;for(let r=this.tail;r;)i.push(e.call(t,r.value,this)),r=r.prev;return i}reduce(e,t){let i,r=this.head;if(arguments.length>1)i=t;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=e(i,r.value,n),r=r.next;return i}reduceReverse(e,t){let i,r=this.tail;if(arguments.length>1)i=t;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=e(i,r.value,n),r=r.prev;return i}toArray(){let e=new Array(this.length);for(let t=0,i=this.head;i;t++)e[t]=i.value,i=i.next;return e}toArrayReverse(){let e=new Array(this.length);for(let t=0,i=this.tail;i;t++)e[t]=i.value,i=i.prev;return e}slice(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.head,n=0;for(n=0;r&&n<e;n++)r=r.next;for(;r&&n<t;n++,r=r.next)i.push(r.value);return i}sliceReverse(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.length,n=this.tail;for(;n&&r>t;r--)n=n.prev;for(;n&&r>e;r--,n=n.prev)i.push(n.value);return i}splice(e,t=0,...i){e>this.length&&(e=this.length-1),e<0&&(e=this.length+e);let r=this.head;for(let o=0;r&&o<e;o++)r=r.next;let n=[];for(let o=0;r&&o<t;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=wh(this,r,o);return n}reverse(){let e=this.head,t=this.tail;for(let i=e;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=t,this.tail=e,this}};at.Yallist=or;function wh(s,e,t){let i=e,r=e?e.next:s.head,n=new ot(t,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function yh(s,e){s.tail=new ot(e,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Eh(s,e){s.head=new ot(e,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ot=class{list;next;prev;value;constructor(e,t,i,r){this.list=r,this.value=e,t?(t.next=this,this.prev=t):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};at.Node=ot});var Ci=d(L=>{"use strict";var bh=L&&L.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Sh=L&&L.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),gh=L&&L.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&bh(t,e,i[r]);return Sh(t,e),t}})(),Pn=L&&L.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(L,"__esModule",{value:!0});L.PackSync=L.Pack=L.PackJob=void 0;var Ii=Pn(require("fs")),fr=nr(),Nt=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(e,t){this.path=e||"./",this.absolute=t}};L.PackJob=Nt;var Rh=We(),ar=gh(Ps()),Oh=Rn(),vh=hi(),On=Buffer.alloc(1024),Pi=Symbol("onStat"),Tt=Symbol("ended"),X=Symbol("queue"),Dt=Symbol("pendingLinks"),Te=Symbol("current"),je=Symbol("process"),Pt=Symbol("processing"),Di=Symbol("processJob"),Q=Symbol("jobs"),hr=Symbol("jobDone"),Ni=Symbol("addFSEntry"),vn=Symbol("addTarEntry"),dr=Symbol("stat"),mr=Symbol("readdir"),Mi=Symbol("onreaddir"),Li=Symbol("pipe"),Tn=Symbol("entry"),lr=Symbol("entryOpt"),Ai=Symbol("writeEntryClass"),Nn=Symbol("write"),cr=Symbol("ondrain"),Dn=Pn(require("path")),ur=tt(),Fi=class extends Rh.Minipass{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[Ai];onWriteEntry;[X];[Dt]=new Map;[Q]=0;[Pt]=!1;[Tt]=!1;constructor(e={}){if(super(),this.opt=e,this.file=e.file||"",this.cwd=e.cwd||process.cwd(),this.maxReadSize=e.maxReadSize,this.preservePaths=!!e.preservePaths,this.strict=!!e.strict,this.noPax=!!e.noPax,this.prefix=(0,ur.normalizeWindowsPath)(e.prefix||""),this.linkCache=e.linkCache||new Map,this.statCache=e.statCache||new Map,this.readdirCache=e.readdirCache||new Map,this.onWriteEntry=e.onWriteEntry,this[Ai]=fr.WriteEntry,typeof e.onwarn=="function"&&this.on("warn",e.onwarn),this.portable=!!e.portable,e.gzip||e.brotli||e.zstd){if((e.gzip?1:0)+(e.brotli?1:0)+(e.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(e.gzip&&(typeof e.gzip!="object"&&(e.gzip={}),this.portable&&(e.gzip.portable=!0),this.zip=new ar.Gzip(e.gzip)),e.brotli&&(typeof e.brotli!="object"&&(e.brotli={}),this.zip=new ar.BrotliCompress(e.brotli)),e.zstd&&(typeof e.zstd!="object"&&(e.zstd={}),this.zip=new ar.ZstdCompress(e.zstd)),!this.zip)throw new Error("impossible");let t=this.zip;t.on("data",i=>super.write(i)),t.on("end",()=>super.end()),t.on("drain",()=>this[cr]()),this.on("resume",()=>t.resume())}else this.on("drain",this[cr]);this.noDirRecurse=!!e.noDirRecurse,this.follow=!!e.follow,this.noMtime=!!e.noMtime,e.mtime&&(this.mtime=e.mtime),this.filter=typeof e.filter=="function"?e.filter:()=>!0,this[X]=new Oh.Yallist,this[Q]=0,this.jobs=Number(e.jobs)||4,this[Pt]=!1,this[Tt]=!1}[Nn](e){return super.write(e)}add(e){return this.write(e),this}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&this.add(e),this[Tt]=!0,this[je](),i&&i(),this}write(e){if(this[Tt])throw new Error("write after end");return typeof e=="string"?this[Ni](e):this[vn](e),this.flowing}[vn](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e.path));if(!this.filter(e.path,e))e.resume();else{let i=new Nt(e.path,t);i.entry=new fr.WriteEntryTar(e,this[lr](i)),i.entry.on("end",()=>this[hr](i)),this[Q]+=1,this[X].push(i)}this[je]()}[Ni](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e));this[X].push(new Nt(e,t)),this[je]()}[dr](e){e.pending=!0,this[Q]+=1;let t=this.follow?"stat":"lstat";Ii.default[t](e.absolute,(i,r)=>{e.pending=!1,this[Q]-=1,i?this.emit("error",i):this[Pi](e,r)})}[Pi](e,t){if(this.statCache.set(e.absolute,t),e.stat=t,!this.filter(e.path,t))e.ignore=!0;else if(t.isFile()&&t.nlink>1&&!this.linkCache.get(`${t.dev}:${t.ino}`)&&!this.sync)if(e===this[Te])this[Di](e);else{let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);r?r.push(e):this[Dt].set(i,[e]),e.pendingLink=!0,e.pending=!0}this[je]()}[mr](e){e.pending=!0,this[Q]+=1,Ii.default.readdir(e.absolute,(t,i)=>{if(e.pending=!1,this[Q]-=1,t)return this.emit("error",t);this[Mi](e,i)})}[Mi](e,t){this.readdirCache.set(e.absolute,t),e.readdir=t,this[je]()}[je](){if(!this[Pt]){this[Pt]=!0;for(let e=this[X].head;e&&this[Q]<this.jobs;e=e.next)if(this[Di](e.value),e.value.ignore){let t=e.next;this[X].removeNode(e),e.next=t}this[Pt]=!1,this[Tt]&&this[X].length===0&&this[Q]===0&&(this.zip?this.zip.end(On):(super.write(On),super.end()))}}get[Te](){return this[X]&&this[X].head&&this[X].head.value}[hr](e){this[X].shift(),this[Q]-=1;let{stat:t}=e;if(t&&t.isFile()&&t.nlink>1){let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);if(r){this[Dt].delete(i);for(let n of r)n.pending=!1,this[Di](n)}}this[je]()}[Di](e){if(e.pending&&e.pendingLink&&e===this[Te]&&(e.pending=!1,e.pendingLink=!1),!e.pending){if(e.entry){e===this[Te]&&!e.piped&&this[Li](e);return}if(!e.stat){let t=this.statCache.get(e.absolute);t?this[Pi](e,t):this[dr](e)}if(e.stat&&!e.ignore){if(!this.noDirRecurse&&e.stat.isDirectory()&&!e.readdir){let t=this.readdirCache.get(e.absolute);if(t?this[Mi](e,t):this[mr](e),!e.readdir)return}if(e.entry=this[Tn](e),!e.entry){e.ignore=!0;return}e===this[Te]&&!e.piped&&this[Li](e)}}}[lr](e){return{onwarn:(t,i,r)=>this.warn(t,i,r),noPax:this.noPax,cwd:this.cwd,absolute:e.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[Tn](e){this[Q]+=1;try{return new this[Ai](e.path,this[lr](e)).on("end",()=>this[hr](e)).on("error",i=>this.emit("error",i))}catch(t){this.emit("error",t)}}[cr](){this[Te]&&this[Te].entry&&this[Te].entry.resume()}[Li](e){e.piped=!0,e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)});let t=e.entry,i=this.zip;if(!t)throw new Error("cannot pipe without source");i?t.on("data",r=>{i.write(r)||t.pause()}):t.on("data",r=>{super.write(r)||t.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(e,t,i={}){(0,vh.warnMethod)(this,e,t,i)}};L.Pack=Fi;var pr=class extends Fi{sync=!0;constructor(e){super(e),this[Ai]=fr.WriteEntrySync}pause(){}resume(){}[dr](e){let t=this.follow?"statSync":"lstatSync";this[Pi](e,Ii.default[t](e.absolute))}[mr](e){this[Mi](e,Ii.default.readdirSync(e.absolute))}[Li](e){let t=e.entry,i=this.zip;if(e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)}),!t)throw new Error("Cannot pipe without source");i?t.on("data",r=>{i.write(r)}):t.on("data",r=>{super[Nn](r)})}};L.PackSync=pr});var _r=d(ht=>{"use strict";var Th=ht&&ht.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ht,"__esModule",{value:!0});ht.create=void 0;var Mn=Ke(),Ln=Th(require("node:path")),An=rt(),Dh=Ve(),Bi=Ci(),Ph=(s,e)=>{let t=new Bi.PackSync(s),i=new Mn.WriteStreamSync(s.file,{mode:s.mode||438});t.pipe(i),In(t,e)},Nh=(s,e)=>{let t=new Bi.Pack(s),i=new Mn.WriteStream(s.file,{mode:s.mode||438});t.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),t.on("error",o)});return Fn(t,e).catch(n=>t.emit("error",n)),r},In=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,An.list)({file:Ln.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},Fn=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,An.list)({file:Ln.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(t);s.end()},Mh=(s,e)=>{let t=new Bi.PackSync(s);return In(t,e),t},Lh=(s,e)=>{let t=new Bi.Pack(s);return Fn(t,e).catch(i=>t.emit("error",i)),t};ht.create=(0,Dh.makeCommand)(Ph,Nh,Mh,Lh,(s,e)=>{if(!e?.length)throw new TypeError("no paths specified to add to archive")})});var Wn=d(lt=>{"use strict";var Ah=lt&&lt.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(lt,"__esModule",{value:!0});lt.getWriteFlag=void 0;var zn=Ah(require("fs")),Ih=process.env.__FAKE_PLATFORM__||process.platform,kn=Ih==="win32",{O_CREAT:xn,O_NOFOLLOW:Cn,O_TRUNC:jn,O_WRONLY:Un}=zn.default.constants,qn=Number(process.env.__FAKE_FS_O_FILENAME__)||zn.default.constants.UV_FS_O_FILEMAP||0,Fh=kn&&!!qn,Ch=512*1024,Bh=qn|jn|xn|Un,Bn=!kn&&typeof Cn=="number"?Cn|jn|xn|Un:null;lt.getWriteFlag=Bn!==null?()=>Bn:Fh?s=>s<Ch?Bh:"w":()=>"w"});var Gn=d(le=>{"use strict";var Hn=le&&le.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(le,"__esModule",{value:!0});le.chownrSync=le.chownr=void 0;var ki=Hn(require("node:fs")),Mt=Hn(require("node:path")),wr=(s,e,t)=>{try{return ki.default.lchownSync(s,e,t)}catch(i){if(i?.code!=="ENOENT")throw i}},zi=(s,e,t,i)=>{ki.default.lchown(s,e,t,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},zh=(s,e,t,i,r)=>{if(e.isDirectory())(0,le.chownr)(Mt.default.resolve(s,e.name),t,i,n=>{if(n)return r(n);let o=Mt.default.resolve(s,e.name);zi(o,t,i,r)});else{let n=Mt.default.resolve(s,e.name);zi(n,t,i,r)}},kh=(s,e,t,i)=>{ki.default.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return zi(s,e,t,i);let o=n.length,a=null,h=l=>{if(!a){if(l)return i(a=l);if(--o===0)return zi(s,e,t,i)}};for(let l of n)zh(s,l,e,t,h)})};le.chownr=kh;var xh=(s,e,t,i)=>{e.isDirectory()&&(0,le.chownrSync)(Mt.default.resolve(s,e.name),t,i),wr(Mt.default.resolve(s,e.name),t,i)},jh=(s,e,t)=>{let i;try{i=ki.default.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return wr(s,e,t);throw n}for(let r of i)xh(s,r,e,t);return wr(s,e,t)};le.chownrSync=jh});var Zn=d(xi=>{"use strict";Object.defineProperty(xi,"__esModule",{value:!0});xi.CwdError=void 0;var yr=class extends Error{path;code;syscall="chdir";constructor(e,t){super(`${t}: Cannot cd into '${e}'`),this.path=e,this.code=t}get name(){return"CwdError"}};xi.CwdError=yr});var br=d(ji=>{"use strict";Object.defineProperty(ji,"__esModule",{value:!0});ji.SymlinkError=void 0;var Er=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(e,t){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=e,this.path=t}get name(){return"SymlinkError"}};ji.SymlinkError=Er});var Xn=d(De=>{"use strict";var gr=De&&De.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(De,"__esModule",{value:!0});De.mkdirSync=De.mkdir=void 0;var Yn=Gn(),j=gr(require("node:fs")),Uh=gr(require("node:fs/promises")),Ui=gr(require("node:path")),Kn=Zn(),_e=tt(),Vn=br(),qh=(s,e)=>{j.default.stat(s,(t,i)=>{(t||!i.isDirectory())&&(t=new Kn.CwdError(s,t?.code||"ENOTDIR")),e(t)})},Wh=(s,e,t)=>{s=(0,_e.normalizeWindowsPath)(s);let i=e.umask??18,r=e.mode|448,n=(r&i)!==0,o=e.uid,a=e.gid,h=typeof o=="number"&&typeof a=="number"&&(o!==e.processUid||a!==e.processGid),l=e.preserve,c=e.unlink,u=(0,_e.normalizeWindowsPath)(e.cwd),E=(w,P)=>{w?t(w):P&&h?(0,Yn.chownr)(P,o,a,xt=>E(xt)):n?j.default.chmod(s,r,t):t()};if(s===u)return qh(s,E);if(l)return Uh.default.mkdir(s,{mode:r,recursive:!0}).then(w=>E(null,w??void 0),E);let A=(0,_e.normalizeWindowsPath)(Ui.default.relative(u,s)).split("/");Sr(u,A,r,c,u,void 0,E)};De.mkdir=Wh;var Sr=(s,e,t,i,r,n,o)=>{if(e.length===0)return o(null,n);let a=e.shift(),h=(0,_e.normalizeWindowsPath)(Ui.default.resolve(s+"/"+a));j.default.mkdir(h,t,$n(h,e,t,i,r,n,o))},$n=(s,e,t,i,r,n,o)=>a=>{a?j.default.lstat(s,(h,l)=>{if(h)h.path=h.path&&(0,_e.normalizeWindowsPath)(h.path),o(h);else if(l.isDirectory())Sr(s,e,t,i,r,n,o);else if(i)j.default.unlink(s,c=>{if(c)return o(c);j.default.mkdir(s,t,$n(s,e,t,i,r,n,o))});else{if(l.isSymbolicLink())return o(new Vn.SymlinkError(s,s+"/"+e.join("/")));o(a)}}):(n=n||s,Sr(s,e,t,i,r,n,o))},Hh=s=>{let e=!1,t;try{e=j.default.statSync(s).isDirectory()}catch(i){t=i?.code}finally{if(!e)throw new Kn.CwdError(s,t??"ENOTDIR")}},Gh=(s,e)=>{s=(0,_e.normalizeWindowsPath)(s);let t=e.umask??18,i=e.mode|448,r=(i&t)!==0,n=e.uid,o=e.gid,a=typeof n=="number"&&typeof o=="number"&&(n!==e.processUid||o!==e.processGid),h=e.preserve,l=e.unlink,c=(0,_e.normalizeWindowsPath)(e.cwd),u=w=>{w&&a&&(0,Yn.chownrSync)(w,n,o),r&&j.default.chmodSync(s,i)};if(s===c)return Hh(c),u();if(h)return u(j.default.mkdirSync(s,{mode:i,recursive:!0})??void 0);let D=(0,_e.normalizeWindowsPath)(Ui.default.relative(c,s)).split("/"),A;for(let w=D.shift(),P=c;w&&(P+="/"+w);w=D.shift()){P=(0,_e.normalizeWindowsPath)(Ui.default.resolve(P));try{j.default.mkdirSync(P,i),A=A||P}catch{let xt=j.default.lstatSync(P);if(xt.isDirectory())continue;if(l){j.default.unlinkSync(P),j.default.mkdirSync(P,i),A=A||P;continue}else if(xt.isSymbolicLink())return new Vn.SymlinkError(P,P+"/"+D.join("/"))}}return u(A)};De.mkdirSync=Gh});var Jn=d(qi=>{"use strict";Object.defineProperty(qi,"__esModule",{value:!0});qi.normalizeUnicode=void 0;var Rr=Object.create(null),Qn=1e4,ct=new Set,Zh=s=>{ct.has(s)?ct.delete(s):Rr[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),ct.add(s);let e=Rr[s],t=ct.size-Qn;if(t>Qn/10){for(let i of ct)if(ct.delete(i),delete Rr[i],--t<=0)break}return e};qi.normalizeUnicode=Zh});var to=d(Wi=>{"use strict";Object.defineProperty(Wi,"__esModule",{value:!0});Wi.PathReservations=void 0;var eo=require("node:path"),Yh=Jn(),Kh=yi(),Vh=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,$h=Vh==="win32",Xh=s=>s.split("/").slice(0,-1).reduce((t,i)=>{let r=t.at(-1);return r!==void 0&&(i=(0,eo.join)(r,i)),t.push(i||"/"),t},[]),Or=class{#e=new Map;#i=new Map;#s=new Set;reserve(e,t){e=$h?["win32 parallelization disabled"]:e.map(r=>(0,Kh.stripTrailingSlashes)((0,eo.join)((0,Yh.normalizeUnicode)(r))));let i=new Set(e.map(r=>Xh(r)).reduce((r,n)=>r.concat(n)));this.#i.set(t,{dirs:i,paths:e});for(let r of e){let n=this.#e.get(r);n?n.push(t):this.#e.set(r,[t])}for(let r of i){let n=this.#e.get(r);if(!n)this.#e.set(r,[new Set([t])]);else{let o=n.at(-1);o instanceof Set?o.add(t):n.push(new Set([t]))}}return this.#r(t)}#n(e){let t=this.#i.get(e);if(!t)throw new Error("function does not have any path reservations");return{paths:t.paths.map(i=>this.#e.get(i)),dirs:[...t.dirs].map(i=>this.#e.get(i))}}check(e){let{paths:t,dirs:i}=this.#n(e);return t.every(r=>r&&r[0]===e)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(e))}#r(e){return this.#s.has(e)||!this.check(e)?!1:(this.#s.add(e),e(()=>this.#t(e)),!0)}#t(e){if(!this.#s.has(e))return!1;let t=this.#i.get(e);if(!t)throw new Error("invalid reservation");let{paths:i,dirs:r}=t,n=new Set;for(let o of i){let a=this.#e.get(o);if(!a||a?.[0]!==e)continue;let h=a[1];if(!h){this.#e.delete(o);continue}if(a.shift(),typeof h=="function")n.add(h);else for(let l of h)n.add(l)}for(let o of r){let a=this.#e.get(o),h=a?.[0];if(!(!a||!(h instanceof Set)))if(h.size===1&&a.length===1){this.#e.delete(o);continue}else if(h.size===1){a.shift();let l=a[0];typeof l=="function"&&n.add(l)}else h.delete(e)}return this.#s.delete(e),n.forEach(o=>this.#r(o)),!0}};Wi.PathReservations=Or});var io=d(Hi=>{"use strict";Object.defineProperty(Hi,"__esModule",{value:!0});Hi.umask=void 0;var Qh=()=>process.umask();Hi.umask=Qh});var Cr=d(k=>{"use strict";var Jh=k&&k.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),el=k&&k.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fo=k&&k.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Jh(t,e,i[r]);return el(t,e),t}})(),Fr=k&&k.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(k,"__esModule",{value:!0});k.UnpackSync=k.Unpack=void 0;var tl=fo(Ke()),il=Fr(require("node:assert")),mo=require("node:crypto"),m=Fr(require("node:fs")),g=Fr(require("node:path")),po=Wn(),_o=Xn(),U=tt(),sl=_i(),rl=Zs(),so=fo(Ks()),nl=to(),wo=br(),ol=io(),ro=Symbol("onEntry"),Pr=Symbol("checkFs"),no=Symbol("checkFs2"),Nr=Symbol("isReusable"),G=Symbol("makeFs"),Mr=Symbol("file"),Lr=Symbol("directory"),Zi=Symbol("link"),oo=Symbol("symlink"),ao=Symbol("hardlink"),At=Symbol("ensureNoSymlink"),ho=Symbol("unsupported"),lo=Symbol("checkPath"),vr=Symbol("stripAbsolutePath"),Pe=Symbol("mkdir"),T=Symbol("onError"),Gi=Symbol("pending"),co=Symbol("pend"),ut=Symbol("unpend"),Tr=Symbol("ended"),Dr=Symbol("maybeClose"),Ar=Symbol("skip"),It=Symbol("doChown"),Ft=Symbol("uid"),Ct=Symbol("gid"),Bt=Symbol("checkedCwd"),al=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,zt=al==="win32",hl=1024,ll=(s,e)=>{if(!zt)return m.default.unlink(s,e);let t=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.rename(s,t,i=>{if(i)return e(i);m.default.unlink(t,e)})},cl=s=>{if(!zt)return m.default.unlinkSync(s);let e=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.renameSync(s,e),m.default.unlinkSync(e)},uo=(s,e,t)=>s!==void 0&&s===s>>>0?s:e!==void 0&&e===e>>>0?e:t,Yi=class extends sl.Parser{[Tr]=!1;[Bt]=!1;[Gi]=0;reservations=new nl.PathReservations;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(e={}){if(e.ondone=()=>{this[Tr]=!0,this[Dr]()},super(e),this.transform=e.transform,this.chmod=!!e.chmod,typeof e.uid=="number"||typeof e.gid=="number"){if(typeof e.uid!="number"||typeof e.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(e.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=e.uid,this.gid=e.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=e.preserveOwner===void 0&&typeof e.uid!="number"?process.getuid?.()===0:!!e.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof e.maxDepth=="number"?e.maxDepth:hl,this.forceChown=e.forceChown===!0,this.win32=!!e.win32||zt,this.newer=!!e.newer,this.keep=!!e.keep,this.noMtime=!!e.noMtime,this.preservePaths=!!e.preservePaths,this.unlink=!!e.unlink,this.cwd=(0,U.normalizeWindowsPath)(g.default.resolve(e.cwd||process.cwd())),this.strip=Number(e.strip)||0,this.processUmask=this.chmod?typeof e.processUmask=="number"?e.processUmask:(0,ol.umask)():0,this.umask=typeof e.umask=="number"?e.umask:this.processUmask,this.dmode=e.dmode||511&~this.umask,this.fmode=e.fmode||438&~this.umask,this.on("entry",t=>this[ro](t))}warn(e,t,i={}){return(e==="TAR_BAD_ARCHIVE"||e==="TAR_ABORT")&&(i.recoverable=!1),super.warn(e,t,i)}[Dr](){this[Tr]&&this[Gi]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[vr](e,t){let i=e[t],{type:r}=e;if(!i||this.preservePaths)return!0;let[n,o]=(0,rl.stripAbsolutePath)(i),a=o.replaceAll(/\\/g,"/").split("/");if(a.includes("..")||zt&&/^[a-z]:\.\.$/i.test(a[0]??"")){if(t==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${t} contains '..'`,{entry:e,[t]:i}),!1;let h=g.default.posix.dirname(e.path),l=g.default.posix.normalize(g.default.posix.join(h,a.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${t} escapes extraction directory`,{entry:e,[t]:i}),!1}return n&&(e[t]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${t}`,{entry:e,[t]:i})),!0}[lo](e){let t=(0,U.normalizeWindowsPath)(e.path),i=t.split("/");if(this.strip){if(i.length<this.strip)return!1;if(e.type==="Link"){let r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");if(r.length>=this.strip)e.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),e.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:e,path:t,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[vr](e,"path")||!this[vr](e,"linkpath"))return!1;if(e.absolute=g.default.isAbsolute(e.path)?(0,U.normalizeWindowsPath)(g.default.resolve(e.path)):(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,e.path)),!this.preservePaths&&typeof e.absolute=="string"&&e.absolute.indexOf(this.cwd+"/")!==0&&e.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:e,path:(0,U.normalizeWindowsPath)(e.path),resolvedPath:e.absolute,cwd:this.cwd}),!1;if(e.absolute===this.cwd&&e.type!=="Directory"&&e.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=g.default.win32.parse(String(e.absolute));e.absolute=r+so.encode(String(e.absolute).slice(r.length));let{root:n}=g.default.win32.parse(e.path);e.path=n+so.encode(e.path.slice(n.length))}return!0}[ro](e){if(!this[lo](e))return e.resume();switch(il.default.equal(typeof e.absolute,"string"),e.type){case"Directory":case"GNUDumpDir":e.mode&&(e.mode=e.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[Pr](e);default:return this[ho](e)}}[T](e,t){e.name==="CwdError"?this.emit("error",e):(this.warn("TAR_ENTRY_ERROR",e,{entry:t}),this[ut](),t.resume())}[Pe](e,t,i){(0,_o.mkdir)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t},i)}[It](e){return this.forceChown||this.preserveOwner&&(typeof e.uid=="number"&&e.uid!==this.processUid||typeof e.gid=="number"&&e.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[Ft](e){return uo(this.uid,e.uid,this.processUid)}[Ct](e){return uo(this.gid,e.gid,this.processGid)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=new tl.WriteStream(String(e.absolute),{flags:(0,po.getWriteFlag)(e.size),mode:i,autoClose:!1});r.on("error",h=>{r.fd&&m.default.close(r.fd,()=>{}),r.write=()=>!0,this[T](h,e),t()});let n=1,o=h=>{if(h){r.fd&&m.default.close(r.fd,()=>{}),this[T](h,e),t();return}--n===0&&r.fd!==void 0&&m.default.close(r.fd,l=>{l?this[T](l,e):this[ut](),t()})};r.on("finish",()=>{let h=String(e.absolute),l=r.fd;if(typeof l=="number"&&e.mtime&&!this.noMtime){n++;let c=e.atime||new Date,u=e.mtime;m.default.futimes(l,c,u,E=>E?m.default.utimes(h,c,u,D=>o(D&&E)):o())}if(typeof l=="number"&&this[It](e)){n++;let c=this[Ft](e),u=this[Ct](e);typeof c=="number"&&typeof u=="number"&&m.default.fchown(l,c,u,E=>E?m.default.chown(h,c,u,D=>o(D&&E)):o())}o()});let a=this.transform&&this.transform(e)||e;a!==e&&(a.on("error",h=>{this[T](h,e),t()}),e.pipe(a)),a.pipe(r)}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode;this[Pe](String(e.absolute),i,r=>{if(r){this[T](r,e),t();return}let n=1,o=()=>{--n===0&&(t(),this[ut](),e.resume())};e.mtime&&!this.noMtime&&(n++,m.default.utimes(String(e.absolute),e.atime||new Date,e.mtime,o)),this[It](e)&&(n++,m.default.chown(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)),o)),o()})}[ho](e){e.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${e.type}`,{entry:e}),e.resume()}[oo](e,t){let i=(0,U.normalizeWindowsPath)(g.default.relative(this.cwd,g.default.resolve(g.default.dirname(String(e.absolute)),String(e.linkpath)))).split("/");this[At](e,this.cwd,i,()=>this[Zi](e,String(e.linkpath),"symlink",t),r=>{this[T](r,e),t()})}[ao](e,t){let i=(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,String(e.linkpath))),r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");this[At](e,this.cwd,r,()=>this[Zi](e,i,"link",t),n=>{this[T](n,e),t()})}[At](e,t,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let a=g.default.resolve(t,o);m.default.lstat(a,(h,l)=>{if(h)return r();if(l?.isSymbolicLink())return n(new wo.SymlinkError(a,g.default.resolve(a,i.join("/"))));this[At](e,a,i,r,n)})}[co](){this[Gi]++}[ut](){this[Gi]--,this[Dr]()}[Ar](e){this[ut](),e.resume()}[Nr](e,t){return e.type==="File"&&!this.unlink&&t.isFile()&&t.nlink<=1&&!zt}[Pr](e){this[co]();let t=[e.path];e.linkpath&&t.push(e.linkpath),this.reservations.reserve(t,i=>this[no](e,i))}[no](e,t){let i=a=>{t(a)},r=()=>{this[Pe](this.cwd,this.dmode,a=>{if(a){this[T](a,e),i();return}this[Bt]=!0,n()})},n=()=>{if(e.absolute!==this.cwd){let a=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(a!==this.cwd)return this[Pe](a,this.dmode,h=>{if(h){this[T](h,e),i();return}o()})}o()},o=()=>{m.default.lstat(String(e.absolute),(a,h)=>{if(h&&(this.keep||this.newer&&h.mtime>(e.mtime??h.mtime))){this[Ar](e),i();return}if(a||this[Nr](e,h))return this[G](null,e,i);if(h.isDirectory()){if(e.type==="Directory"){let l=this.chmod&&e.mode&&(h.mode&4095)!==e.mode,c=u=>this[G](u??null,e,i);return l?m.default.chmod(String(e.absolute),Number(e.mode),c):c()}if(e.absolute!==this.cwd)return m.default.rmdir(String(e.absolute),l=>this[G](l??null,e,i))}if(e.absolute===this.cwd)return this[G](null,e,i);ll(String(e.absolute),l=>this[G](l??null,e,i))})};this[Bt]?n():r()}[G](e,t,i){if(e){this[T](e,t),i();return}switch(t.type){case"File":case"OldFile":case"ContiguousFile":return this[Mr](t,i);case"Link":return this[ao](t,i);case"SymbolicLink":return this[oo](t,i);case"Directory":case"GNUDumpDir":return this[Lr](t,i)}}[Zi](e,t,i,r){m.default[i](t,String(e.absolute),n=>{n?this[T](n,e):(this[ut](),e.resume()),r()})}};k.Unpack=Yi;var Lt=s=>{try{return[null,s()]}catch(e){return[e,null]}},Ir=class extends Yi{sync=!0;[G](e,t){return super[G](e,t,()=>{})}[Pr](e){if(!this[Bt]){let n=this[Pe](this.cwd,this.dmode);if(n)return this[T](n,e);this[Bt]=!0}if(e.absolute!==this.cwd){let n=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(n!==this.cwd){let o=this[Pe](n,this.dmode);if(o)return this[T](o,e)}}let[t,i]=Lt(()=>m.default.lstatSync(String(e.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(e.mtime??i.mtime)))return this[Ar](e);if(t||this[Nr](e,i))return this[G](null,e);if(i.isDirectory()){if(e.type==="Directory"){let o=this.chmod&&e.mode&&(i.mode&4095)!==e.mode,[a]=o?Lt(()=>{m.default.chmodSync(String(e.absolute),Number(e.mode))}):[];return this[G](a,e)}let[n]=Lt(()=>m.default.rmdirSync(String(e.absolute)));this[G](n,e)}let[r]=e.absolute===this.cwd?[]:Lt(()=>cl(String(e.absolute)));this[G](r,e)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=a=>{let h;try{m.default.closeSync(n)}catch(l){h=l}(a||h)&&this[T](a||h,e),t()},n;try{n=m.default.openSync(String(e.absolute),(0,po.getWriteFlag)(e.size),i)}catch(a){return r(a)}let o=this.transform&&this.transform(e)||e;o!==e&&(o.on("error",a=>this[T](a,e)),e.pipe(o)),o.on("data",a=>{try{m.default.writeSync(n,a,0,a.length)}catch(h){r(h)}}),o.on("end",()=>{let a=null;if(e.mtime&&!this.noMtime){let h=e.atime||new Date,l=e.mtime;try{m.default.futimesSync(n,h,l)}catch(c){try{m.default.utimesSync(String(e.absolute),h,l)}catch{a=c}}}if(this[It](e)){let h=this[Ft](e),l=this[Ct](e);try{m.default.fchownSync(n,Number(h),Number(l))}catch(c){try{m.default.chownSync(String(e.absolute),Number(h),Number(l))}catch{a=a||c}}}r(a)})}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode,r=this[Pe](String(e.absolute),i);if(r){this[T](r,e),t();return}if(e.mtime&&!this.noMtime)try{m.default.utimesSync(String(e.absolute),e.atime||new Date,e.mtime)}catch{}if(this[It](e))try{m.default.chownSync(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)))}catch{}t(),e.resume()}[Pe](e,t){try{return(0,_o.mkdirSync)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t})}catch(i){return i}}[At](e,t,i,r,n){if(this.preservePaths||i.length===0)return r();let o=t;for(let a of i){o=g.default.resolve(o,a);let[h,l]=Lt(()=>m.default.lstatSync(o));if(h)return r();if(l.isSymbolicLink())return n(new wo.SymlinkError(o,g.default.resolve(t,i.join("/"))))}r()}[Zi](e,t,i,r){let n=`${i}Sync`;try{m.default[n](t,String(e.absolute)),r(),e.resume()}catch(o){return this[T](o,e)}}};k.UnpackSync=Ir});var Br=d(Z=>{"use strict";var ul=Z&&Z.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),fl=Z&&Z.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),dl=Z&&Z.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ul(t,e,i[r]);return fl(t,e),t}})(),ml=Z&&Z.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(Z,"__esModule",{value:!0});Z.extract=void 0;var yo=dl(Ke()),Eo=ml(require("node:fs")),pl=rt(),_l=Ve(),Ki=Cr(),wl=s=>{let e=new Ki.UnpackSync(s),t=s.file,i=Eo.default.statSync(t),r=s.maxReadSize||16*1024*1024;new yo.ReadStreamSync(t,{readSize:r,size:i.size}).pipe(e)},yl=(s,e)=>{let t=new Ki.Unpack(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("close",o),Eo.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new yo.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};Z.extract=(0,_l.makeCommand)(wl,yl,s=>new Ki.UnpackSync(s),s=>new Ki.Unpack(s),(s,e)=>{e?.length&&(0,pl.filesFilter)(s,e)})});var Vi=d(ft=>{"use strict";var bo=ft&&ft.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ft,"__esModule",{value:!0});ft.replace=void 0;var So=Ke(),q=bo(require("node:fs")),go=bo(require("node:path")),Ro=et(),Oo=rt(),El=Ve(),bl=Qt(),vo=Ci(),Sl=(s,e)=>{let t=new vo.PackSync(s),i=!0,r,n;try{try{r=q.default.openSync(s.file,"r+")}catch(h){if(h?.code==="ENOENT")r=q.default.openSync(s.file,"w+");else throw h}let o=q.default.fstatSync(r),a=Buffer.alloc(512);e:for(n=0;n<o.size;n+=512){for(let c=0,u=0;c<512;c+=u){if(u=q.default.readSync(r,a,c,a.length-c,n+c),n===0&&a[0]===31&&a[1]===139)throw new Error("cannot append to compressed archives");if(!u)break e}let h=new Ro.Header(a);if(!h.cksumValid)break;let l=512*Math.ceil((h.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&h.mtime&&s.mtimeCache.set(String(h.path),h.mtime)}i=!1,gl(s,t,n,r,e)}finally{if(i)try{q.default.closeSync(r)}catch{}}},gl=(s,e,t,i,r)=>{let n=new So.WriteStreamSync(s.file,{fd:i,start:t});e.pipe(n),Ol(e,r)},Rl=(s,e)=>{e=Array.from(e);let t=new vo.Pack(s),i=(n,o,a)=>{let h=(D,A)=>{D?q.default.close(n,w=>a(D)):a(null,A)},l=0;if(o===0)return h(null,0);let c=0,u=Buffer.alloc(512),E=(D,A)=>{if(D||A===void 0)return h(D);if(c+=A,c<512&&A)return q.default.read(n,u,c,u.length-c,l+c,E);if(l===0&&u[0]===31&&u[1]===139)return h(new Error("cannot append to compressed archives"));if(c<512)return h(null,l);let w=new Ro.Header(u);if(!w.cksumValid)return h(null,l);let P=512*Math.ceil((w.size??0)/512);if(l+P+512>o||(l+=P+512,l>=o))return h(null,l);s.mtimeCache&&w.mtime&&s.mtimeCache.set(String(w.path),w.mtime),c=0,q.default.read(n,u,0,512,l,E)};q.default.read(n,u,0,512,l,E)};return new Promise((n,o)=>{t.on("error",o);let a="r+",h=(l,c)=>{if(l&&l.code==="ENOENT"&&a==="r+")return a="w+",q.default.open(s.file,a,h);if(l||!c)return o(l);q.default.fstat(c,(u,E)=>{if(u)return q.default.close(c,()=>o(u));i(c,E.size,(D,A)=>{if(D)return o(D);let w=new So.WriteStream(s.file,{fd:c,start:A});t.pipe(w),w.on("error",o),w.on("close",n),vl(t,e)})})};q.default.open(s.file,a,h)})},Ol=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,Oo.list)({file:go.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},vl=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,Oo.list)({file:go.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t);s.end()};ft.replace=(0,El.makeCommand)(Sl,Rl,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,e)=>{if(!(0,bl.isFile)(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!e?.length)throw new TypeError("no paths specified to add/replace")})});var zr=d($i=>{"use strict";Object.defineProperty($i,"__esModule",{value:!0});$i.update=void 0;var Tl=Ve(),kt=Vi();$i.update=(0,Tl.makeCommand)(kt.replace.syncFile,kt.replace.asyncFile,kt.replace.syncNoFile,kt.replace.asyncNoFile,(s,e=[])=>{kt.replace.validate?.(s,e),Dl(s)});var Dl=s=>{let e=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=e?(t,i)=>e(t,i)&&!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0)):(t,i)=>!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0))}});var To=exports&&exports.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Pl=exports&&exports.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Y=exports&&exports.__exportStar||function(s,e){for(var t in s)t!=="default"&&!Object.prototype.hasOwnProperty.call(e,t)&&To(e,s,t)},Nl=exports&&exports.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&To(t,e,i[r]);return Pl(t,e),t}})();Object.defineProperty(exports,"__esModule",{value:!0});exports.u=exports.types=exports.r=exports.t=exports.x=exports.c=void 0;Y(_r(),exports);var Ml=_r();Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Ml.create}});Y(Br(),exports);var Ll=Br();Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return Ll.extract}});Y(et(),exports);Y(rt(),exports);var Al=rt();Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Al.list}});Y(Ci(),exports);Y(_i(),exports);Y(si(),exports);Y(Cs(),exports);Y(Vi(),exports);var Il=Vi();Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Il.replace}});exports.types=Nl(Ns());Y(Cr(),exports);Y(zr(),exports);var Fl=zr();Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return Fl.update}});Y(nr(),exports);
+`).reduce(Fa,Object.create(null)),Fa=(s,e)=>{let t=parseInt(e,10);if(t!==Buffer.byteLength(e)+1)return s;e=e.slice((t+" ").length);let i=e.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let a=+o;a>=0&&(s[n]=a);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s}});var tt=d(ri=>{"use strict";Object.defineProperty(ri,"__esModule",{value:!0});ri.normalizeWindowsPath=void 0;var Ca=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform;ri.normalizeWindowsPath=Ca!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/")});var Cs=d(oi=>{"use strict";Object.defineProperty(oi,"__esModule",{value:!0});oi.ReadEntry=void 0;var Ba=We(),ni=tt(),Fs=class extends Ba.Minipass{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(e,t,i){switch(super({}),this.pause(),this.extended=t,this.globalExtended=i,this.header=e,this.remain=e.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=e.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!e.path)throw new Error("no path provided for tar.ReadEntry");this.path=(0,ni.normalizeWindowsPath)(e.path),this.mode=e.mode,this.mode&&(this.mode=this.mode&4095),this.uid=e.uid,this.gid=e.gid,this.uname=e.uname,this.gname=e.gname,this.size=this.remain,this.mtime=e.mtime,this.atime=e.atime,this.ctime=e.ctime,this.linkpath=e.linkpath?(0,ni.normalizeWindowsPath)(e.linkpath):void 0,this.uname=e.uname,this.gname=e.gname,t&&this.#e(t),i&&this.#e(i,!0)}write(e){let t=e.length;if(t>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-t),this.blockRemain=Math.max(0,r-t),this.ignore?!0:i>=t?super.write(e):super.write(e.subarray(0,i))}#e(e,t=!1){e.path&&(e.path=(0,ni.normalizeWindowsPath)(e.path)),e.linkpath&&(e.linkpath=(0,ni.normalizeWindowsPath)(e.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="path"&&t))))}};oi.ReadEntry=Fs});var hi=d(ai=>{"use strict";Object.defineProperty(ai,"__esModule",{value:!0});ai.warnMethod=void 0;var za=(s,e,t,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=t instanceof Error&&t.code||e,i.tarCode=e,!s.strict&&i.recoverable!==!1?(t instanceof Error&&(i=Object.assign(t,i),t=t.message),s.emit("warn",e,t,i)):t instanceof Error?s.emit("error",Object.assign(t,i)):s.emit("error",Object.assign(new Error(`${e}: ${t}`),i))};ai.warnMethod=za});var _i=d(pi=>{"use strict";Object.defineProperty(pi,"__esModule",{value:!0});pi.Parser=void 0;var ka=require("events"),Bs=Ps(),Xr=et(),Qr=si(),xa=Cs(),ja=hi(),Ua=1024*1024,qs=Buffer.from([31,139]),Ws=Buffer.from([40,181,47,253]),qa=Math.max(qs.length,Ws.length),H=Symbol("state"),ze=Symbol("writeEntry"),me=Symbol("readEntry"),zs=Symbol("nextEntry"),Jr=Symbol("processEntry"),re=Symbol("extendedHeader"),gt=Symbol("globalExtendedHeader"),Re=Symbol("meta"),en=Symbol("emitMeta"),_=Symbol("buffer"),pe=Symbol("queue"),Oe=Symbol("ended"),ks=Symbol("emittedEnd"),ke=Symbol("emit"),y=Symbol("unzip"),li=Symbol("consumeChunk"),ci=Symbol("consumeChunkSub"),xs=Symbol("consumeBody"),tn=Symbol("consumeMeta"),sn=Symbol("consumeHeader"),Rt=Symbol("consuming"),js=Symbol("bufferConcat"),ui=Symbol("maybeEnd"),it=Symbol("writing"),ne=Symbol("aborted"),fi=Symbol("onDone"),xe=Symbol("sawValidEntry"),di=Symbol("sawNullBlock"),mi=Symbol("sawEOF"),rn=Symbol("closeStream"),Wa=1e3,Ot=Symbol("compressedBytesRead"),Us=Symbol("decompressedBytesRead"),nn=Symbol("checkDecompressionRatio"),Ha=()=>!0,Hs=class extends ka.EventEmitter{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[pe]=[];[_];[me];[ze];[H]="begin";[Re]="";[re];[gt];[Oe]=!1;[y];[ne]=!1;[xe];[di]=!1;[mi]=!1;[it]=!1;[Rt]=!1;[ks]=!1;[Ot]=0;[Us]=0;constructor(e={}){super(),this.file=e.file||"",this.on(fi,()=>{(this[H]==="begin"||this[xe]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),e.ondone?this.on(fi,e.ondone):this.on(fi,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!e.strict,this.maxDecompressionRatio=typeof e.maxDecompressionRatio=="number"?e.maxDecompressionRatio:Wa,this.maxMetaEntrySize=e.maxMetaEntrySize||Ua,this.filter=typeof e.filter=="function"?e.filter:Ha;let t=e.file&&(e.file.endsWith(".tar.br")||e.file.endsWith(".tbr"));this.brotli=!(e.gzip||e.zstd)&&e.brotli!==void 0?e.brotli:t?void 0:!1;let i=e.file&&(e.file.endsWith(".tar.zst")||e.file.endsWith(".tzst"));this.zstd=!(e.gzip||e.brotli)&&e.zstd!==void 0?e.zstd:i?!0:void 0,this.on("end",()=>this[rn]()),typeof e.onwarn=="function"&&this.on("warn",e.onwarn),typeof e.onReadEntry=="function"&&this.on("entry",e.onReadEntry)}warn(e,t,i={}){(0,ja.warnMethod)(this,e,t,i)}[sn](e,t){this[xe]===void 0&&(this[xe]=!1);let i;try{i=new Xr.Header(e,t,this[re],this[gt])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[di]?(this[mi]=!0,this[H]==="begin"&&(this[H]="header"),this[ke]("eof")):(this[di]=!0,this[ke]("nullBlock"));else if(this[di]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[ze]=new xa.ReadEntry(i,this[re],this[gt]);if(!this[xe])if(n.remain){let o=()=>{n.invalid||(this[xe]=!0)};n.on("end",o)}else this[xe]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[ke]("ignoredEntry",n),this[H]="ignore",n.resume()):n.size>0&&(this[Re]="",n.on("data",o=>this[Re]+=o),this[H]="meta"):(this[re]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[ke]("ignoredEntry",n),this[H]=n.remain?"ignore":"header",n.resume()):(n.remain?this[H]="body":(this[H]="header",n.end()),this[me]?this[pe].push(n):(this[pe].push(n),this[zs]())))}}}[rn](){queueMicrotask(()=>this.emit("close"))}[Jr](e){let t=!0;if(!e)this[me]=void 0,t=!1;else if(Array.isArray(e)){let[i,...r]=e;this.emit(i,...r)}else this[me]=e,this.emit("entry",e),e.emittedEnd||(e.on("end",()=>this[zs]()),t=!1);return t}[zs](){do;while(this[Jr](this[pe].shift()));if(this[pe].length===0){let e=this[me];!e||e.flowing||e.size===e.remain?this[it]||this.emit("drain"):e.once("drain",()=>this.emit("drain"))}}[xs](e,t){let i=this[ze];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=e.length&&t===0?e:e.subarray(t,t+r);return i.write(n),i.blockRemain||(this[H]="header",this[ze]=void 0,i.end()),n.length}[tn](e,t){let i=this[ze],r=this[xs](e,t);return!this[ze]&&i&&this[en](i),r}[ke](e,t,i){this[pe].length===0&&!this[me]?this.emit(e,t,i):this[pe].push([e,t,i])}[en](e){switch(this[ke]("meta",this[Re]),e.type){case"ExtendedHeader":case"OldExtendedHeader":this[re]=Qr.Pax.parse(this[Re],this[re],!1);break;case"GlobalExtendedHeader":this[gt]=Qr.Pax.parse(this[Re],this[gt],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let t=this[re]??Object.create(null);this[re]=t,t.path=this[Re].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let t=this[re]||Object.create(null);this[re]=t,t.linkpath=this[Re].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+e.type)}}abort(e){if(!this[ne]){if(this[y]){let t=this[y];t.write=()=>!0,t.end=()=>t,t.emit=()=>!1,t.destroy?.()}this[ne]=!0,this.emit("abort",e),this.warn("TAR_ABORT",e,{recoverable:!1})}}[nn](e){this[Us]+=e.length;let t=this[Us]/this[Ot];return t>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${t.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this[ne])return i?.(),!1;if((this[y]===void 0||this.brotli===void 0&&this[y]===!1)&&e){if(this[_]&&(e=Buffer.concat([this[_],e]),this[_]=void 0),e.length<qa)return this[_]=e,i?.(),!0;for(let h=0;this[y]===void 0&&h<qs.length;h++)e[h]!==qs[h]&&(this[y]=!1);let o=!1;if(this[y]===!1&&this.zstd!==!1){o=!0;for(let h=0;h<Ws.length;h++)if(e[h]!==Ws[h]){o=!1;break}}let a=this.brotli===void 0&&!o;if(this[y]===!1&&a)if(e.length<512)if(this[Oe])this.brotli=!0;else return this[_]=e,i?.(),!0;else try{new Xr.Header(e.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[y]===void 0||this[y]===!1&&(this.brotli||o)){let h=this[Oe];this[Oe]=!1,this[y]=this[y]===void 0?new Bs.Unzip({}):o?new Bs.ZstdDecompress({}):new Bs.BrotliDecompress({}),this[y].on("data",c=>{this[nn](c)&&this[li](c)}),this[y].on("error",c=>{this[ne]||this.abort(c)}),this[y].on("end",()=>{this[Oe]=!0,this[li]()}),this[it]=!0,this[Ot]+=e.length;let l=!!this[y][h?"end":"write"](e);return this[it]=!1,i?.(),l}}this[it]=!0,this[y]?(this[Ot]+=e.length,this[y].write(e)):this[li](e),this[it]=!1;let n=this[pe].length>0?!1:this[me]?this[me].flowing:!0;return!n&&this[pe].length===0&&this[me]?.once("drain",()=>this.emit("drain")),i?.(),n}[js](e){e&&!this[ne]&&(this[_]=this[_]?Buffer.concat([this[_],e]):e)}[ui](){if(this[Oe]&&!this[ks]&&!this[ne]&&!this[Rt]){this[ks]=!0;let e=this[ze];if(e?.blockRemain){let t=this[_]?this[_].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${e.blockRemain} more bytes, only ${t} available)`,{entry:e}),this[_]&&e.write(this[_]),e.end()}this[ke](fi)}}[li](e){if(this[Rt]&&e)this[js](e);else if(!e&&!this[_])this[ui]();else if(e){if(this[Rt]=!0,this[_]){this[js](e);let t=this[_];this[_]=void 0,this[ci](t)}else this[ci](e);for(;this[_]&&this[_]?.length>=512&&!this[ne]&&!this[mi];){let t=this[_];this[_]=void 0,this[ci](t)}this[Rt]=!1}(!this[_]||this[Oe])&&this[ui]()}[ci](e){let t=0,i=e.length;for(;t+512<=i&&!this[ne]&&!this[mi];)switch(this[H]){case"begin":case"header":this[sn](e,t),t+=512;break;case"ignore":case"body":t+=this[xs](e,t);break;case"meta":t+=this[tn](e,t);break;default:throw new Error("invalid state: "+this[H])}t<i&&(this[_]=this[_]?Buffer.concat([e.subarray(t),this[_]]):e.subarray(t))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t)),i&&this.once("finish",i),this[ne]||(this[y]?(e&&(this[Ot]+=e.length,this[y].write(e)),this[y].end()):(this[Oe]=!0,(this.brotli===void 0||this.zstd===void 0)&&(e=e||Buffer.alloc(0)),e&&this.write(e),this[ui]())),this}};pi.Parser=Hs});var yi=d(wi=>{"use strict";Object.defineProperty(wi,"__esModule",{value:!0});wi.stripTrailingSlashes=void 0;var Ga=s=>{let e=s.length-1,t=-1;for(;e>-1&&s.charAt(e)==="/";)t=e,e--;return t===-1?s:s.slice(0,t)};wi.stripTrailingSlashes=Ga});var rt=d(B=>{"use strict";var Za=B&&B.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ya=B&&B.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Ka=B&&B.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Za(t,e,i[r]);return Ya(t,e),t}})(),Va=B&&B.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(B,"__esModule",{value:!0});B.list=B.filesFilter=void 0;var $a=Ka(Ke()),st=Va(require("node:fs")),on=require("path"),Xa=Ve(),Ei=_i(),Gs=yi(),Qa=s=>{let e=s.onReadEntry;s.onReadEntry=e?t=>{e(t),t.resume()}:t=>t.resume()},Ja=(s,e)=>{let t=new Map(e.map(o=>[(0,Gs.stripTrailingSlashes)(o),!0])),i=s.filter,r=100,n=(o,a="",h=0)=>{if(h>=r)return t.set(o,!1),!1;let l=a||(0,on.parse)(o).root||".",c;if(o===l)c=!1;else{let u=t.get(o);c=u!==void 0?u:n((0,on.dirname)(o),l,h+1)}return t.set(o,c),c};s.filter=i?(o,a)=>i(o,a)&&n((0,Gs.stripTrailingSlashes)(o)):o=>n((0,Gs.stripTrailingSlashes)(o))};B.filesFilter=Ja;var eh=s=>{let e=new Ei.Parser(s),t=s.file,i;try{i=st.default.openSync(t,"r");let r=st.default.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),a=st.default.readSync(i,o,0,r.size,0);e.end(a===o.byteLength?o:o.subarray(0,a))}else{let o=0,a=Buffer.allocUnsafe(n);for(;o<r.size;){let h=st.default.readSync(i,a,0,n,o);if(h===0)break;o+=h,e.write(a.subarray(0,h))}e.end()}}finally{if(typeof i=="number")try{st.default.closeSync(i)}catch{}}},th=(s,e)=>{let t=new Ei.Parser(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("end",o),st.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new $a.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};B.list=(0,Xa.makeCommand)(eh,th,s=>new Ei.Parser(s),s=>new Ei.Parser(s),(s,e)=>{e?.length&&(0,B.filesFilter)(s,e),s.noResume||Qa(s)})});var an=d(bi=>{"use strict";Object.defineProperty(bi,"__esModule",{value:!0});bi.modeFix=void 0;var ih=(s,e,t)=>(s&=4095,t&&(s=(s|384)&-19),e&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);bi.modeFix=ih});var Zs=d(Si=>{"use strict";Object.defineProperty(Si,"__esModule",{value:!0});Si.stripAbsolutePath=void 0;var sh=require("node:path"),{isAbsolute:rh,parse:hn}=sh.win32,nh=s=>{let e="",t=hn(s);for(;rh(s)||t.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":t.root;s=s.slice(i.length),e+=i,t=hn(s)}return[e,s]};Si.stripAbsolutePath=nh});var Ks=d(nt=>{"use strict";Object.defineProperty(nt,"__esModule",{value:!0});nt.decode=nt.encode=void 0;var gi=["|","<",">","?",":"],Ys=gi.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),oh=new Map(gi.map((s,e)=>[s,Ys[e]])),ah=new Map(Ys.map((s,e)=>[s,gi[e]])),hh=s=>gi.reduce((e,t)=>e.split(t).join(oh.get(t)),s);nt.encode=hh;var lh=s=>Ys.reduce((e,t)=>e.split(t).join(ah.get(t)),s);nt.decode=lh});var nr=d(M=>{"use strict";var ch=M&&M.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),uh=M&&M.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fh=M&&M.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ch(t,e,i[r]);return uh(t,e),t}})(),mn=M&&M.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(M,"__esModule",{value:!0});M.WriteEntryTar=M.WriteEntrySync=M.WriteEntry=void 0;var ae=mn(require("fs")),pn=We(),ln=mn(require("path")),_n=et(),wn=an(),oe=tt(),yn=Qt(),En=si(),bn=Zs(),dh=yi(),Sn=hi(),mh=fh(Ks()),gn=(s,e)=>e?(s=(0,oe.normalizeWindowsPath)(s).replace(/^\.(\/|$)/,""),(0,dh.stripTrailingSlashes)(e)+"/"+s):(0,oe.normalizeWindowsPath)(s),ph=16*1024*1024,cn=Symbol("process"),un=Symbol("file"),fn=Symbol("directory"),$s=Symbol("symlink"),dn=Symbol("hardlink"),vt=Symbol("header"),Ri=Symbol("read"),Xs=Symbol("lstat"),Oi=Symbol("onlstat"),Qs=Symbol("onread"),Js=Symbol("onreadlink"),er=Symbol("openfile"),tr=Symbol("onopenfile"),ve=Symbol("close"),vi=Symbol("mode"),ir=Symbol("awaitDrain"),Vs=Symbol("ondrain"),he=Symbol("prefix"),Ti=class extends pn.Minipass{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#e=!1;constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.path=(0,oe.normalizeWindowsPath)(e),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||ph,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=(0,oe.normalizeWindowsPath)(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?(0,oe.normalizeWindowsPath)(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,a]=(0,bn.stripAbsolutePath)(this.path);o&&typeof a=="string"&&(this.path=a,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=mh.decode(this.path.replaceAll(/\\/g,"/")),e=e.replaceAll(/\\/g,"/")),this.absolute=(0,oe.normalizeWindowsPath)(i.absolute||ln.default.resolve(this.cwd,e)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[Oi](n):this[Xs]()}warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}emit(e,...t){return e==="error"&&(this.#e=!0),super.emit(e,...t)}[Xs](){ae.default.lstat(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Oi](t)})}[Oi](e){this.statCache.set(this.absolute,e),this.stat=e,e.isFile()||(e.size=0),this.type=_h(e),this.emit("stat",e),this[cn]()}[cn](){switch(this.type){case"File":return this[un]();case"Directory":return this[fn]();case"SymbolicLink":return this[$s]();default:return this.end()}}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}[he](e){return gn(e,this.prefix)}[vt](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this[vi](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let e=this.header?.block;if(!e)throw new Error("failed to encode header");super.write(e)}[fn](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[vt](),this.end()}[$s](){ae.default.readlink(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Js](t)})}[Js](e){this.linkpath=(0,oe.normalizeWindowsPath)(e),this[vt](),this.end()}[dn](e){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=(0,oe.normalizeWindowsPath)(ln.default.relative(this.cwd,e)),this.stat.size=0,this[vt](),this.end()}[un](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let e=`${this.stat.dev}:${this.stat.ino}`,t=this.linkCache.get(e);if(t?.indexOf(this.cwd)===0)return this[dn](t);this.linkCache.set(e,this.absolute)}if(this[vt](),this.stat.size===0)return this.end();this[er]()}[er](){ae.default.open(this.absolute,"r",(e,t)=>{if(e)return this.emit("error",e);this[tr](t)})}[tr](e){if(this.fd=e,this.#e)return this[ve]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let t=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(t),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[Ri]()}[Ri](){let{fd:e,buf:t,offset:i,length:r,pos:n}=this;if(e===void 0||t===void 0)throw new Error("cannot read file without first opening");ae.default.read(e,t,i,r,n,(o,a)=>{if(o)return this[ve](()=>this.emit("error",o));this[Qs](a)})}[ve](e=()=>{}){this.fd!==void 0&&ae.default.close(this.fd,e)}[Qs](e){if(e<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(e>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(e===this.remain)for(let r=e;r<this.length&&e<this.blockRemain;r++)this.buf[r+this.offset]=0,e++,this.remain++;let t=this.offset===0&&e===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+e);this.write(t)?this[Vs]():this[ir](()=>this[Vs]())}[ir](e){this.once("drain",e)}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this.blockRemain<e.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=e.length,this.blockRemain-=e.length,this.pos+=e.length,this.offset+=e.length,super.write(e,null,i)}[Vs](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[ve](e=>e?this.emit("error",e):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[Ri]()}};M.WriteEntry=Ti;var sr=class extends Ti{sync=!0;[Xs](){this[Oi](ae.default.lstatSync(this.absolute))}[$s](){this[Js](ae.default.readlinkSync(this.absolute))}[er](){this[tr](ae.default.openSync(this.absolute,"r"))}[Ri](){let e=!0;try{let{fd:t,buf:i,offset:r,length:n,pos:o}=this;if(t===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let a=ae.default.readSync(t,i,r,n,o);this[Qs](a),e=!1}finally{if(e)try{this[ve](()=>{})}catch{}}}[ir](e){e()}[ve](e=()=>{}){this.fd!==void 0&&ae.default.closeSync(this.fd),e()}};M.WriteEntrySync=sr;var rr=class extends pn.Minipass{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=e;let{type:r}=e;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=(0,oe.normalizeWindowsPath)(e.path),this.mode=e.mode!==void 0?this[vi](e.mode):void 0,this.uid=this.portable?void 0:e.uid,this.gid=this.portable?void 0:e.gid,this.uname=this.portable?void 0:e.uname,this.gname=this.portable?void 0:e.gname,this.size=e.size,this.mtime=this.noMtime?void 0:i.mtime||e.mtime,this.atime=this.portable?void 0:e.atime,this.ctime=this.portable?void 0:e.ctime,this.linkpath=e.linkpath!==void 0?(0,oe.normalizeWindowsPath)(e.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[a,h]=(0,bn.stripAbsolutePath)(this.path);a&&typeof h=="string"&&(this.path=h,n=a)}this.remain=e.size,this.blockRemain=e.startBlockSize,this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),e.pipe(this)}[he](e){return gn(e,this.prefix)}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}write(e,t,i){typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8"));let r=e.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(e,i)}end(e,t,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t??"utf8")),i&&this.once("finish",i),e?super.end(e,i):super.end(i),this}};M.WriteEntryTar=rr;var _h=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported"});var Rn=d(at=>{"use strict";Object.defineProperty(at,"__esModule",{value:!0});at.Node=at.Yallist=void 0;var or=class s{tail;head;length=0;static create(e=[]){return new s(e)}constructor(e=[]){for(let t of e)this.push(t)}*[Symbol.iterator](){for(let e=this.head;e;e=e.next)yield e.value}removeNode(e){if(e.list!==this)throw new Error("removing node which does not belong to this list");let t=e.next,i=e.prev;return t&&(t.prev=i),i&&(i.next=t),e===this.head&&(this.head=t),e===this.tail&&(this.tail=i),this.length--,e.next=void 0,e.prev=void 0,e.list=void 0,t}unshiftNode(e){if(e===this.head)return;e.list&&e.list.removeNode(e);let t=this.head;e.list=this,e.next=t,t&&(t.prev=e),this.head=e,this.tail||(this.tail=e),this.length++}pushNode(e){if(e===this.tail)return;e.list&&e.list.removeNode(e);let t=this.tail;e.list=this,e.prev=t,t&&(t.next=e),this.tail=e,this.head||(this.head=e),this.length++}push(...e){for(let t=0,i=e.length;t<i;t++)yh(this,e[t]);return this.length}unshift(...e){for(var t=0,i=e.length;t<i;t++)Eh(this,e[t]);return this.length}pop(){if(!this.tail)return;let e=this.tail.value,t=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,t.list=void 0,this.length--,e}shift(){if(!this.head)return;let e=this.head.value,t=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,t.list=void 0,this.length--,e}forEach(e,t){t=t||this;for(let i=this.head,r=0;i;r++)e.call(t,i.value,r,this),i=i.next}forEachReverse(e,t){t=t||this;for(let i=this.tail,r=this.length-1;i;r--)e.call(t,i.value,r,this),i=i.prev}get(e){let t=0,i=this.head;for(;i&&t<e;t++)i=i.next;if(t===e&&i)return i.value}getReverse(e){let t=0,i=this.tail;for(;i&&t<e;t++)i=i.prev;if(t===e&&i)return i.value}map(e,t){t=t||this;let i=new s;for(let r=this.head;r;)i.push(e.call(t,r.value,this)),r=r.next;return i}mapReverse(e,t){t=t||this;var i=new s;for(let r=this.tail;r;)i.push(e.call(t,r.value,this)),r=r.prev;return i}reduce(e,t){let i,r=this.head;if(arguments.length>1)i=t;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=e(i,r.value,n),r=r.next;return i}reduceReverse(e,t){let i,r=this.tail;if(arguments.length>1)i=t;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=e(i,r.value,n),r=r.prev;return i}toArray(){let e=new Array(this.length);for(let t=0,i=this.head;i;t++)e[t]=i.value,i=i.next;return e}toArrayReverse(){let e=new Array(this.length);for(let t=0,i=this.tail;i;t++)e[t]=i.value,i=i.prev;return e}slice(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.head,n=0;for(n=0;r&&n<e;n++)r=r.next;for(;r&&n<t;n++,r=r.next)i.push(r.value);return i}sliceReverse(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.length,n=this.tail;for(;n&&r>t;r--)n=n.prev;for(;n&&r>e;r--,n=n.prev)i.push(n.value);return i}splice(e,t=0,...i){e>this.length&&(e=this.length-1),e<0&&(e=this.length+e);let r=this.head;for(let o=0;r&&o<e;o++)r=r.next;let n=[];for(let o=0;r&&o<t;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=wh(this,r,o);return n}reverse(){let e=this.head,t=this.tail;for(let i=e;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=t,this.tail=e,this}};at.Yallist=or;function wh(s,e,t){let i=e,r=e?e.next:s.head,n=new ot(t,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function yh(s,e){s.tail=new ot(e,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Eh(s,e){s.head=new ot(e,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ot=class{list;next;prev;value;constructor(e,t,i,r){this.list=r,this.value=e,t?(t.next=this,this.prev=t):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};at.Node=ot});var Ci=d(L=>{"use strict";var bh=L&&L.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Sh=L&&L.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),gh=L&&L.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&bh(t,e,i[r]);return Sh(t,e),t}})(),Pn=L&&L.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(L,"__esModule",{value:!0});L.PackSync=L.Pack=L.PackJob=void 0;var Ii=Pn(require("fs")),fr=nr(),Nt=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(e,t){this.path=e||"./",this.absolute=t}};L.PackJob=Nt;var Rh=We(),ar=gh(Ps()),Oh=Rn(),vh=hi(),On=Buffer.alloc(1024),Pi=Symbol("onStat"),Tt=Symbol("ended"),X=Symbol("queue"),Dt=Symbol("pendingLinks"),Te=Symbol("current"),je=Symbol("process"),Pt=Symbol("processing"),Di=Symbol("processJob"),Q=Symbol("jobs"),hr=Symbol("jobDone"),Ni=Symbol("addFSEntry"),vn=Symbol("addTarEntry"),dr=Symbol("stat"),mr=Symbol("readdir"),Mi=Symbol("onreaddir"),Li=Symbol("pipe"),Tn=Symbol("entry"),lr=Symbol("entryOpt"),Ai=Symbol("writeEntryClass"),Nn=Symbol("write"),cr=Symbol("ondrain"),Dn=Pn(require("path")),ur=tt(),Fi=class extends Rh.Minipass{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[Ai];onWriteEntry;[X];[Dt]=new Map;[Q]=0;[Pt]=!1;[Tt]=!1;constructor(e={}){if(super(),this.opt=e,this.file=e.file||"",this.cwd=e.cwd||process.cwd(),this.maxReadSize=e.maxReadSize,this.preservePaths=!!e.preservePaths,this.strict=!!e.strict,this.noPax=!!e.noPax,this.prefix=(0,ur.normalizeWindowsPath)(e.prefix||""),this.linkCache=e.linkCache||new Map,this.statCache=e.statCache||new Map,this.readdirCache=e.readdirCache||new Map,this.onWriteEntry=e.onWriteEntry,this[Ai]=fr.WriteEntry,typeof e.onwarn=="function"&&this.on("warn",e.onwarn),this.portable=!!e.portable,e.gzip||e.brotli||e.zstd){if((e.gzip?1:0)+(e.brotli?1:0)+(e.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(e.gzip&&(typeof e.gzip!="object"&&(e.gzip={}),this.portable&&(e.gzip.portable=!0),this.zip=new ar.Gzip(e.gzip)),e.brotli&&(typeof e.brotli!="object"&&(e.brotli={}),this.zip=new ar.BrotliCompress(e.brotli)),e.zstd&&(typeof e.zstd!="object"&&(e.zstd={}),this.zip=new ar.ZstdCompress(e.zstd)),!this.zip)throw new Error("impossible");let t=this.zip;t.on("data",i=>super.write(i)),t.on("end",()=>super.end()),t.on("drain",()=>this[cr]()),this.on("resume",()=>t.resume())}else this.on("drain",this[cr]);this.noDirRecurse=!!e.noDirRecurse,this.follow=!!e.follow,this.noMtime=!!e.noMtime,e.mtime&&(this.mtime=e.mtime),this.filter=typeof e.filter=="function"?e.filter:()=>!0,this[X]=new Oh.Yallist,this[Q]=0,this.jobs=Number(e.jobs)||4,this[Pt]=!1,this[Tt]=!1}[Nn](e){return super.write(e)}add(e){return this.write(e),this}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&this.add(e),this[Tt]=!0,this[je](),i&&i(),this}write(e){if(this[Tt])throw new Error("write after end");return typeof e=="string"?this[Ni](e):this[vn](e),this.flowing}[vn](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e.path));if(!this.filter(e.path,e))e.resume();else{let i=new Nt(e.path,t);i.entry=new fr.WriteEntryTar(e,this[lr](i)),i.entry.on("end",()=>this[hr](i)),this[Q]+=1,this[X].push(i)}this[je]()}[Ni](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e));this[X].push(new Nt(e,t)),this[je]()}[dr](e){e.pending=!0,this[Q]+=1;let t=this.follow?"stat":"lstat";Ii.default[t](e.absolute,(i,r)=>{e.pending=!1,this[Q]-=1,i?this.emit("error",i):this[Pi](e,r)})}[Pi](e,t){if(this.statCache.set(e.absolute,t),e.stat=t,!this.filter(e.path,t))e.ignore=!0;else if(t.isFile()&&t.nlink>1&&!this.linkCache.get(`${t.dev}:${t.ino}`)&&!this.sync)if(e===this[Te])this[Di](e);else{let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);r?r.push(e):this[Dt].set(i,[e]),e.pendingLink=!0,e.pending=!0}this[je]()}[mr](e){e.pending=!0,this[Q]+=1,Ii.default.readdir(e.absolute,(t,i)=>{if(e.pending=!1,this[Q]-=1,t)return this.emit("error",t);this[Mi](e,i)})}[Mi](e,t){this.readdirCache.set(e.absolute,t),e.readdir=t,this[je]()}[je](){if(!this[Pt]){this[Pt]=!0;for(let e=this[X].head;e&&this[Q]<this.jobs;e=e.next)if(this[Di](e.value),e.value.ignore){let t=e.next;this[X].removeNode(e),e.next=t}this[Pt]=!1,this[Tt]&&this[X].length===0&&this[Q]===0&&(this.zip?this.zip.end(On):(super.write(On),super.end()))}}get[Te](){return this[X]&&this[X].head&&this[X].head.value}[hr](e){this[X].shift(),this[Q]-=1;let{stat:t}=e;if(t&&t.isFile()&&t.nlink>1){let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);if(r){this[Dt].delete(i);for(let n of r)n.pending=!1,this[Di](n)}}this[je]()}[Di](e){if(e.pending&&e.pendingLink&&e===this[Te]&&(e.pending=!1,e.pendingLink=!1),!e.pending){if(e.entry){e===this[Te]&&!e.piped&&this[Li](e);return}if(!e.stat){let t=this.statCache.get(e.absolute);t?this[Pi](e,t):this[dr](e)}if(e.stat&&!e.ignore){if(!this.noDirRecurse&&e.stat.isDirectory()&&!e.readdir){let t=this.readdirCache.get(e.absolute);if(t?this[Mi](e,t):this[mr](e),!e.readdir)return}if(e.entry=this[Tn](e),!e.entry){e.ignore=!0;return}e===this[Te]&&!e.piped&&this[Li](e)}}}[lr](e){return{onwarn:(t,i,r)=>this.warn(t,i,r),noPax:this.noPax,cwd:this.cwd,absolute:e.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[Tn](e){this[Q]+=1;try{return new this[Ai](e.path,this[lr](e)).on("end",()=>this[hr](e)).on("error",i=>this.emit("error",i))}catch(t){this.emit("error",t)}}[cr](){this[Te]&&this[Te].entry&&this[Te].entry.resume()}[Li](e){e.piped=!0,e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)});let t=e.entry,i=this.zip;if(!t)throw new Error("cannot pipe without source");i?t.on("data",r=>{i.write(r)||t.pause()}):t.on("data",r=>{super.write(r)||t.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(e,t,i={}){(0,vh.warnMethod)(this,e,t,i)}};L.Pack=Fi;var pr=class extends Fi{sync=!0;constructor(e){super(e),this[Ai]=fr.WriteEntrySync}pause(){}resume(){}[dr](e){let t=this.follow?"statSync":"lstatSync";this[Pi](e,Ii.default[t](e.absolute))}[mr](e){this[Mi](e,Ii.default.readdirSync(e.absolute))}[Li](e){let t=e.entry,i=this.zip;if(e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)}),!t)throw new Error("Cannot pipe without source");i?t.on("data",r=>{i.write(r)}):t.on("data",r=>{super[Nn](r)})}};L.PackSync=pr});var _r=d(ht=>{"use strict";var Th=ht&&ht.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ht,"__esModule",{value:!0});ht.create=void 0;var Mn=Ke(),Ln=Th(require("node:path")),An=rt(),Dh=Ve(),Bi=Ci(),Ph=(s,e)=>{let t=new Bi.PackSync(s),i=new Mn.WriteStreamSync(s.file,{mode:s.mode||438});t.pipe(i),In(t,e)},Nh=(s,e)=>{let t=new Bi.Pack(s),i=new Mn.WriteStream(s.file,{mode:s.mode||438});t.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),t.on("error",o)});return Fn(t,e).catch(n=>t.emit("error",n)),r},In=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,An.list)({file:Ln.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},Fn=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,An.list)({file:Ln.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(t);s.end()},Mh=(s,e)=>{let t=new Bi.PackSync(s);return In(t,e),t},Lh=(s,e)=>{let t=new Bi.Pack(s);return Fn(t,e).catch(i=>t.emit("error",i)),t};ht.create=(0,Dh.makeCommand)(Ph,Nh,Mh,Lh,(s,e)=>{if(!e?.length)throw new TypeError("no paths specified to add to archive")})});var Wn=d(lt=>{"use strict";var Ah=lt&&lt.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(lt,"__esModule",{value:!0});lt.getWriteFlag=void 0;var zn=Ah(require("fs")),Ih=process.env.__FAKE_PLATFORM__||process.platform,kn=Ih==="win32",{O_CREAT:xn,O_NOFOLLOW:Cn,O_TRUNC:jn,O_WRONLY:Un}=zn.default.constants,qn=Number(process.env.__FAKE_FS_O_FILENAME__)||zn.default.constants.UV_FS_O_FILEMAP||0,Fh=kn&&!!qn,Ch=512*1024,Bh=qn|jn|xn|Un,Bn=!kn&&typeof Cn=="number"?Cn|jn|xn|Un:null;lt.getWriteFlag=Bn!==null?()=>Bn:Fh?s=>s<Ch?Bh:"w":()=>"w"});var Gn=d(le=>{"use strict";var Hn=le&&le.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(le,"__esModule",{value:!0});le.chownrSync=le.chownr=void 0;var ki=Hn(require("node:fs")),Mt=Hn(require("node:path")),wr=(s,e,t)=>{try{return ki.default.lchownSync(s,e,t)}catch(i){if(i?.code!=="ENOENT")throw i}},zi=(s,e,t,i)=>{ki.default.lchown(s,e,t,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},zh=(s,e,t,i,r)=>{if(e.isDirectory())(0,le.chownr)(Mt.default.resolve(s,e.name),t,i,n=>{if(n)return r(n);let o=Mt.default.resolve(s,e.name);zi(o,t,i,r)});else{let n=Mt.default.resolve(s,e.name);zi(n,t,i,r)}},kh=(s,e,t,i)=>{ki.default.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return zi(s,e,t,i);let o=n.length,a=null,h=l=>{if(!a){if(l)return i(a=l);if(--o===0)return zi(s,e,t,i)}};for(let l of n)zh(s,l,e,t,h)})};le.chownr=kh;var xh=(s,e,t,i)=>{e.isDirectory()&&(0,le.chownrSync)(Mt.default.resolve(s,e.name),t,i),wr(Mt.default.resolve(s,e.name),t,i)},jh=(s,e,t)=>{let i;try{i=ki.default.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return wr(s,e,t);throw n}for(let r of i)xh(s,r,e,t);return wr(s,e,t)};le.chownrSync=jh});var Zn=d(xi=>{"use strict";Object.defineProperty(xi,"__esModule",{value:!0});xi.CwdError=void 0;var yr=class extends Error{path;code;syscall="chdir";constructor(e,t){super(`${t}: Cannot cd into '${e}'`),this.path=e,this.code=t}get name(){return"CwdError"}};xi.CwdError=yr});var br=d(ji=>{"use strict";Object.defineProperty(ji,"__esModule",{value:!0});ji.SymlinkError=void 0;var Er=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(e,t){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=e,this.path=t}get name(){return"SymlinkError"}};ji.SymlinkError=Er});var Xn=d(De=>{"use strict";var gr=De&&De.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(De,"__esModule",{value:!0});De.mkdirSync=De.mkdir=void 0;var Yn=Gn(),j=gr(require("node:fs")),Uh=gr(require("node:fs/promises")),Ui=gr(require("node:path")),Kn=Zn(),_e=tt(),Vn=br(),qh=(s,e)=>{j.default.stat(s,(t,i)=>{(t||!i.isDirectory())&&(t=new Kn.CwdError(s,t?.code||"ENOTDIR")),e(t)})},Wh=(s,e,t)=>{s=(0,_e.normalizeWindowsPath)(s);let i=e.umask??18,r=e.mode|448,n=(r&i)!==0,o=e.uid,a=e.gid,h=typeof o=="number"&&typeof a=="number"&&(o!==e.processUid||a!==e.processGid),l=e.preserve,c=e.unlink,u=(0,_e.normalizeWindowsPath)(e.cwd),b=(w,P)=>{w?t(w):P&&h?(0,Yn.chownr)(P,o,a,xt=>b(xt)):n?j.default.chmod(s,r,t):t()};if(s===u)return qh(s,b);if(l)return Uh.default.mkdir(s,{mode:r,recursive:!0}).then(w=>b(null,w??void 0),b);let A=(0,_e.normalizeWindowsPath)(Ui.default.relative(u,s)).split("/");Sr(u,A,r,c,u,void 0,b)};De.mkdir=Wh;var Sr=(s,e,t,i,r,n,o)=>{if(e.length===0)return o(null,n);let a=e.shift(),h=(0,_e.normalizeWindowsPath)(Ui.default.resolve(s+"/"+a));j.default.mkdir(h,t,$n(h,e,t,i,r,n,o))},$n=(s,e,t,i,r,n,o)=>a=>{a?j.default.lstat(s,(h,l)=>{if(h)h.path=h.path&&(0,_e.normalizeWindowsPath)(h.path),o(h);else if(l.isDirectory())Sr(s,e,t,i,r,n,o);else if(i)j.default.unlink(s,c=>{if(c)return o(c);j.default.mkdir(s,t,$n(s,e,t,i,r,n,o))});else{if(l.isSymbolicLink())return o(new Vn.SymlinkError(s,s+"/"+e.join("/")));o(a)}}):(n=n||s,Sr(s,e,t,i,r,n,o))},Hh=s=>{let e=!1,t;try{e=j.default.statSync(s).isDirectory()}catch(i){t=i?.code}finally{if(!e)throw new Kn.CwdError(s,t??"ENOTDIR")}},Gh=(s,e)=>{s=(0,_e.normalizeWindowsPath)(s);let t=e.umask??18,i=e.mode|448,r=(i&t)!==0,n=e.uid,o=e.gid,a=typeof n=="number"&&typeof o=="number"&&(n!==e.processUid||o!==e.processGid),h=e.preserve,l=e.unlink,c=(0,_e.normalizeWindowsPath)(e.cwd),u=w=>{w&&a&&(0,Yn.chownrSync)(w,n,o),r&&j.default.chmodSync(s,i)};if(s===c)return Hh(c),u();if(h)return u(j.default.mkdirSync(s,{mode:i,recursive:!0})??void 0);let D=(0,_e.normalizeWindowsPath)(Ui.default.relative(c,s)).split("/"),A;for(let w=D.shift(),P=c;w&&(P+="/"+w);w=D.shift()){P=(0,_e.normalizeWindowsPath)(Ui.default.resolve(P));try{j.default.mkdirSync(P,i),A=A||P}catch{let xt=j.default.lstatSync(P);if(xt.isDirectory())continue;if(l){j.default.unlinkSync(P),j.default.mkdirSync(P,i),A=A||P;continue}else if(xt.isSymbolicLink())return new Vn.SymlinkError(P,P+"/"+D.join("/"))}}return u(A)};De.mkdirSync=Gh});var Jn=d(qi=>{"use strict";Object.defineProperty(qi,"__esModule",{value:!0});qi.normalizeUnicode=void 0;var Rr=Object.create(null),Qn=1e4,ct=new Set,Zh=s=>{ct.has(s)?ct.delete(s):Rr[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),ct.add(s);let e=Rr[s],t=ct.size-Qn;if(t>Qn/10){for(let i of ct)if(ct.delete(i),delete Rr[i],--t<=0)break}return e};qi.normalizeUnicode=Zh});var to=d(Wi=>{"use strict";Object.defineProperty(Wi,"__esModule",{value:!0});Wi.PathReservations=void 0;var eo=require("node:path"),Yh=Jn(),Kh=yi(),Vh=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,$h=Vh==="win32",Xh=s=>s.split("/").slice(0,-1).reduce((t,i)=>{let r=t.at(-1);return r!==void 0&&(i=(0,eo.join)(r,i)),t.push(i||"/"),t},[]),Or=class{#e=new Map;#i=new Map;#s=new Set;reserve(e,t){e=$h?["win32 parallelization disabled"]:e.map(r=>(0,Kh.stripTrailingSlashes)((0,eo.join)((0,Yh.normalizeUnicode)(r))));let i=new Set(e.map(r=>Xh(r)).reduce((r,n)=>r.concat(n)));this.#i.set(t,{dirs:i,paths:e});for(let r of e){let n=this.#e.get(r);n?n.push(t):this.#e.set(r,[t])}for(let r of i){let n=this.#e.get(r);if(!n)this.#e.set(r,[new Set([t])]);else{let o=n.at(-1);o instanceof Set?o.add(t):n.push(new Set([t]))}}return this.#r(t)}#n(e){let t=this.#i.get(e);if(!t)throw new Error("function does not have any path reservations");return{paths:t.paths.map(i=>this.#e.get(i)),dirs:[...t.dirs].map(i=>this.#e.get(i))}}check(e){let{paths:t,dirs:i}=this.#n(e);return t.every(r=>r&&r[0]===e)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(e))}#r(e){return this.#s.has(e)||!this.check(e)?!1:(this.#s.add(e),e(()=>this.#t(e)),!0)}#t(e){if(!this.#s.has(e))return!1;let t=this.#i.get(e);if(!t)throw new Error("invalid reservation");let{paths:i,dirs:r}=t,n=new Set;for(let o of i){let a=this.#e.get(o);if(!a||a?.[0]!==e)continue;let h=a[1];if(!h){this.#e.delete(o);continue}if(a.shift(),typeof h=="function")n.add(h);else for(let l of h)n.add(l)}for(let o of r){let a=this.#e.get(o),h=a?.[0];if(!(!a||!(h instanceof Set)))if(h.size===1&&a.length===1){this.#e.delete(o);continue}else if(h.size===1){a.shift();let l=a[0];typeof l=="function"&&n.add(l)}else h.delete(e)}return this.#s.delete(e),n.forEach(o=>this.#r(o)),!0}};Wi.PathReservations=Or});var io=d(Hi=>{"use strict";Object.defineProperty(Hi,"__esModule",{value:!0});Hi.umask=void 0;var Qh=()=>process.umask();Hi.umask=Qh});var Cr=d(k=>{"use strict";var Jh=k&&k.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),el=k&&k.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fo=k&&k.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Jh(t,e,i[r]);return el(t,e),t}})(),Fr=k&&k.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(k,"__esModule",{value:!0});k.UnpackSync=k.Unpack=void 0;var tl=fo(Ke()),il=Fr(require("node:assert")),mo=require("node:crypto"),m=Fr(require("node:fs")),g=Fr(require("node:path")),po=Wn(),_o=Xn(),U=tt(),sl=_i(),rl=Zs(),so=fo(Ks()),nl=to(),wo=br(),ol=io(),ro=Symbol("onEntry"),Pr=Symbol("checkFs"),no=Symbol("checkFs2"),Nr=Symbol("isReusable"),G=Symbol("makeFs"),Mr=Symbol("file"),Lr=Symbol("directory"),Zi=Symbol("link"),oo=Symbol("symlink"),ao=Symbol("hardlink"),At=Symbol("ensureNoSymlink"),ho=Symbol("unsupported"),lo=Symbol("checkPath"),vr=Symbol("stripAbsolutePath"),Pe=Symbol("mkdir"),T=Symbol("onError"),Gi=Symbol("pending"),co=Symbol("pend"),ut=Symbol("unpend"),Tr=Symbol("ended"),Dr=Symbol("maybeClose"),Ar=Symbol("skip"),It=Symbol("doChown"),Ft=Symbol("uid"),Ct=Symbol("gid"),Bt=Symbol("checkedCwd"),al=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,zt=al==="win32",hl=1024,ll=(s,e)=>{if(!zt)return m.default.unlink(s,e);let t=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.rename(s,t,i=>{if(i)return e(i);m.default.unlink(t,e)})},cl=s=>{if(!zt)return m.default.unlinkSync(s);let e=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.renameSync(s,e),m.default.unlinkSync(e)},uo=(s,e,t)=>s!==void 0&&s===s>>>0?s:e!==void 0&&e===e>>>0?e:t,Yi=class extends sl.Parser{[Tr]=!1;[Bt]=!1;[Gi]=0;reservations=new nl.PathReservations;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(e={}){if(e.ondone=()=>{this[Tr]=!0,this[Dr]()},super(e),this.transform=e.transform,this.chmod=!!e.chmod,typeof e.uid=="number"||typeof e.gid=="number"){if(typeof e.uid!="number"||typeof e.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(e.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=e.uid,this.gid=e.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=e.preserveOwner===void 0&&typeof e.uid!="number"?process.getuid?.()===0:!!e.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof e.maxDepth=="number"?e.maxDepth:hl,this.forceChown=e.forceChown===!0,this.win32=!!e.win32||zt,this.newer=!!e.newer,this.keep=!!e.keep,this.noMtime=!!e.noMtime,this.preservePaths=!!e.preservePaths,this.unlink=!!e.unlink,this.cwd=(0,U.normalizeWindowsPath)(g.default.resolve(e.cwd||process.cwd())),this.strip=Number(e.strip)||0,this.processUmask=this.chmod?typeof e.processUmask=="number"?e.processUmask:(0,ol.umask)():0,this.umask=typeof e.umask=="number"?e.umask:this.processUmask,this.dmode=e.dmode||511&~this.umask,this.fmode=e.fmode||438&~this.umask,this.on("entry",t=>this[ro](t))}warn(e,t,i={}){return(e==="TAR_BAD_ARCHIVE"||e==="TAR_ABORT")&&(i.recoverable=!1),super.warn(e,t,i)}[Dr](){this[Tr]&&this[Gi]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[vr](e,t){let i=e[t],{type:r}=e;if(!i||this.preservePaths)return!0;let[n,o]=(0,rl.stripAbsolutePath)(i),a=o.replaceAll(/\\/g,"/").split("/");if(a.includes("..")||zt&&/^[a-z]:\.\.$/i.test(a[0]??"")){if(t==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${t} contains '..'`,{entry:e,[t]:i}),!1;let h=g.default.posix.dirname(e.path),l=g.default.posix.normalize(g.default.posix.join(h,a.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${t} escapes extraction directory`,{entry:e,[t]:i}),!1}return n&&(e[t]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${t}`,{entry:e,[t]:i})),!0}[lo](e){let t=(0,U.normalizeWindowsPath)(e.path),i=t.split("/");if(this.strip){if(i.length<this.strip)return!1;if(e.type==="Link"){let r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");if(r.length>=this.strip)e.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),e.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:e,path:t,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[vr](e,"path")||!this[vr](e,"linkpath"))return!1;if(e.absolute=g.default.isAbsolute(e.path)?(0,U.normalizeWindowsPath)(g.default.resolve(e.path)):(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,e.path)),!this.preservePaths&&typeof e.absolute=="string"&&e.absolute.indexOf(this.cwd+"/")!==0&&e.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:e,path:(0,U.normalizeWindowsPath)(e.path),resolvedPath:e.absolute,cwd:this.cwd}),!1;if(e.absolute===this.cwd&&e.type!=="Directory"&&e.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=g.default.win32.parse(String(e.absolute));e.absolute=r+so.encode(String(e.absolute).slice(r.length));let{root:n}=g.default.win32.parse(e.path);e.path=n+so.encode(e.path.slice(n.length))}return!0}[ro](e){if(!this[lo](e))return e.resume();switch(il.default.equal(typeof e.absolute,"string"),e.type){case"Directory":case"GNUDumpDir":e.mode&&(e.mode=e.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[Pr](e);default:return this[ho](e)}}[T](e,t){e.name==="CwdError"?this.emit("error",e):(this.warn("TAR_ENTRY_ERROR",e,{entry:t}),this[ut](),t.resume())}[Pe](e,t,i){(0,_o.mkdir)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t},i)}[It](e){return this.forceChown||this.preserveOwner&&(typeof e.uid=="number"&&e.uid!==this.processUid||typeof e.gid=="number"&&e.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[Ft](e){return uo(this.uid,e.uid,this.processUid)}[Ct](e){return uo(this.gid,e.gid,this.processGid)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=new tl.WriteStream(String(e.absolute),{flags:(0,po.getWriteFlag)(e.size),mode:i,autoClose:!1});r.on("error",h=>{r.fd&&m.default.close(r.fd,()=>{}),r.write=()=>!0,this[T](h,e),t()});let n=1,o=h=>{if(h){r.fd&&m.default.close(r.fd,()=>{}),this[T](h,e),t();return}--n===0&&r.fd!==void 0&&m.default.close(r.fd,l=>{l?this[T](l,e):this[ut](),t()})};r.on("finish",()=>{let h=String(e.absolute),l=r.fd;if(typeof l=="number"&&e.mtime&&!this.noMtime){n++;let c=e.atime||new Date,u=e.mtime;m.default.futimes(l,c,u,b=>b?m.default.utimes(h,c,u,D=>o(D&&b)):o())}if(typeof l=="number"&&this[It](e)){n++;let c=this[Ft](e),u=this[Ct](e);typeof c=="number"&&typeof u=="number"&&m.default.fchown(l,c,u,b=>b?m.default.chown(h,c,u,D=>o(D&&b)):o())}o()});let a=this.transform&&this.transform(e)||e;a!==e&&(a.on("error",h=>{this[T](h,e),t()}),e.pipe(a)),a.pipe(r)}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode;this[Pe](String(e.absolute),i,r=>{if(r){this[T](r,e),t();return}let n=1,o=()=>{--n===0&&(t(),this[ut](),e.resume())};e.mtime&&!this.noMtime&&(n++,m.default.utimes(String(e.absolute),e.atime||new Date,e.mtime,o)),this[It](e)&&(n++,m.default.chown(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)),o)),o()})}[ho](e){e.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${e.type}`,{entry:e}),e.resume()}[oo](e,t){let i=(0,U.normalizeWindowsPath)(g.default.relative(this.cwd,g.default.resolve(g.default.dirname(String(e.absolute)),String(e.linkpath)))).split("/");this[At](e,this.cwd,i,()=>this[Zi](e,String(e.linkpath),"symlink",t),r=>{this[T](r,e),t()})}[ao](e,t){let i=(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,String(e.linkpath))),r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");this[At](e,this.cwd,r,()=>this[Zi](e,i,"link",t),n=>{this[T](n,e),t()})}[At](e,t,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let a=g.default.resolve(t,o);m.default.lstat(a,(h,l)=>{if(h)return r();if(l?.isSymbolicLink())return n(new wo.SymlinkError(a,g.default.resolve(a,i.join("/"))));this[At](e,a,i,r,n)})}[co](){this[Gi]++}[ut](){this[Gi]--,this[Dr]()}[Ar](e){this[ut](),e.resume()}[Nr](e,t){return e.type==="File"&&!this.unlink&&t.isFile()&&t.nlink<=1&&!zt}[Pr](e){this[co]();let t=[e.path];e.linkpath&&t.push(e.linkpath),this.reservations.reserve(t,i=>this[no](e,i))}[no](e,t){let i=a=>{t(a)},r=()=>{this[Pe](this.cwd,this.dmode,a=>{if(a){this[T](a,e),i();return}this[Bt]=!0,n()})},n=()=>{if(e.absolute!==this.cwd){let a=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(a!==this.cwd)return this[Pe](a,this.dmode,h=>{if(h){this[T](h,e),i();return}o()})}o()},o=()=>{m.default.lstat(String(e.absolute),(a,h)=>{if(h&&(this.keep||this.newer&&h.mtime>(e.mtime??h.mtime))){this[Ar](e),i();return}if(a||this[Nr](e,h))return this[G](null,e,i);if(h.isDirectory()){if(e.type==="Directory"){let l=this.chmod&&e.mode&&(h.mode&4095)!==e.mode,c=u=>this[G](u??null,e,i);return l?m.default.chmod(String(e.absolute),Number(e.mode),c):c()}if(e.absolute!==this.cwd)return m.default.rmdir(String(e.absolute),l=>this[G](l??null,e,i))}if(e.absolute===this.cwd)return this[G](null,e,i);ll(String(e.absolute),l=>this[G](l??null,e,i))})};this[Bt]?n():r()}[G](e,t,i){if(e){this[T](e,t),i();return}switch(t.type){case"File":case"OldFile":case"ContiguousFile":return this[Mr](t,i);case"Link":return this[ao](t,i);case"SymbolicLink":return this[oo](t,i);case"Directory":case"GNUDumpDir":return this[Lr](t,i)}}[Zi](e,t,i,r){m.default[i](t,String(e.absolute),n=>{n?this[T](n,e):(this[ut](),e.resume()),r()})}};k.Unpack=Yi;var Lt=s=>{try{return[null,s()]}catch(e){return[e,null]}},Ir=class extends Yi{sync=!0;[G](e,t){return super[G](e,t,()=>{})}[Pr](e){if(!this[Bt]){let n=this[Pe](this.cwd,this.dmode);if(n)return this[T](n,e);this[Bt]=!0}if(e.absolute!==this.cwd){let n=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(n!==this.cwd){let o=this[Pe](n,this.dmode);if(o)return this[T](o,e)}}let[t,i]=Lt(()=>m.default.lstatSync(String(e.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(e.mtime??i.mtime)))return this[Ar](e);if(t||this[Nr](e,i))return this[G](null,e);if(i.isDirectory()){if(e.type==="Directory"){let o=this.chmod&&e.mode&&(i.mode&4095)!==e.mode,[a]=o?Lt(()=>{m.default.chmodSync(String(e.absolute),Number(e.mode))}):[];return this[G](a,e)}let[n]=Lt(()=>m.default.rmdirSync(String(e.absolute)));this[G](n,e)}let[r]=e.absolute===this.cwd?[]:Lt(()=>cl(String(e.absolute)));this[G](r,e)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=a=>{let h;try{m.default.closeSync(n)}catch(l){h=l}(a||h)&&this[T](a||h,e),t()},n;try{n=m.default.openSync(String(e.absolute),(0,po.getWriteFlag)(e.size),i)}catch(a){return r(a)}let o=this.transform&&this.transform(e)||e;o!==e&&(o.on("error",a=>this[T](a,e)),e.pipe(o)),o.on("data",a=>{try{m.default.writeSync(n,a,0,a.length)}catch(h){r(h)}}),o.on("end",()=>{let a=null;if(e.mtime&&!this.noMtime){let h=e.atime||new Date,l=e.mtime;try{m.default.futimesSync(n,h,l)}catch(c){try{m.default.utimesSync(String(e.absolute),h,l)}catch{a=c}}}if(this[It](e)){let h=this[Ft](e),l=this[Ct](e);try{m.default.fchownSync(n,Number(h),Number(l))}catch(c){try{m.default.chownSync(String(e.absolute),Number(h),Number(l))}catch{a=a||c}}}r(a)})}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode,r=this[Pe](String(e.absolute),i);if(r){this[T](r,e),t();return}if(e.mtime&&!this.noMtime)try{m.default.utimesSync(String(e.absolute),e.atime||new Date,e.mtime)}catch{}if(this[It](e))try{m.default.chownSync(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)))}catch{}t(),e.resume()}[Pe](e,t){try{return(0,_o.mkdirSync)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t})}catch(i){return i}}[At](e,t,i,r,n){if(this.preservePaths||i.length===0)return r();let o=t;for(let a of i){o=g.default.resolve(o,a);let[h,l]=Lt(()=>m.default.lstatSync(o));if(h)return r();if(l.isSymbolicLink())return n(new wo.SymlinkError(o,g.default.resolve(t,i.join("/"))))}r()}[Zi](e,t,i,r){let n=`${i}Sync`;try{m.default[n](t,String(e.absolute)),r(),e.resume()}catch(o){return this[T](o,e)}}};k.UnpackSync=Ir});var Br=d(Z=>{"use strict";var ul=Z&&Z.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),fl=Z&&Z.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),dl=Z&&Z.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ul(t,e,i[r]);return fl(t,e),t}})(),ml=Z&&Z.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(Z,"__esModule",{value:!0});Z.extract=void 0;var yo=dl(Ke()),Eo=ml(require("node:fs")),pl=rt(),_l=Ve(),Ki=Cr(),wl=s=>{let e=new Ki.UnpackSync(s),t=s.file,i=Eo.default.statSync(t),r=s.maxReadSize||16*1024*1024;new yo.ReadStreamSync(t,{readSize:r,size:i.size}).pipe(e)},yl=(s,e)=>{let t=new Ki.Unpack(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("close",o),Eo.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new yo.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};Z.extract=(0,_l.makeCommand)(wl,yl,s=>new Ki.UnpackSync(s),s=>new Ki.Unpack(s),(s,e)=>{e?.length&&(0,pl.filesFilter)(s,e)})});var Vi=d(ft=>{"use strict";var bo=ft&&ft.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ft,"__esModule",{value:!0});ft.replace=void 0;var So=Ke(),q=bo(require("node:fs")),go=bo(require("node:path")),Ro=et(),Oo=rt(),El=Ve(),bl=Qt(),vo=Ci(),Sl=(s,e)=>{let t=new vo.PackSync(s),i=!0,r,n;try{try{r=q.default.openSync(s.file,"r+")}catch(h){if(h?.code==="ENOENT")r=q.default.openSync(s.file,"w+");else throw h}let o=q.default.fstatSync(r),a=Buffer.alloc(512);e:for(n=0;n<o.size;n+=512){for(let c=0,u=0;c<512;c+=u){if(u=q.default.readSync(r,a,c,a.length-c,n+c),n===0&&a[0]===31&&a[1]===139)throw new Error("cannot append to compressed archives");if(!u)break e}let h=new Ro.Header(a);if(!h.cksumValid)break;let l=512*Math.ceil((h.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&h.mtime&&s.mtimeCache.set(String(h.path),h.mtime)}i=!1,gl(s,t,n,r,e)}finally{if(i)try{q.default.closeSync(r)}catch{}}},gl=(s,e,t,i,r)=>{let n=new So.WriteStreamSync(s.file,{fd:i,start:t});e.pipe(n),Ol(e,r)},Rl=(s,e)=>{e=Array.from(e);let t=new vo.Pack(s),i=(n,o,a)=>{let h=(D,A)=>{D?q.default.close(n,w=>a(D)):a(null,A)},l=0;if(o===0)return h(null,0);let c=0,u=Buffer.alloc(512),b=(D,A)=>{if(D||A===void 0)return h(D);if(c+=A,c<512&&A)return q.default.read(n,u,c,u.length-c,l+c,b);if(l===0&&u[0]===31&&u[1]===139)return h(new Error("cannot append to compressed archives"));if(c<512)return h(null,l);let w=new Ro.Header(u);if(!w.cksumValid)return h(null,l);let P=512*Math.ceil((w.size??0)/512);if(l+P+512>o||(l+=P+512,l>=o))return h(null,l);s.mtimeCache&&w.mtime&&s.mtimeCache.set(String(w.path),w.mtime),c=0,q.default.read(n,u,0,512,l,b)};q.default.read(n,u,0,512,l,b)};return new Promise((n,o)=>{t.on("error",o);let a="r+",h=(l,c)=>{if(l&&l.code==="ENOENT"&&a==="r+")return a="w+",q.default.open(s.file,a,h);if(l||!c)return o(l);q.default.fstat(c,(u,b)=>{if(u)return q.default.close(c,()=>o(u));i(c,b.size,(D,A)=>{if(D)return o(D);let w=new So.WriteStream(s.file,{fd:c,start:A});t.pipe(w),w.on("error",o),w.on("close",n),vl(t,e)})})};q.default.open(s.file,a,h)})},Ol=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,Oo.list)({file:go.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},vl=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,Oo.list)({file:go.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t);s.end()};ft.replace=(0,El.makeCommand)(Sl,Rl,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,e)=>{if(!(0,bl.isFile)(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!e?.length)throw new TypeError("no paths specified to add/replace")})});var zr=d($i=>{"use strict";Object.defineProperty($i,"__esModule",{value:!0});$i.update=void 0;var Tl=Ve(),kt=Vi();$i.update=(0,Tl.makeCommand)(kt.replace.syncFile,kt.replace.asyncFile,kt.replace.syncNoFile,kt.replace.asyncNoFile,(s,e=[])=>{kt.replace.validate?.(s,e),Dl(s)});var Dl=s=>{let e=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=e?(t,i)=>e(t,i)&&!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0)):(t,i)=>!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0))}});var To=exports&&exports.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Pl=exports&&exports.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Y=exports&&exports.__exportStar||function(s,e){for(var t in s)t!=="default"&&!Object.prototype.hasOwnProperty.call(e,t)&&To(e,s,t)},Nl=exports&&exports.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&To(t,e,i[r]);return Pl(t,e),t}})();Object.defineProperty(exports,"__esModule",{value:!0});exports.u=exports.types=exports.r=exports.t=exports.x=exports.c=void 0;Y(_r(),exports);var Ml=_r();Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Ml.create}});Y(Br(),exports);var Ll=Br();Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return Ll.extract}});Y(et(),exports);Y(rt(),exports);var Al=rt();Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Al.list}});Y(Ci(),exports);Y(_i(),exports);Y(si(),exports);Y(Cs(),exports);Y(Vi(),exports);var Il=Vi();Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Il.replace}});exports.types=Nl(Ns());Y(Cr(),exports);Y(zr(),exports);var Fl=zr();Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return Fl.update}});Y(nr(),exports);
 //# sourceMappingURL=index.min.js.map
diff --git a/deps/npm/node_modules/tar/dist/commonjs/list.js b/deps/npm/node_modules/tar/dist/commonjs/list.js
index 700030a0ac10..5dfdb985cd78 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/list.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/list.js
@@ -59,14 +59,22 @@ const onReadEntryFunction = (opt) => {
 const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [(0, strip_trailing_slashes_js_1.stripTrailingSlashes)(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || (0, path_1.parse)(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root);
+            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;
diff --git a/deps/npm/node_modules/tar/dist/commonjs/parse.js b/deps/npm/node_modules/tar/dist/commonjs/parse.js
index 2968e861ee68..6ab1e333458c 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/parse.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/parse.js
@@ -376,6 +376,16 @@ class Parser extends events_1.EventEmitter {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode
diff --git a/deps/npm/node_modules/tar/dist/esm/index.min.js b/deps/npm/node_modules/tar/dist/esm/index.min.js
index bf4036b4115e..9d9044ce85e3 100644
--- a/deps/npm/node_modules/tar/dist/esm/index.min.js
+++ b/deps/npm/node_modules/tar/dist/esm/index.min.js
@@ -1,4 +1,4 @@
-var zr=Object.defineProperty;var Ur=(s,t)=>{for(var e in t)zr(s,e,{get:t[e],enumerable:!0})};import Qr from"events";import I from"fs";import{EventEmitter as Di}from"node:events";import Cs from"node:stream";import{StringDecoder as Hr}from"node:string_decoder";var Ds=typeof process=="object"&&process?process:{stdout:null,stderr:null},Wr=s=>!!s&&typeof s=="object"&&(s instanceof A||s instanceof Cs||Gr(s)||Zr(s)),Gr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.pipe=="function"&&s.pipe!==Cs.Writable.prototype.pipe,Zr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.write=="function"&&typeof s.end=="function",Q=Symbol("EOF"),J=Symbol("maybeEmitEnd"),nt=Symbol("emittedEnd"),De=Symbol("emittingEnd"),qt=Symbol("emittedError"),Ne=Symbol("closed"),Ns=Symbol("read"),Ae=Symbol("flush"),As=Symbol("flushChunk"),z=Symbol("encoding"),Mt=Symbol("decoder"),g=Symbol("flowing"),Qt=Symbol("paused"),Bt=Symbol("resume"),b=Symbol("buffer"),N=Symbol("pipes"),_=Symbol("bufferLength"),bi=Symbol("bufferPush"),Ie=Symbol("bufferShift"),L=Symbol("objectMode"),w=Symbol("destroyed"),_i=Symbol("error"),Oi=Symbol("emitData"),Is=Symbol("emitEnd"),Ti=Symbol("emitEnd2"),Z=Symbol("async"),xi=Symbol("abort"),Ce=Symbol("aborted"),Jt=Symbol("signal"),Rt=Symbol("dataListeners"),C=Symbol("discarded"),jt=s=>Promise.resolve().then(s),Yr=s=>s(),Kr=s=>s==="end"||s==="finish"||s==="prefinish",Vr=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,$r=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Fe=class{src;dest;opts;ondrain;constructor(t,e,i){this.src=t,this.dest=e,this.opts=i,this.ondrain=()=>t[Bt](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(t){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},Li=class extends Fe{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(t,e,i){super(t,e,i),this.proxyErrors=r=>this.dest.emit("error",r),t.on("error",this.proxyErrors)}},Xr=s=>!!s.objectMode,qr=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",A=class extends Di{[g]=!1;[Qt]=!1;[N]=[];[b]=[];[L];[z];[Z];[Mt];[Q]=!1;[nt]=!1;[De]=!1;[Ne]=!1;[qt]=null;[_]=0;[w]=!1;[Jt];[Ce]=!1;[Rt]=0;[C]=!1;writable=!0;readable=!0;constructor(...t){let e=t[0]||{};if(super(),e.objectMode&&typeof e.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Xr(e)?(this[L]=!0,this[z]=null):qr(e)?(this[z]=e.encoding,this[L]=!1):(this[L]=!1,this[z]=null),this[Z]=!!e.async,this[Mt]=this[z]?new Hr(this[z]):null,e&&e.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[b]}),e&&e.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[N]});let{signal:i}=e;i&&(this[Jt]=i,i.aborted?this[xi]():i.addEventListener("abort",()=>this[xi]()))}get bufferLength(){return this[_]}get encoding(){return this[z]}set encoding(t){throw new Error("Encoding must be set at instantiation time")}setEncoding(t){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[L]}set objectMode(t){throw new Error("objectMode must be set at instantiation time")}get async(){return this[Z]}set async(t){this[Z]=this[Z]||!!t}[xi](){this[Ce]=!0,this.emit("abort",this[Jt]?.reason),this.destroy(this[Jt]?.reason)}get aborted(){return this[Ce]}set aborted(t){}write(t,e,i){if(this[Ce])return!1;if(this[Q])throw new Error("write after end");if(this[w])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof e=="function"&&(i=e,e="utf8"),e||(e="utf8");let r=this[Z]?jt:Yr;if(!this[L]&&!Buffer.isBuffer(t)){if($r(t))t=Buffer.from(t.buffer,t.byteOffset,t.byteLength);else if(Vr(t))t=Buffer.from(t);else if(typeof t!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[L]?(this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):t.length?(typeof t=="string"&&!(e===this[z]&&!this[Mt]?.lastNeed)&&(t=Buffer.from(t,e)),Buffer.isBuffer(t)&&this[z]&&(t=this[Mt].write(t)),this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):(this[_]!==0&&this.emit("readable"),i&&r(i),this[g])}read(t){if(this[w])return null;if(this[C]=!1,this[_]===0||t===0||t&&t>this[_])return this[J](),null;this[L]&&(t=null),this[b].length>1&&!this[L]&&(this[b]=[this[z]?this[b].join(""):Buffer.concat(this[b],this[_])]);let e=this[Ns](t||null,this[b][0]);return this[J](),e}[Ns](t,e){if(this[L])this[Ie]();else{let i=e;t===i.length||t===null?this[Ie]():typeof i=="string"?(this[b][0]=i.slice(t),e=i.slice(0,t),this[_]-=t):(this[b][0]=i.subarray(t),e=i.subarray(0,t),this[_]-=t)}return this.emit("data",e),!this[b].length&&!this[Q]&&this.emit("drain"),e}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e="utf8"),t!==void 0&&this.write(t,e),i&&this.once("end",i),this[Q]=!0,this.writable=!1,(this[g]||!this[Qt])&&this[J](),this}[Bt](){this[w]||(!this[Rt]&&!this[N].length&&(this[C]=!0),this[Qt]=!1,this[g]=!0,this.emit("resume"),this[b].length?this[Ae]():this[Q]?this[J]():this.emit("drain"))}resume(){return this[Bt]()}pause(){this[g]=!1,this[Qt]=!0,this[C]=!1}get destroyed(){return this[w]}get flowing(){return this[g]}get paused(){return this[Qt]}[bi](t){this[L]?this[_]+=1:this[_]+=t.length,this[b].push(t)}[Ie](){return this[L]?this[_]-=1:this[_]-=this[b][0].length,this[b].shift()}[Ae](t=!1){do;while(this[As](this[Ie]())&&this[b].length);!t&&!this[b].length&&!this[Q]&&this.emit("drain")}[As](t){return this.emit("data",t),this[g]}pipe(t,e){if(this[w])return t;this[C]=!1;let i=this[nt];return e=e||{},t===Ds.stdout||t===Ds.stderr?e.end=!1:e.end=e.end!==!1,e.proxyErrors=!!e.proxyErrors,i?e.end&&t.end():(this[N].push(e.proxyErrors?new Li(this,t,e):new Fe(this,t,e)),this[Z]?jt(()=>this[Bt]()):this[Bt]()),t}unpipe(t){let e=this[N].find(i=>i.dest===t);e&&(this[N].length===1?(this[g]&&this[Rt]===0&&(this[g]=!1),this[N]=[]):this[N].splice(this[N].indexOf(e),1),e.unpipe())}addListener(t,e){return this.on(t,e)}on(t,e){let i=super.on(t,e);if(t==="data")this[C]=!1,this[Rt]++,!this[N].length&&!this[g]&&this[Bt]();else if(t==="readable"&&this[_]!==0)super.emit("readable");else if(Kr(t)&&this[nt])super.emit(t),this.removeAllListeners(t);else if(t==="error"&&this[qt]){let r=e;this[Z]?jt(()=>r.call(this,this[qt])):r.call(this,this[qt])}return i}removeListener(t,e){return this.off(t,e)}off(t,e){let i=super.off(t,e);return t==="data"&&(this[Rt]=this.listeners("data").length,this[Rt]===0&&!this[C]&&!this[N].length&&(this[g]=!1)),i}removeAllListeners(t){let e=super.removeAllListeners(t);return(t==="data"||t===void 0)&&(this[Rt]=0,!this[C]&&!this[N].length&&(this[g]=!1)),e}get emittedEnd(){return this[nt]}[J](){!this[De]&&!this[nt]&&!this[w]&&this[b].length===0&&this[Q]&&(this[De]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ne]&&this.emit("close"),this[De]=!1)}emit(t,...e){let i=e[0];if(t!=="error"&&t!=="close"&&t!==w&&this[w])return!1;if(t==="data")return!this[L]&&!i?!1:this[Z]?(jt(()=>this[Oi](i)),!0):this[Oi](i);if(t==="end")return this[Is]();if(t==="close"){if(this[Ne]=!0,!this[nt]&&!this[w])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(t==="error"){this[qt]=i,super.emit(_i,i);let n=!this[Jt]||this.listeners("error").length?super.emit("error",i):!1;return this[J](),n}else if(t==="resume"){let n=super.emit("resume");return this[J](),n}else if(t==="finish"||t==="prefinish"){let n=super.emit(t);return this.removeAllListeners(t),n}let r=super.emit(t,...e);return this[J](),r}[Oi](t){for(let i of this[N])i.dest.write(t)===!1&&this.pause();let e=this[C]?!1:super.emit("data",t);return this[J](),e}[Is](){return this[nt]?!1:(this[nt]=!0,this.readable=!1,this[Z]?(jt(()=>this[Ti]()),!0):this[Ti]())}[Ti](){if(this[Mt]){let e=this[Mt].end();if(e){for(let i of this[N])i.dest.write(e);this[C]||super.emit("data",e)}}for(let e of this[N])e.end();let t=super.emit("end");return this.removeAllListeners("end"),t}async collect(){let t=Object.assign([],{dataLength:0});this[L]||(t.dataLength=0);let e=this.promise();return this.on("data",i=>{t.push(i),this[L]||(t.dataLength+=i.length)}),await e,t}async concat(){if(this[L])throw new Error("cannot concat in objectMode");let t=await this.collect();return this[z]?t.join(""):Buffer.concat(t,t.dataLength)}async promise(){return new Promise((t,e)=>{this.on(w,()=>e(new Error("stream destroyed"))),this.on("error",i=>e(i)),this.on("end",()=>t())})}[Symbol.asyncIterator](){this[C]=!1;let t=!1,e=async()=>(this.pause(),t=!0,{value:void 0,done:!0});return{next:()=>{if(t)return e();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[Q])return e();let n,o,h=d=>{this.off("data",a),this.off("end",l),this.off(w,c),e(),o(d)},a=d=>{this.off("error",h),this.off("end",l),this.off(w,c),this.pause(),n({value:d,done:!!this[Q]})},l=()=>{this.off("error",h),this.off("data",a),this.off(w,c),e(),n({done:!0,value:void 0})},c=()=>h(new Error("stream destroyed"));return new Promise((d,S)=>{o=S,n=d,this.once(w,c),this.once("error",h),this.once("end",l),this.once("data",a)})},throw:e,return:e,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[C]=!1;let t=!1,e=()=>(this.pause(),this.off(_i,e),this.off(w,e),this.off("end",e),t=!0,{done:!0,value:void 0}),i=()=>{if(t)return e();let r=this.read();return r===null?e():{done:!1,value:r}};return this.once("end",e),this.once(_i,e),this.once(w,e),{next:i,throw:e,return:e,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(t){if(this[w])return t?this.emit("error",t):this.emit(w),this;this[w]=!0,this[C]=!0,this[b].length=0,this[_]=0;let e=this;return typeof e.close=="function"&&!this[Ne]&&e.close(),t?this.emit("error",t):this.emit(w),this}static get isStream(){return Wr}};var Jr=I.writev,ht=Symbol("_autoClose"),H=Symbol("_close"),te=Symbol("_ended"),u=Symbol("_fd"),Ni=Symbol("_finished"),tt=Symbol("_flags"),Ai=Symbol("_flush"),ki=Symbol("_handleChunk"),vi=Symbol("_makeBuf"),ie=Symbol("_mode"),ke=Symbol("_needDrain"),Ut=Symbol("_onerror"),Ht=Symbol("_onopen"),Ii=Symbol("_onread"),Pt=Symbol("_onwrite"),at=Symbol("_open"),U=Symbol("_path"),ot=Symbol("_pos"),Y=Symbol("_queue"),zt=Symbol("_read"),Ci=Symbol("_readSize"),j=Symbol("_reading"),ee=Symbol("_remain"),Fi=Symbol("_size"),ve=Symbol("_write"),gt=Symbol("_writing"),Me=Symbol("_defaultFlag"),bt=Symbol("_errored"),_t=class extends A{[bt]=!1;[u];[U];[Ci];[j]=!1;[Fi];[ee];[ht];constructor(t,e){if(e=e||{},super(e),this.readable=!0,this.writable=!1,typeof t!="string")throw new TypeError("path must be a string");this[bt]=!1,this[u]=typeof e.fd=="number"?e.fd:void 0,this[U]=t,this[Ci]=e.readSize||16*1024*1024,this[j]=!1,this[Fi]=typeof e.size=="number"?e.size:1/0,this[ee]=this[Fi],this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0,typeof this[u]=="number"?this[zt]():this[at]()}get fd(){return this[u]}get path(){return this[U]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[at](){I.open(this[U],"r",(t,e)=>this[Ht](t,e))}[Ht](t,e){t?this[Ut](t):(this[u]=e,this.emit("open",e),this[zt]())}[vi](){return Buffer.allocUnsafe(Math.min(this[Ci],this[ee]))}[zt](){if(!this[j]){this[j]=!0;let t=this[vi]();if(t.length===0)return process.nextTick(()=>this[Ii](null,0,t));I.read(this[u],t,0,t.length,null,(e,i,r)=>this[Ii](e,i,r))}}[Ii](t,e,i){this[j]=!1,t?this[Ut](t):this[ki](e,i)&&this[zt]()}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}[Ut](t){this[j]=!0,this[H](),this.emit("error",t)}[ki](t,e){let i=!1;return this[ee]-=t,t>0&&(i=super.write(t<e.length?e.subarray(0,t):e)),(t===0||this[ee]<=0)&&(i=!1,this[H](),super.end()),i}emit(t,...e){switch(t){case"prefinish":case"finish":return!1;case"drain":return typeof this[u]=="number"&&this[zt](),!1;case"error":return this[bt]?!1:(this[bt]=!0,super.emit(t,...e));default:return super.emit(t,...e)}}},Be=class extends _t{[at](){let t=!0;try{this[Ht](null,I.openSync(this[U],"r")),t=!1}finally{t&&this[H]()}}[zt](){let t=!0;try{if(!this[j]){this[j]=!0;do{let e=this[vi](),i=e.length===0?0:I.readSync(this[u],e,0,e.length,null);if(!this[ki](i,e))break}while(!0);this[j]=!1}t=!1}finally{t&&this[H]()}}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.closeSync(t),this.emit("close")}}},et=class extends Qr{readable=!1;writable=!0;[bt]=!1;[gt]=!1;[te]=!1;[Y]=[];[ke]=!1;[U];[ie];[ht];[u];[Me];[tt];[Ni]=!1;[ot];constructor(t,e){e=e||{},super(e),this[U]=t,this[u]=typeof e.fd=="number"?e.fd:void 0,this[ie]=e.mode===void 0?438:e.mode,this[ot]=typeof e.start=="number"?e.start:void 0,this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0;let i=this[ot]!==void 0?"r+":"w";this[Me]=e.flags===void 0,this[tt]=e.flags===void 0?i:e.flags,this[u]===void 0&&this[at]()}emit(t,...e){if(t==="error"){if(this[bt])return!1;this[bt]=!0}return super.emit(t,...e)}get fd(){return this[u]}get path(){return this[U]}[Ut](t){this[H](),this[gt]=!0,this.emit("error",t)}[at](){I.open(this[U],this[tt],this[ie],(t,e)=>this[Ht](t,e))}[Ht](t,e){this[Me]&&this[tt]==="r+"&&t&&t.code==="ENOENT"?(this[tt]="w",this[at]()):t?this[Ut](t):(this[u]=e,this.emit("open",e),this[gt]||this[Ai]())}end(t,e){return t&&this.write(t,e),this[te]=!0,!this[gt]&&!this[Y].length&&typeof this[u]=="number"&&this[Pt](null,0),this}write(t,e){return typeof t=="string"&&(t=Buffer.from(t,e)),this[te]?(this.emit("error",new Error("write() after end()")),!1):this[u]===void 0||this[gt]||this[Y].length?(this[Y].push(t),this[ke]=!0,!1):(this[gt]=!0,this[ve](t),!0)}[ve](t){I.write(this[u],t,0,t.length,this[ot],(e,i)=>this[Pt](e,i))}[Pt](t,e){t?this[Ut](t):(this[ot]!==void 0&&typeof e=="number"&&(this[ot]+=e),this[Y].length?this[Ai]():(this[gt]=!1,this[te]&&!this[Ni]?(this[Ni]=!0,this[H](),this.emit("finish")):this[ke]&&(this[ke]=!1,this.emit("drain"))))}[Ai](){if(this[Y].length===0)this[te]&&this[Pt](null,0);else if(this[Y].length===1)this[ve](this[Y].pop());else{let t=this[Y];this[Y]=[],Jr(this[u],t,this[ot],(e,i)=>this[Pt](e,i))}}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}},Wt=class extends et{[at](){let t;if(this[Me]&&this[tt]==="r+")try{t=I.openSync(this[U],this[tt],this[ie])}catch(e){if(e?.code==="ENOENT")return this[tt]="w",this[at]();throw e}else t=I.openSync(this[U],this[tt],this[ie]);this[Ht](null,t)}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.closeSync(t),this.emit("close")}}[ve](t){let e=!0;try{this[Pt](null,I.writeSync(this[u],t,0,t.length,this[ot])),e=!1}finally{if(e)try{this[H]()}catch{}}}};import cr from"node:path";import Kt from"node:fs";import{dirname as Fn,parse as kn}from"path";var jr=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),Fs=s=>!!s.sync&&!!s.file,ks=s=>!s.sync&&!!s.file,vs=s=>!!s.sync&&!s.file,Ms=s=>!s.sync&&!s.file;var Bs=s=>!!s.file;var tn=s=>{let t=jr.get(s);return t||s},se=(s={})=>{if(!s)return{};let t={};for(let[e,i]of Object.entries(s)){let r=tn(e);t[r]=i}return t.chmod===void 0&&t.noChmod===!1&&(t.chmod=!0),delete t.noChmod,t};var K=(s,t,e,i,r)=>Object.assign((n=[],o,h)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(h=o,o=void 0),o=o?Array.from(o):[];let a=se(n);if(r?.(a,o),Fs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return s(a,o)}else if(ks(a)){let l=t(a,o);return h?l.then(()=>h(),h):l}else if(vs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return e(a,o)}else if(Ms(a)){if(typeof h=="function")throw new TypeError("callback only supported with file option");return i(a,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:t,syncNoFile:e,asyncNoFile:i,validate:r});import{EventEmitter as Dn}from"events";import zi from"assert";import{Buffer as Ot}from"buffer";import*as Ps from"zlib";import en from"zlib";var sn=en.constants||{ZLIB_VERNUM:4736},M=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},sn));var rn=Ot.concat,zs=Object.getOwnPropertyDescriptor(Ot,"concat"),nn=s=>s,Bi=zs?.writable===!0||zs?.set!==void 0?s=>{Ot.concat=s?nn:rn}:s=>{},Tt=Symbol("_superWrite"),Gt=class extends Error{code;errno;constructor(t,e){super("zlib: "+t.message,{cause:t}),this.code=t.code,this.errno=t.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+t.message,Error.captureStackTrace(this,e??this.constructor)}get name(){return"ZlibError"}},Pi=Symbol("flushFlag"),re=class extends A{#t=!1;#i=!1;#s;#n;#r;#e;#o;get sawError(){return this.#t}get handle(){return this.#e}get flushFlag(){return this.#s}constructor(t,e){if(!t||typeof t!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(t),this.#s=t.flush??0,this.#n=t.finishFlush??0,this.#r=t.fullFlushFlag??0,typeof Ps[e]!="function")throw new TypeError("Compression method not supported: "+e);try{this.#e=new Ps[e](t)}catch(i){throw new Gt(i,this.constructor)}this.#o=i=>{this.#t||(this.#t=!0,this.close(),this.emit("error",i))},this.#e?.on("error",i=>this.#o(new Gt(i))),this.once("end",()=>this.close)}close(){this.#e&&(this.#e.close(),this.#e=void 0,this.emit("close"))}reset(){if(!this.#t)return zi(this.#e,"zlib binding closed"),this.#e.reset?.()}flush(t){this.ended||(typeof t!="number"&&(t=this.#r),this.write(Object.assign(Ot.alloc(0),{[Pi]:t})))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&(e?this.write(t,e):this.write(t)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Tt](t){return super.write(t)}write(t,e,i){if(typeof e=="function"&&(i=e,e="utf8"),typeof t=="string"&&(t=Ot.from(t,e)),this.#t)return;zi(this.#e,"zlib binding closed");let r=this.#e._handle,n=r.close;r.close=()=>{};let o=this.#e.close;this.#e.close=()=>{},Bi(!0);let h;try{let l=typeof t[Pi]=="number"?t[Pi]:this.#s;h=this.#e._processChunk(t,l),Bi(!1)}catch(l){Bi(!1),this.#o(new Gt(l,this.write))}finally{this.#e&&(this.#e._handle=r,r.close=n,this.#e.close=o,this.#e.removeAllListeners("error"))}this.#e&&this.#e.on("error",l=>this.#o(new Gt(l,this.write)));let a;if(h)if(Array.isArray(h)&&h.length>0){let l=h[0];a=this[Tt](Ot.from(l));for(let c=1;c<h.length;c++)a=this[Tt](h[c])}else a=this[Tt](Ot.from(h));return i&&i(),a}},Pe=class extends re{#t;#i;constructor(t,e){t=t||{},t.flush=t.flush||M.Z_NO_FLUSH,t.finishFlush=t.finishFlush||M.Z_FINISH,t.fullFlushFlag=M.Z_FULL_FLUSH,super(t,e),this.#t=t.level,this.#i=t.strategy}params(t,e){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#t!==t||this.#i!==e){this.flush(M.Z_SYNC_FLUSH),zi(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(t,e)}finally{this.handle.flush=i}this.handle&&(this.#t=t,this.#i=e)}}}};var ze=class extends Pe{#t;constructor(t){super(t,"Gzip"),this.#t=t&&!!t.portable}[Tt](t){return this.#t?(this.#t=!1,t[9]=255,super[Tt](t)):super[Tt](t)}};var Ue=class extends Pe{constructor(t){super(t,"Unzip")}},He=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.BROTLI_OPERATION_PROCESS,t.finishFlush=t.finishFlush||M.BROTLI_OPERATION_FINISH,t.fullFlushFlag=M.BROTLI_OPERATION_FLUSH,super(t,e)}},We=class extends He{constructor(t){super(t,"BrotliCompress")}},Ge=class extends He{constructor(t){super(t,"BrotliDecompress")}},Ze=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.ZSTD_e_continue,t.finishFlush=t.finishFlush||M.ZSTD_e_end,t.fullFlushFlag=M.ZSTD_e_flush,super(t,e)}},Ye=class extends Ze{constructor(t){super(t,"ZstdCompress")}},Ke=class extends Ze{constructor(t){super(t,"ZstdDecompress")}};import{posix as Zt}from"node:path";var Us=(s,t)=>{if(Number.isSafeInteger(s))s<0?an(s,t):hn(s,t);else throw Error("cannot encode number outside of javascript safe integer range");return t},hn=(s,t)=>{t[0]=128;for(var e=t.length;e>1;e--)t[e-1]=s&255,s=Math.floor(s/256)},an=(s,t)=>{t[0]=255;var e=!1;s=s*-1;for(var i=t.length;i>1;i--){var r=s&255;s=Math.floor(s/256),e?t[i-1]=Ws(r):r===0?t[i-1]=0:(e=!0,t[i-1]=Gs(r))}},Hs=s=>{let t=s[0],e=t===128?cn(s.subarray(1,s.length)):t===255?ln(s):null;if(e===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(e))throw Error("parsed number outside of javascript safe integer range");return e},ln=s=>{for(var t=s.length,e=0,i=!1,r=t-1;r>-1;r--){var n=Number(s[r]),o;i?o=Ws(n):n===0?o=n:(i=!0,o=Gs(n)),o!==0&&(e-=o*Math.pow(256,t-r-1))}return e},cn=s=>{for(var t=s.length,e=0,i=t-1;i>-1;i--){var r=Number(s[i]);r!==0&&(e+=r*Math.pow(256,t-i-1))}return e},Ws=s=>(255^s)&255,Gs=s=>(255^s)+1&255;var Hi={};Ur(Hi,{code:()=>Ve,isCode:()=>ne,isName:()=>dn,name:()=>oe,normalFsTypes:()=>Ui});var ne=s=>oe.has(s),dn=s=>Ve.has(s),Ui=new Set(["0","","1","2","3","4","5","6","7","D"]),oe=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]),Ve=new Map(Array.from(oe).map(s=>[s[1],s[0]]));var mn=s=>s===void 0||s<0?void 0:s,F=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#t="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(t,e=0,i,r){Buffer.isBuffer(t)?this.decode(t,e||0,i,r):t&&this.#i(t)}decode(t,e,i,r){if(e||(e=0),!t||!(t.length>=e+512))throw new Error("need 512 bytes for header");let n=xt(t,e+156,1),o=Ui.has(n),h=o?i:void 0,a=o?r:void 0;if(this.path=h?.path??xt(t,e,100),this.mode=h?.mode??a?.mode??lt(t,e+100,8),this.uid=h?.uid??a?.uid??lt(t,e+108,8),this.gid=h?.gid??a?.gid??lt(t,e+116,8),this.size=mn(h?.size??a?.size??lt(t,e+124,12)),this.mtime=h?.mtime??a?.mtime??Wi(t,e+136,12),this.cksum=lt(t,e+148,12),a&&this.#i(a,!0),h&&this.#i(h),ne(n)&&(this.#t=n||"0"),this.#t==="0"&&this.path.slice(-1)==="/"&&(this.#t="5"),this.#t==="5"&&(this.size=0),this.linkpath=xt(t,e+157,100),t.subarray(e+257,e+265).toString()==="ustar\x0000")if(this.uname=h?.uname??a?.uname??xt(t,e+265,32),this.gname=h?.gname??a?.gname??xt(t,e+297,32),this.devmaj=h?.devmaj??a?.devmaj??lt(t,e+329,8)??0,this.devmin=h?.devmin??a?.devmin??lt(t,e+337,8)??0,t[e+475]!==0){let c=xt(t,e+345,155);this.path=c+"/"+this.path}else{let c=xt(t,e+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Wi(t,e+476,12),this.ctime=i?.ctime??r?.ctime??Wi(t,e+488,12)}let l=256;for(let c=e;c<e+148;c++)l+=t[c];for(let c=e+156;c<e+512;c++)l+=t[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(t,e=!1){Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&e||i==="linkpath"&&e||i==="global"))))}encode(t,e=0){if(t||(t=this.block=Buffer.alloc(512)),this.#t==="Unsupported"&&(this.#t="0"),!(t.length>=e+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=un(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Lt(t,e,100,n)||this.needPax,this.needPax=ct(t,e+100,8,this.mode)||this.needPax,this.needPax=ct(t,e+108,8,this.uid)||this.needPax,this.needPax=ct(t,e+116,8,this.gid)||this.needPax,this.needPax=ct(t,e+124,12,this.size)||this.needPax,this.needPax=Gi(t,e+136,12,this.mtime)||this.needPax,t[e+156]=Number(this.#t.codePointAt(0)),this.needPax=Lt(t,e+157,100,this.linkpath)||this.needPax,t.write("ustar\x0000",e+257,8),this.needPax=Lt(t,e+265,32,this.uname)||this.needPax,this.needPax=Lt(t,e+297,32,this.gname)||this.needPax,this.needPax=ct(t,e+329,8,this.devmaj)||this.needPax,this.needPax=ct(t,e+337,8,this.devmin)||this.needPax,this.needPax=Lt(t,e+345,i,o)||this.needPax,t[e+475]!==0?this.needPax=Lt(t,e+345,155,o)||this.needPax:(this.needPax=Lt(t,e+345,130,o)||this.needPax,this.needPax=Gi(t,e+476,12,this.atime)||this.needPax,this.needPax=Gi(t,e+488,12,this.ctime)||this.needPax);let h=256;for(let a=e;a<e+148;a++)h+=t[a];for(let a=e+156;a<e+512;a++)h+=t[a];return this.cksum=h,ct(t,e+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#t==="Unsupported"?this.#t:oe.get(this.#t)}get typeKey(){return this.#t}set type(t){let e=String(Ve.get(t));if(ne(e)||e==="Unsupported")this.#t=e;else if(ne(t))this.#t=t;else throw new TypeError("invalid entry type: "+t)}},un=(s,t)=>{let i=s,r="",n,o=Zt.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Zt.dirname(i),i=Zt.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=t?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=t?n=[i.slice(0,99),r,!0]:(i=Zt.join(Zt.basename(r),i),r=Zt.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},xt=(s,t,e)=>s.subarray(t,t+e).toString("utf8").replace(/\0.*/,""),Wi=(s,t,e)=>pn(lt(s,t,e)),pn=s=>s===void 0?void 0:new Date(s*1e3),lt=(s,t,e)=>Number(s[t])&128?Hs(s.subarray(t,t+e)):wn(s,t,e),En=s=>isNaN(s)?void 0:s,wn=(s,t,e)=>En(parseInt(s.subarray(t,t+e).toString("utf8").replace(/\0.*$/,"").trim(),8)),Sn={12:8589934591,8:2097151},ct=(s,t,e,i)=>i===void 0?!1:i>Sn[e]||i<0?(Us(i,s.subarray(t,t+e)),!0):(yn(s,t,e,i),!1),yn=(s,t,e,i)=>s.write(Rn(i,e),t,e,"ascii"),Rn=(s,t)=>gn(Math.floor(s).toString(8),t),gn=(s,t)=>(s.length===t-1?s:new Array(t-s.length-1).join("0")+s+" ")+"\0",Gi=(s,t,e,i)=>i===void 0?!1:ct(s,t,e,i.getTime()/1e3),bn=new Array(156).join("\0"),Lt=(s,t,e,i)=>i===void 0?!1:(s.write(i+bn,t,e,"utf8"),i.length!==Buffer.byteLength(i)||i.length>e);import{basename as _n}from"node:path";var ft=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(t,e=!1){this.atime=t.atime,this.charset=t.charset,this.comment=t.comment,this.ctime=t.ctime,this.dev=t.dev,this.gid=t.gid,this.global=e,this.gname=t.gname,this.ino=t.ino,this.linkpath=t.linkpath,this.mtime=t.mtime,this.nlink=t.nlink,this.path=t.path,this.size=t.size,this.uid=t.uid,this.uname=t.uname}encode(){let t=this.encodeBody();if(t==="")return Buffer.allocUnsafe(0);let e=Buffer.byteLength(t),i=512*Math.ceil(1+e/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new F({path:("PaxHeader/"+_n(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:e,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(t,512,e,"utf8");for(let n=e+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(t){if(this[t]===void 0)return"";let e=this[t],i=e instanceof Date?e.getTime()/1e3:e,r=" "+(t==="dev"||t==="ino"||t==="nlink"?"SCHILY.":"")+t+"="+i+`
+var zr=Object.defineProperty;var Ur=(s,t)=>{for(var e in t)zr(s,e,{get:t[e],enumerable:!0})};import Qr from"events";import I from"fs";import{EventEmitter as Di}from"node:events";import Cs from"node:stream";import{StringDecoder as Hr}from"node:string_decoder";var Ds=typeof process=="object"&&process?process:{stdout:null,stderr:null},Wr=s=>!!s&&typeof s=="object"&&(s instanceof A||s instanceof Cs||Gr(s)||Zr(s)),Gr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.pipe=="function"&&s.pipe!==Cs.Writable.prototype.pipe,Zr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.write=="function"&&typeof s.end=="function",Q=Symbol("EOF"),J=Symbol("maybeEmitEnd"),nt=Symbol("emittedEnd"),De=Symbol("emittingEnd"),qt=Symbol("emittedError"),Ne=Symbol("closed"),Ns=Symbol("read"),Ae=Symbol("flush"),As=Symbol("flushChunk"),z=Symbol("encoding"),Mt=Symbol("decoder"),g=Symbol("flowing"),Qt=Symbol("paused"),Bt=Symbol("resume"),b=Symbol("buffer"),N=Symbol("pipes"),_=Symbol("bufferLength"),bi=Symbol("bufferPush"),Ie=Symbol("bufferShift"),L=Symbol("objectMode"),S=Symbol("destroyed"),_i=Symbol("error"),Oi=Symbol("emitData"),Is=Symbol("emitEnd"),Ti=Symbol("emitEnd2"),Z=Symbol("async"),xi=Symbol("abort"),Ce=Symbol("aborted"),Jt=Symbol("signal"),Rt=Symbol("dataListeners"),C=Symbol("discarded"),jt=s=>Promise.resolve().then(s),Yr=s=>s(),Kr=s=>s==="end"||s==="finish"||s==="prefinish",Vr=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,$r=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Fe=class{src;dest;opts;ondrain;constructor(t,e,i){this.src=t,this.dest=e,this.opts=i,this.ondrain=()=>t[Bt](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(t){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},Li=class extends Fe{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(t,e,i){super(t,e,i),this.proxyErrors=r=>this.dest.emit("error",r),t.on("error",this.proxyErrors)}},Xr=s=>!!s.objectMode,qr=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",A=class extends Di{[g]=!1;[Qt]=!1;[N]=[];[b]=[];[L];[z];[Z];[Mt];[Q]=!1;[nt]=!1;[De]=!1;[Ne]=!1;[qt]=null;[_]=0;[S]=!1;[Jt];[Ce]=!1;[Rt]=0;[C]=!1;writable=!0;readable=!0;constructor(...t){let e=t[0]||{};if(super(),e.objectMode&&typeof e.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Xr(e)?(this[L]=!0,this[z]=null):qr(e)?(this[z]=e.encoding,this[L]=!1):(this[L]=!1,this[z]=null),this[Z]=!!e.async,this[Mt]=this[z]?new Hr(this[z]):null,e&&e.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[b]}),e&&e.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[N]});let{signal:i}=e;i&&(this[Jt]=i,i.aborted?this[xi]():i.addEventListener("abort",()=>this[xi]()))}get bufferLength(){return this[_]}get encoding(){return this[z]}set encoding(t){throw new Error("Encoding must be set at instantiation time")}setEncoding(t){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[L]}set objectMode(t){throw new Error("objectMode must be set at instantiation time")}get async(){return this[Z]}set async(t){this[Z]=this[Z]||!!t}[xi](){this[Ce]=!0,this.emit("abort",this[Jt]?.reason),this.destroy(this[Jt]?.reason)}get aborted(){return this[Ce]}set aborted(t){}write(t,e,i){if(this[Ce])return!1;if(this[Q])throw new Error("write after end");if(this[S])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof e=="function"&&(i=e,e="utf8"),e||(e="utf8");let r=this[Z]?jt:Yr;if(!this[L]&&!Buffer.isBuffer(t)){if($r(t))t=Buffer.from(t.buffer,t.byteOffset,t.byteLength);else if(Vr(t))t=Buffer.from(t);else if(typeof t!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[L]?(this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):t.length?(typeof t=="string"&&!(e===this[z]&&!this[Mt]?.lastNeed)&&(t=Buffer.from(t,e)),Buffer.isBuffer(t)&&this[z]&&(t=this[Mt].write(t)),this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):(this[_]!==0&&this.emit("readable"),i&&r(i),this[g])}read(t){if(this[S])return null;if(this[C]=!1,this[_]===0||t===0||t&&t>this[_])return this[J](),null;this[L]&&(t=null),this[b].length>1&&!this[L]&&(this[b]=[this[z]?this[b].join(""):Buffer.concat(this[b],this[_])]);let e=this[Ns](t||null,this[b][0]);return this[J](),e}[Ns](t,e){if(this[L])this[Ie]();else{let i=e;t===i.length||t===null?this[Ie]():typeof i=="string"?(this[b][0]=i.slice(t),e=i.slice(0,t),this[_]-=t):(this[b][0]=i.subarray(t),e=i.subarray(0,t),this[_]-=t)}return this.emit("data",e),!this[b].length&&!this[Q]&&this.emit("drain"),e}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e="utf8"),t!==void 0&&this.write(t,e),i&&this.once("end",i),this[Q]=!0,this.writable=!1,(this[g]||!this[Qt])&&this[J](),this}[Bt](){this[S]||(!this[Rt]&&!this[N].length&&(this[C]=!0),this[Qt]=!1,this[g]=!0,this.emit("resume"),this[b].length?this[Ae]():this[Q]?this[J]():this.emit("drain"))}resume(){return this[Bt]()}pause(){this[g]=!1,this[Qt]=!0,this[C]=!1}get destroyed(){return this[S]}get flowing(){return this[g]}get paused(){return this[Qt]}[bi](t){this[L]?this[_]+=1:this[_]+=t.length,this[b].push(t)}[Ie](){return this[L]?this[_]-=1:this[_]-=this[b][0].length,this[b].shift()}[Ae](t=!1){do;while(this[As](this[Ie]())&&this[b].length);!t&&!this[b].length&&!this[Q]&&this.emit("drain")}[As](t){return this.emit("data",t),this[g]}pipe(t,e){if(this[S])return t;this[C]=!1;let i=this[nt];return e=e||{},t===Ds.stdout||t===Ds.stderr?e.end=!1:e.end=e.end!==!1,e.proxyErrors=!!e.proxyErrors,i?e.end&&t.end():(this[N].push(e.proxyErrors?new Li(this,t,e):new Fe(this,t,e)),this[Z]?jt(()=>this[Bt]()):this[Bt]()),t}unpipe(t){let e=this[N].find(i=>i.dest===t);e&&(this[N].length===1?(this[g]&&this[Rt]===0&&(this[g]=!1),this[N]=[]):this[N].splice(this[N].indexOf(e),1),e.unpipe())}addListener(t,e){return this.on(t,e)}on(t,e){let i=super.on(t,e);if(t==="data")this[C]=!1,this[Rt]++,!this[N].length&&!this[g]&&this[Bt]();else if(t==="readable"&&this[_]!==0)super.emit("readable");else if(Kr(t)&&this[nt])super.emit(t),this.removeAllListeners(t);else if(t==="error"&&this[qt]){let r=e;this[Z]?jt(()=>r.call(this,this[qt])):r.call(this,this[qt])}return i}removeListener(t,e){return this.off(t,e)}off(t,e){let i=super.off(t,e);return t==="data"&&(this[Rt]=this.listeners("data").length,this[Rt]===0&&!this[C]&&!this[N].length&&(this[g]=!1)),i}removeAllListeners(t){let e=super.removeAllListeners(t);return(t==="data"||t===void 0)&&(this[Rt]=0,!this[C]&&!this[N].length&&(this[g]=!1)),e}get emittedEnd(){return this[nt]}[J](){!this[De]&&!this[nt]&&!this[S]&&this[b].length===0&&this[Q]&&(this[De]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ne]&&this.emit("close"),this[De]=!1)}emit(t,...e){let i=e[0];if(t!=="error"&&t!=="close"&&t!==S&&this[S])return!1;if(t==="data")return!this[L]&&!i?!1:this[Z]?(jt(()=>this[Oi](i)),!0):this[Oi](i);if(t==="end")return this[Is]();if(t==="close"){if(this[Ne]=!0,!this[nt]&&!this[S])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(t==="error"){this[qt]=i,super.emit(_i,i);let n=!this[Jt]||this.listeners("error").length?super.emit("error",i):!1;return this[J](),n}else if(t==="resume"){let n=super.emit("resume");return this[J](),n}else if(t==="finish"||t==="prefinish"){let n=super.emit(t);return this.removeAllListeners(t),n}let r=super.emit(t,...e);return this[J](),r}[Oi](t){for(let i of this[N])i.dest.write(t)===!1&&this.pause();let e=this[C]?!1:super.emit("data",t);return this[J](),e}[Is](){return this[nt]?!1:(this[nt]=!0,this.readable=!1,this[Z]?(jt(()=>this[Ti]()),!0):this[Ti]())}[Ti](){if(this[Mt]){let e=this[Mt].end();if(e){for(let i of this[N])i.dest.write(e);this[C]||super.emit("data",e)}}for(let e of this[N])e.end();let t=super.emit("end");return this.removeAllListeners("end"),t}async collect(){let t=Object.assign([],{dataLength:0});this[L]||(t.dataLength=0);let e=this.promise();return this.on("data",i=>{t.push(i),this[L]||(t.dataLength+=i.length)}),await e,t}async concat(){if(this[L])throw new Error("cannot concat in objectMode");let t=await this.collect();return this[z]?t.join(""):Buffer.concat(t,t.dataLength)}async promise(){return new Promise((t,e)=>{this.on(S,()=>e(new Error("stream destroyed"))),this.on("error",i=>e(i)),this.on("end",()=>t())})}[Symbol.asyncIterator](){this[C]=!1;let t=!1,e=async()=>(this.pause(),t=!0,{value:void 0,done:!0});return{next:()=>{if(t)return e();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[Q])return e();let n,o,h=d=>{this.off("data",a),this.off("end",l),this.off(S,c),e(),o(d)},a=d=>{this.off("error",h),this.off("end",l),this.off(S,c),this.pause(),n({value:d,done:!!this[Q]})},l=()=>{this.off("error",h),this.off("data",a),this.off(S,c),e(),n({done:!0,value:void 0})},c=()=>h(new Error("stream destroyed"));return new Promise((d,y)=>{o=y,n=d,this.once(S,c),this.once("error",h),this.once("end",l),this.once("data",a)})},throw:e,return:e,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[C]=!1;let t=!1,e=()=>(this.pause(),this.off(_i,e),this.off(S,e),this.off("end",e),t=!0,{done:!0,value:void 0}),i=()=>{if(t)return e();let r=this.read();return r===null?e():{done:!1,value:r}};return this.once("end",e),this.once(_i,e),this.once(S,e),{next:i,throw:e,return:e,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(t){if(this[S])return t?this.emit("error",t):this.emit(S),this;this[S]=!0,this[C]=!0,this[b].length=0,this[_]=0;let e=this;return typeof e.close=="function"&&!this[Ne]&&e.close(),t?this.emit("error",t):this.emit(S),this}static get isStream(){return Wr}};var Jr=I.writev,ht=Symbol("_autoClose"),H=Symbol("_close"),te=Symbol("_ended"),m=Symbol("_fd"),Ni=Symbol("_finished"),tt=Symbol("_flags"),Ai=Symbol("_flush"),ki=Symbol("_handleChunk"),vi=Symbol("_makeBuf"),ie=Symbol("_mode"),ke=Symbol("_needDrain"),Ut=Symbol("_onerror"),Ht=Symbol("_onopen"),Ii=Symbol("_onread"),Pt=Symbol("_onwrite"),at=Symbol("_open"),U=Symbol("_path"),ot=Symbol("_pos"),Y=Symbol("_queue"),zt=Symbol("_read"),Ci=Symbol("_readSize"),j=Symbol("_reading"),ee=Symbol("_remain"),Fi=Symbol("_size"),ve=Symbol("_write"),gt=Symbol("_writing"),Me=Symbol("_defaultFlag"),bt=Symbol("_errored"),_t=class extends A{[bt]=!1;[m];[U];[Ci];[j]=!1;[Fi];[ee];[ht];constructor(t,e){if(e=e||{},super(e),this.readable=!0,this.writable=!1,typeof t!="string")throw new TypeError("path must be a string");this[bt]=!1,this[m]=typeof e.fd=="number"?e.fd:void 0,this[U]=t,this[Ci]=e.readSize||16*1024*1024,this[j]=!1,this[Fi]=typeof e.size=="number"?e.size:1/0,this[ee]=this[Fi],this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0,typeof this[m]=="number"?this[zt]():this[at]()}get fd(){return this[m]}get path(){return this[U]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[at](){I.open(this[U],"r",(t,e)=>this[Ht](t,e))}[Ht](t,e){t?this[Ut](t):(this[m]=e,this.emit("open",e),this[zt]())}[vi](){return Buffer.allocUnsafe(Math.min(this[Ci],this[ee]))}[zt](){if(!this[j]){this[j]=!0;let t=this[vi]();if(t.length===0)return process.nextTick(()=>this[Ii](null,0,t));I.read(this[m],t,0,t.length,null,(e,i,r)=>this[Ii](e,i,r))}}[Ii](t,e,i){this[j]=!1,t?this[Ut](t):this[ki](e,i)&&this[zt]()}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}[Ut](t){this[j]=!0,this[H](),this.emit("error",t)}[ki](t,e){let i=!1;return this[ee]-=t,t>0&&(i=super.write(t<e.length?e.subarray(0,t):e)),(t===0||this[ee]<=0)&&(i=!1,this[H](),super.end()),i}emit(t,...e){switch(t){case"prefinish":case"finish":return!1;case"drain":return typeof this[m]=="number"&&this[zt](),!1;case"error":return this[bt]?!1:(this[bt]=!0,super.emit(t,...e));default:return super.emit(t,...e)}}},Be=class extends _t{[at](){let t=!0;try{this[Ht](null,I.openSync(this[U],"r")),t=!1}finally{t&&this[H]()}}[zt](){let t=!0;try{if(!this[j]){this[j]=!0;do{let e=this[vi](),i=e.length===0?0:I.readSync(this[m],e,0,e.length,null);if(!this[ki](i,e))break}while(!0);this[j]=!1}t=!1}finally{t&&this[H]()}}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.closeSync(t),this.emit("close")}}},et=class extends Qr{readable=!1;writable=!0;[bt]=!1;[gt]=!1;[te]=!1;[Y]=[];[ke]=!1;[U];[ie];[ht];[m];[Me];[tt];[Ni]=!1;[ot];constructor(t,e){e=e||{},super(e),this[U]=t,this[m]=typeof e.fd=="number"?e.fd:void 0,this[ie]=e.mode===void 0?438:e.mode,this[ot]=typeof e.start=="number"?e.start:void 0,this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0;let i=this[ot]!==void 0?"r+":"w";this[Me]=e.flags===void 0,this[tt]=e.flags===void 0?i:e.flags,this[m]===void 0&&this[at]()}emit(t,...e){if(t==="error"){if(this[bt])return!1;this[bt]=!0}return super.emit(t,...e)}get fd(){return this[m]}get path(){return this[U]}[Ut](t){this[H](),this[gt]=!0,this.emit("error",t)}[at](){I.open(this[U],this[tt],this[ie],(t,e)=>this[Ht](t,e))}[Ht](t,e){this[Me]&&this[tt]==="r+"&&t&&t.code==="ENOENT"?(this[tt]="w",this[at]()):t?this[Ut](t):(this[m]=e,this.emit("open",e),this[gt]||this[Ai]())}end(t,e){return t&&this.write(t,e),this[te]=!0,!this[gt]&&!this[Y].length&&typeof this[m]=="number"&&this[Pt](null,0),this}write(t,e){return typeof t=="string"&&(t=Buffer.from(t,e)),this[te]?(this.emit("error",new Error("write() after end()")),!1):this[m]===void 0||this[gt]||this[Y].length?(this[Y].push(t),this[ke]=!0,!1):(this[gt]=!0,this[ve](t),!0)}[ve](t){I.write(this[m],t,0,t.length,this[ot],(e,i)=>this[Pt](e,i))}[Pt](t,e){t?this[Ut](t):(this[ot]!==void 0&&typeof e=="number"&&(this[ot]+=e),this[Y].length?this[Ai]():(this[gt]=!1,this[te]&&!this[Ni]?(this[Ni]=!0,this[H](),this.emit("finish")):this[ke]&&(this[ke]=!1,this.emit("drain"))))}[Ai](){if(this[Y].length===0)this[te]&&this[Pt](null,0);else if(this[Y].length===1)this[ve](this[Y].pop());else{let t=this[Y];this[Y]=[],Jr(this[m],t,this[ot],(e,i)=>this[Pt](e,i))}}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}},Wt=class extends et{[at](){let t;if(this[Me]&&this[tt]==="r+")try{t=I.openSync(this[U],this[tt],this[ie])}catch(e){if(e?.code==="ENOENT")return this[tt]="w",this[at]();throw e}else t=I.openSync(this[U],this[tt],this[ie]);this[Ht](null,t)}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.closeSync(t),this.emit("close")}}[ve](t){let e=!0;try{this[Pt](null,I.writeSync(this[m],t,0,t.length,this[ot])),e=!1}finally{if(e)try{this[H]()}catch{}}}};import cr from"node:path";import Kt from"node:fs";import{dirname as Fn,parse as kn}from"path";var jr=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),Fs=s=>!!s.sync&&!!s.file,ks=s=>!s.sync&&!!s.file,vs=s=>!!s.sync&&!s.file,Ms=s=>!s.sync&&!s.file;var Bs=s=>!!s.file;var tn=s=>{let t=jr.get(s);return t||s},se=(s={})=>{if(!s)return{};let t={};for(let[e,i]of Object.entries(s)){let r=tn(e);t[r]=i}return t.chmod===void 0&&t.noChmod===!1&&(t.chmod=!0),delete t.noChmod,t};var K=(s,t,e,i,r)=>Object.assign((n=[],o,h)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(h=o,o=void 0),o=o?Array.from(o):[];let a=se(n);if(r?.(a,o),Fs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return s(a,o)}else if(ks(a)){let l=t(a,o);return h?l.then(()=>h(),h):l}else if(vs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return e(a,o)}else if(Ms(a)){if(typeof h=="function")throw new TypeError("callback only supported with file option");return i(a,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:t,syncNoFile:e,asyncNoFile:i,validate:r});import{EventEmitter as Dn}from"events";import zi from"assert";import{Buffer as Ot}from"buffer";import*as Ps from"zlib";import en from"zlib";var sn=en.constants||{ZLIB_VERNUM:4736},M=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},sn));var rn=Ot.concat,zs=Object.getOwnPropertyDescriptor(Ot,"concat"),nn=s=>s,Bi=zs?.writable===!0||zs?.set!==void 0?s=>{Ot.concat=s?nn:rn}:s=>{},Tt=Symbol("_superWrite"),Gt=class extends Error{code;errno;constructor(t,e){super("zlib: "+t.message,{cause:t}),this.code=t.code,this.errno=t.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+t.message,Error.captureStackTrace(this,e??this.constructor)}get name(){return"ZlibError"}},Pi=Symbol("flushFlag"),re=class extends A{#t=!1;#i=!1;#s;#n;#r;#e;#o;get sawError(){return this.#t}get handle(){return this.#e}get flushFlag(){return this.#s}constructor(t,e){if(!t||typeof t!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(t),this.#s=t.flush??0,this.#n=t.finishFlush??0,this.#r=t.fullFlushFlag??0,typeof Ps[e]!="function")throw new TypeError("Compression method not supported: "+e);try{this.#e=new Ps[e](t)}catch(i){throw new Gt(i,this.constructor)}this.#o=i=>{this.#t||(this.#t=!0,this.close(),this.emit("error",i))},this.#e?.on("error",i=>this.#o(new Gt(i))),this.once("end",()=>this.close)}close(){this.#e&&(this.#e.close(),this.#e=void 0,this.emit("close"))}reset(){if(!this.#t)return zi(this.#e,"zlib binding closed"),this.#e.reset?.()}flush(t){this.ended||(typeof t!="number"&&(t=this.#r),this.write(Object.assign(Ot.alloc(0),{[Pi]:t})))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&(e?this.write(t,e):this.write(t)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Tt](t){return super.write(t)}write(t,e,i){if(typeof e=="function"&&(i=e,e="utf8"),typeof t=="string"&&(t=Ot.from(t,e)),this.#t)return;zi(this.#e,"zlib binding closed");let r=this.#e._handle,n=r.close;r.close=()=>{};let o=this.#e.close;this.#e.close=()=>{},Bi(!0);let h;try{let l=typeof t[Pi]=="number"?t[Pi]:this.#s;h=this.#e._processChunk(t,l),Bi(!1)}catch(l){Bi(!1),this.#o(new Gt(l,this.write))}finally{this.#e&&(this.#e._handle=r,r.close=n,this.#e.close=o,this.#e.removeAllListeners("error"))}this.#e&&this.#e.on("error",l=>this.#o(new Gt(l,this.write)));let a;if(h)if(Array.isArray(h)&&h.length>0){let l=h[0];a=this[Tt](Ot.from(l));for(let c=1;c<h.length;c++)a=this[Tt](h[c])}else a=this[Tt](Ot.from(h));return i&&i(),a}},Pe=class extends re{#t;#i;constructor(t,e){t=t||{},t.flush=t.flush||M.Z_NO_FLUSH,t.finishFlush=t.finishFlush||M.Z_FINISH,t.fullFlushFlag=M.Z_FULL_FLUSH,super(t,e),this.#t=t.level,this.#i=t.strategy}params(t,e){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#t!==t||this.#i!==e){this.flush(M.Z_SYNC_FLUSH),zi(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(t,e)}finally{this.handle.flush=i}this.handle&&(this.#t=t,this.#i=e)}}}};var ze=class extends Pe{#t;constructor(t){super(t,"Gzip"),this.#t=t&&!!t.portable}[Tt](t){return this.#t?(this.#t=!1,t[9]=255,super[Tt](t)):super[Tt](t)}};var Ue=class extends Pe{constructor(t){super(t,"Unzip")}},He=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.BROTLI_OPERATION_PROCESS,t.finishFlush=t.finishFlush||M.BROTLI_OPERATION_FINISH,t.fullFlushFlag=M.BROTLI_OPERATION_FLUSH,super(t,e)}},We=class extends He{constructor(t){super(t,"BrotliCompress")}},Ge=class extends He{constructor(t){super(t,"BrotliDecompress")}},Ze=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.ZSTD_e_continue,t.finishFlush=t.finishFlush||M.ZSTD_e_end,t.fullFlushFlag=M.ZSTD_e_flush,super(t,e)}},Ye=class extends Ze{constructor(t){super(t,"ZstdCompress")}},Ke=class extends Ze{constructor(t){super(t,"ZstdDecompress")}};import{posix as Zt}from"node:path";var Us=(s,t)=>{if(Number.isSafeInteger(s))s<0?an(s,t):hn(s,t);else throw Error("cannot encode number outside of javascript safe integer range");return t},hn=(s,t)=>{t[0]=128;for(var e=t.length;e>1;e--)t[e-1]=s&255,s=Math.floor(s/256)},an=(s,t)=>{t[0]=255;var e=!1;s=s*-1;for(var i=t.length;i>1;i--){var r=s&255;s=Math.floor(s/256),e?t[i-1]=Ws(r):r===0?t[i-1]=0:(e=!0,t[i-1]=Gs(r))}},Hs=s=>{let t=s[0],e=t===128?cn(s.subarray(1,s.length)):t===255?ln(s):null;if(e===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(e))throw Error("parsed number outside of javascript safe integer range");return e},ln=s=>{for(var t=s.length,e=0,i=!1,r=t-1;r>-1;r--){var n=Number(s[r]),o;i?o=Ws(n):n===0?o=n:(i=!0,o=Gs(n)),o!==0&&(e-=o*Math.pow(256,t-r-1))}return e},cn=s=>{for(var t=s.length,e=0,i=t-1;i>-1;i--){var r=Number(s[i]);r!==0&&(e+=r*Math.pow(256,t-i-1))}return e},Ws=s=>(255^s)&255,Gs=s=>(255^s)+1&255;var Hi={};Ur(Hi,{code:()=>Ve,isCode:()=>ne,isName:()=>dn,name:()=>oe,normalFsTypes:()=>Ui});var ne=s=>oe.has(s),dn=s=>Ve.has(s),Ui=new Set(["0","","1","2","3","4","5","6","7","D"]),oe=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]),Ve=new Map(Array.from(oe).map(s=>[s[1],s[0]]));var un=s=>s===void 0||s<0?void 0:s,F=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#t="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(t,e=0,i,r){Buffer.isBuffer(t)?this.decode(t,e||0,i,r):t&&this.#i(t)}decode(t,e,i,r){if(e||(e=0),!t||!(t.length>=e+512))throw new Error("need 512 bytes for header");let n=xt(t,e+156,1),o=Ui.has(n),h=o?i:void 0,a=o?r:void 0;if(this.path=h?.path??xt(t,e,100),this.mode=h?.mode??a?.mode??lt(t,e+100,8),this.uid=h?.uid??a?.uid??lt(t,e+108,8),this.gid=h?.gid??a?.gid??lt(t,e+116,8),this.size=un(h?.size??a?.size??lt(t,e+124,12)),this.mtime=h?.mtime??a?.mtime??Wi(t,e+136,12),this.cksum=lt(t,e+148,12),a&&this.#i(a,!0),h&&this.#i(h),ne(n)&&(this.#t=n||"0"),this.#t==="0"&&this.path.slice(-1)==="/"&&(this.#t="5"),this.#t==="5"&&(this.size=0),this.linkpath=xt(t,e+157,100),t.subarray(e+257,e+265).toString()==="ustar\x0000")if(this.uname=h?.uname??a?.uname??xt(t,e+265,32),this.gname=h?.gname??a?.gname??xt(t,e+297,32),this.devmaj=h?.devmaj??a?.devmaj??lt(t,e+329,8)??0,this.devmin=h?.devmin??a?.devmin??lt(t,e+337,8)??0,t[e+475]!==0){let c=xt(t,e+345,155);this.path=c+"/"+this.path}else{let c=xt(t,e+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Wi(t,e+476,12),this.ctime=i?.ctime??r?.ctime??Wi(t,e+488,12)}let l=256;for(let c=e;c<e+148;c++)l+=t[c];for(let c=e+156;c<e+512;c++)l+=t[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(t,e=!1){Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&e||i==="linkpath"&&e||i==="global"))))}encode(t,e=0){if(t||(t=this.block=Buffer.alloc(512)),this.#t==="Unsupported"&&(this.#t="0"),!(t.length>=e+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=mn(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Lt(t,e,100,n)||this.needPax,this.needPax=ct(t,e+100,8,this.mode)||this.needPax,this.needPax=ct(t,e+108,8,this.uid)||this.needPax,this.needPax=ct(t,e+116,8,this.gid)||this.needPax,this.needPax=ct(t,e+124,12,this.size)||this.needPax,this.needPax=Gi(t,e+136,12,this.mtime)||this.needPax,t[e+156]=Number(this.#t.codePointAt(0)),this.needPax=Lt(t,e+157,100,this.linkpath)||this.needPax,t.write("ustar\x0000",e+257,8),this.needPax=Lt(t,e+265,32,this.uname)||this.needPax,this.needPax=Lt(t,e+297,32,this.gname)||this.needPax,this.needPax=ct(t,e+329,8,this.devmaj)||this.needPax,this.needPax=ct(t,e+337,8,this.devmin)||this.needPax,this.needPax=Lt(t,e+345,i,o)||this.needPax,t[e+475]!==0?this.needPax=Lt(t,e+345,155,o)||this.needPax:(this.needPax=Lt(t,e+345,130,o)||this.needPax,this.needPax=Gi(t,e+476,12,this.atime)||this.needPax,this.needPax=Gi(t,e+488,12,this.ctime)||this.needPax);let h=256;for(let a=e;a<e+148;a++)h+=t[a];for(let a=e+156;a<e+512;a++)h+=t[a];return this.cksum=h,ct(t,e+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#t==="Unsupported"?this.#t:oe.get(this.#t)}get typeKey(){return this.#t}set type(t){let e=String(Ve.get(t));if(ne(e)||e==="Unsupported")this.#t=e;else if(ne(t))this.#t=t;else throw new TypeError("invalid entry type: "+t)}},mn=(s,t)=>{let i=s,r="",n,o=Zt.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Zt.dirname(i),i=Zt.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=t?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=t?n=[i.slice(0,99),r,!0]:(i=Zt.join(Zt.basename(r),i),r=Zt.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},xt=(s,t,e)=>s.subarray(t,t+e).toString("utf8").replace(/\0.*/,""),Wi=(s,t,e)=>pn(lt(s,t,e)),pn=s=>s===void 0?void 0:new Date(s*1e3),lt=(s,t,e)=>Number(s[t])&128?Hs(s.subarray(t,t+e)):wn(s,t,e),En=s=>isNaN(s)?void 0:s,wn=(s,t,e)=>En(parseInt(s.subarray(t,t+e).toString("utf8").replace(/\0.*$/,"").trim(),8)),Sn={12:8589934591,8:2097151},ct=(s,t,e,i)=>i===void 0?!1:i>Sn[e]||i<0?(Us(i,s.subarray(t,t+e)),!0):(yn(s,t,e,i),!1),yn=(s,t,e,i)=>s.write(Rn(i,e),t,e,"ascii"),Rn=(s,t)=>gn(Math.floor(s).toString(8),t),gn=(s,t)=>(s.length===t-1?s:new Array(t-s.length-1).join("0")+s+" ")+"\0",Gi=(s,t,e,i)=>i===void 0?!1:ct(s,t,e,i.getTime()/1e3),bn=new Array(156).join("\0"),Lt=(s,t,e,i)=>i===void 0?!1:(s.write(i+bn,t,e,"utf8"),i.length!==Buffer.byteLength(i)||i.length>e);import{basename as _n}from"node:path";var ft=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(t,e=!1){this.atime=t.atime,this.charset=t.charset,this.comment=t.comment,this.ctime=t.ctime,this.dev=t.dev,this.gid=t.gid,this.global=e,this.gname=t.gname,this.ino=t.ino,this.linkpath=t.linkpath,this.mtime=t.mtime,this.nlink=t.nlink,this.path=t.path,this.size=t.size,this.uid=t.uid,this.uname=t.uname}encode(){let t=this.encodeBody();if(t==="")return Buffer.allocUnsafe(0);let e=Buffer.byteLength(t),i=512*Math.ceil(1+e/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new F({path:("PaxHeader/"+_n(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:e,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(t,512,e,"utf8");for(let n=e+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(t){if(this[t]===void 0)return"";let e=this[t],i=e instanceof Date?e.getTime()/1e3:e,r=" "+(t==="dev"||t==="ino"||t==="nlink"?"SCHILY.":"")+t+"="+i+`
 `,n=Buffer.byteLength(r),o=Math.floor(Math.log(n)/Math.log(10))+1;return n+o>=Math.pow(10,o)&&(o+=1),o+n+r}static parse(t,e,i=!1){return new s(On(Tn(t),e),i)}},On=(s,t)=>t?Object.assign({},t,s):s,Tn=s=>s.replace(/\n$/,"").split(`
-`).reduce(xn,Object.create(null)),xn=(s,t)=>{let e=parseInt(t,10);if(e!==Buffer.byteLength(t)+1)return s;t=t.slice((e+" ").length);let i=t.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let h=+o;h>=0&&(s[n]=h);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s};var Ln=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,f=Ln!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/");var $e=class extends A{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(t,e,i){switch(super({}),this.pause(),this.extended=e,this.globalExtended=i,this.header=t,this.remain=t.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=t.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!t.path)throw new Error("no path provided for tar.ReadEntry");this.path=f(t.path),this.mode=t.mode,this.mode&&(this.mode=this.mode&4095),this.uid=t.uid,this.gid=t.gid,this.uname=t.uname,this.gname=t.gname,this.size=this.remain,this.mtime=t.mtime,this.atime=t.atime,this.ctime=t.ctime,this.linkpath=t.linkpath?f(t.linkpath):void 0,this.uname=t.uname,this.gname=t.gname,e&&this.#t(e),i&&this.#t(i,!0)}write(t){let e=t.length;if(e>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-e),this.blockRemain=Math.max(0,r-e),this.ignore?!0:i>=e?super.write(t):super.write(t.subarray(0,i))}#t(t,e=!1){t.path&&(t.path=f(t.path)),t.linkpath&&(t.linkpath=f(t.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="path"&&e))))}};var Dt=(s,t,e,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=e instanceof Error&&e.code||t,i.tarCode=t,!s.strict&&i.recoverable!==!1?(e instanceof Error&&(i=Object.assign(e,i),e=e.message),s.emit("warn",t,e,i)):e instanceof Error?s.emit("error",Object.assign(e,i)):s.emit("error",Object.assign(new Error(`${t}: ${e}`),i))};var Nn=1024*1024,Xi=Buffer.from([31,139]),qi=Buffer.from([40,181,47,253]),An=Math.max(Xi.length,qi.length),B=Symbol("state"),Nt=Symbol("writeEntry"),it=Symbol("readEntry"),Zi=Symbol("nextEntry"),Zs=Symbol("processEntry"),V=Symbol("extendedHeader"),he=Symbol("globalExtendedHeader"),dt=Symbol("meta"),Ys=Symbol("emitMeta"),p=Symbol("buffer"),st=Symbol("queue"),mt=Symbol("ended"),Yi=Symbol("emittedEnd"),At=Symbol("emit"),y=Symbol("unzip"),Xe=Symbol("consumeChunk"),qe=Symbol("consumeChunkSub"),Ki=Symbol("consumeBody"),Ks=Symbol("consumeMeta"),Vs=Symbol("consumeHeader"),ae=Symbol("consuming"),Vi=Symbol("bufferConcat"),Qe=Symbol("maybeEnd"),Yt=Symbol("writing"),$=Symbol("aborted"),Je=Symbol("onDone"),It=Symbol("sawValidEntry"),je=Symbol("sawNullBlock"),ti=Symbol("sawEOF"),$s=Symbol("closeStream"),In=1e3,le=Symbol("compressedBytesRead"),$i=Symbol("decompressedBytesRead"),Xs=Symbol("checkDecompressionRatio"),Cn=()=>!0,rt=class extends Dn{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[st]=[];[p];[it];[Nt];[B]="begin";[dt]="";[V];[he];[mt]=!1;[y];[$]=!1;[It];[je]=!1;[ti]=!1;[Yt]=!1;[ae]=!1;[Yi]=!1;[le]=0;[$i]=0;constructor(t={}){super(),this.file=t.file||"",this.on(Je,()=>{(this[B]==="begin"||this[It]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),t.ondone?this.on(Je,t.ondone):this.on(Je,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!t.strict,this.maxDecompressionRatio=typeof t.maxDecompressionRatio=="number"?t.maxDecompressionRatio:In,this.maxMetaEntrySize=t.maxMetaEntrySize||Nn,this.filter=typeof t.filter=="function"?t.filter:Cn;let e=t.file&&(t.file.endsWith(".tar.br")||t.file.endsWith(".tbr"));this.brotli=!(t.gzip||t.zstd)&&t.brotli!==void 0?t.brotli:e?void 0:!1;let i=t.file&&(t.file.endsWith(".tar.zst")||t.file.endsWith(".tzst"));this.zstd=!(t.gzip||t.brotli)&&t.zstd!==void 0?t.zstd:i?!0:void 0,this.on("end",()=>this[$s]()),typeof t.onwarn=="function"&&this.on("warn",t.onwarn),typeof t.onReadEntry=="function"&&this.on("entry",t.onReadEntry)}warn(t,e,i={}){Dt(this,t,e,i)}[Vs](t,e){this[It]===void 0&&(this[It]=!1);let i;try{i=new F(t,e,this[V],this[he])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[je]?(this[ti]=!0,this[B]==="begin"&&(this[B]="header"),this[At]("eof")):(this[je]=!0,this[At]("nullBlock"));else if(this[je]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[Nt]=new $e(i,this[V],this[he]);if(!this[It])if(n.remain){let o=()=>{n.invalid||(this[It]=!0)};n.on("end",o)}else this[It]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[At]("ignoredEntry",n),this[B]="ignore",n.resume()):n.size>0&&(this[dt]="",n.on("data",o=>this[dt]+=o),this[B]="meta"):(this[V]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[At]("ignoredEntry",n),this[B]=n.remain?"ignore":"header",n.resume()):(n.remain?this[B]="body":(this[B]="header",n.end()),this[it]?this[st].push(n):(this[st].push(n),this[Zi]())))}}}[$s](){queueMicrotask(()=>this.emit("close"))}[Zs](t){let e=!0;if(!t)this[it]=void 0,e=!1;else if(Array.isArray(t)){let[i,...r]=t;this.emit(i,...r)}else this[it]=t,this.emit("entry",t),t.emittedEnd||(t.on("end",()=>this[Zi]()),e=!1);return e}[Zi](){do;while(this[Zs](this[st].shift()));if(this[st].length===0){let t=this[it];!t||t.flowing||t.size===t.remain?this[Yt]||this.emit("drain"):t.once("drain",()=>this.emit("drain"))}}[Ki](t,e){let i=this[Nt];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=t.length&&e===0?t:t.subarray(e,e+r);return i.write(n),i.blockRemain||(this[B]="header",this[Nt]=void 0,i.end()),n.length}[Ks](t,e){let i=this[Nt],r=this[Ki](t,e);return!this[Nt]&&i&&this[Ys](i),r}[At](t,e,i){this[st].length===0&&!this[it]?this.emit(t,e,i):this[st].push([t,e,i])}[Ys](t){switch(this[At]("meta",this[dt]),t.type){case"ExtendedHeader":case"OldExtendedHeader":this[V]=ft.parse(this[dt],this[V],!1);break;case"GlobalExtendedHeader":this[he]=ft.parse(this[dt],this[he],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let e=this[V]??Object.create(null);this[V]=e,e.path=this[dt].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let e=this[V]||Object.create(null);this[V]=e,e.linkpath=this[dt].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+t.type)}}abort(t){this[$]||(this[$]=!0,this.emit("abort",t),this.warn("TAR_ABORT",t,{recoverable:!1}))}[Xs](t){this[$i]+=t.length;let e=this[$i]/this[le];return e>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${e.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this[$])return i?.(),!1;if((this[y]===void 0||this.brotli===void 0&&this[y]===!1)&&t){if(this[p]&&(t=Buffer.concat([this[p],t]),this[p]=void 0),t.length<An)return this[p]=t,i?.(),!0;for(let a=0;this[y]===void 0&&a<Xi.length;a++)t[a]!==Xi[a]&&(this[y]=!1);let o=!1;if(this[y]===!1&&this.zstd!==!1){o=!0;for(let a=0;a<qi.length;a++)if(t[a]!==qi[a]){o=!1;break}}let h=this.brotli===void 0&&!o;if(this[y]===!1&&h)if(t.length<512)if(this[mt])this.brotli=!0;else return this[p]=t,i?.(),!0;else try{new F(t.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[y]===void 0||this[y]===!1&&(this.brotli||o)){let a=this[mt];this[mt]=!1,this[y]=this[y]===void 0?new Ue({}):o?new Ke({}):new Ge({}),this[y].on("data",c=>{this[Xs](c)&&this[Xe](c)}),this[y].on("error",c=>{this[$]||this.abort(c)}),this[y].on("end",()=>{this[mt]=!0,this[Xe]()}),this[Yt]=!0,this[le]+=t.length;let l=!!this[y][a?"end":"write"](t);return this[Yt]=!1,i?.(),l}}this[Yt]=!0,this[y]?(this[le]+=t.length,this[y].write(t)):this[Xe](t),this[Yt]=!1;let n=this[st].length>0?!1:this[it]?this[it].flowing:!0;return!n&&this[st].length===0&&this[it]?.once("drain",()=>this.emit("drain")),i?.(),n}[Vi](t){t&&!this[$]&&(this[p]=this[p]?Buffer.concat([this[p],t]):t)}[Qe](){if(this[mt]&&!this[Yi]&&!this[$]&&!this[ae]){this[Yi]=!0;let t=this[Nt];if(t?.blockRemain){let e=this[p]?this[p].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${t.blockRemain} more bytes, only ${e} available)`,{entry:t}),this[p]&&t.write(this[p]),t.end()}this[At](Je)}}[Xe](t){if(this[ae]&&t)this[Vi](t);else if(!t&&!this[p])this[Qe]();else if(t){if(this[ae]=!0,this[p]){this[Vi](t);let e=this[p];this[p]=void 0,this[qe](e)}else this[qe](t);for(;this[p]&&this[p]?.length>=512&&!this[$]&&!this[ti];){let e=this[p];this[p]=void 0,this[qe](e)}this[ae]=!1}(!this[p]||this[mt])&&this[Qe]()}[qe](t){let e=0,i=t.length;for(;e+512<=i&&!this[$]&&!this[ti];)switch(this[B]){case"begin":case"header":this[Vs](t,e),e+=512;break;case"ignore":case"body":e+=this[Ki](t,e);break;case"meta":e+=this[Ks](t,e);break;default:throw new Error("invalid state: "+this[B])}e<i&&(this[p]=this[p]?Buffer.concat([t.subarray(e),this[p]]):t.subarray(e))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e)),i&&this.once("finish",i),this[$]||(this[y]?(t&&(this[le]+=t.length,this[y].write(t)),this[y].end()):(this[mt]=!0,(this.brotli===void 0||this.zstd===void 0)&&(t=t||Buffer.alloc(0)),t&&this.write(t),this[Qe]())),this}};var ut=s=>{let t=s.length-1,e=-1;for(;t>-1&&s.charAt(t)==="/";)e=t,t--;return e===-1?s:s.slice(0,e)};var vn=s=>{let t=s.onReadEntry;s.onReadEntry=t?e=>{t(e),e.resume()}:e=>e.resume()},Qi=(s,t)=>{let e=new Map(t.map(n=>[ut(n),!0])),i=s.filter,r=(n,o="")=>{let h=o||kn(n).root||".",a;if(n===h)a=!1;else{let l=e.get(n);a=l!==void 0?l:r(Fn(n),h)}return e.set(n,a),a};s.filter=i?(n,o)=>i(n,o)&&r(ut(n)):n=>r(ut(n))},Mn=s=>{let t=new rt(s),e=s.file,i;try{i=Kt.openSync(e,"r");let r=Kt.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),h=Kt.readSync(i,o,0,r.size,0);t.end(h===o.byteLength?o:o.subarray(0,h))}else{let o=0,h=Buffer.allocUnsafe(n);for(;o<r.size;){let a=Kt.readSync(i,h,0,n,o);if(a===0)break;o+=a,t.write(h.subarray(0,a))}t.end()}}finally{if(typeof i=="number")try{Kt.closeSync(i)}catch{}}},Bn=(s,t)=>{let e=new rt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("end",o),Kt.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},Ct=K(Mn,Bn,s=>new rt(s),s=>new rt(s),(s,t)=>{t?.length&&Qi(s,t),s.noResume||vn(s)});import ui from"fs";import X from"fs";import js from"path";var Ji=(s,t,e)=>(s&=4095,e&&(s=(s|384)&-19),t&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);import{win32 as Pn}from"node:path";var{isAbsolute:zn,parse:qs}=Pn,ce=s=>{let t="",e=qs(s);for(;zn(s)||e.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":e.root;s=s.slice(i.length),t+=i,e=qs(s)}return[t,s]};var ei=["|","<",">","?",":"],ji=ei.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),Un=new Map(ei.map((s,t)=>[s,ji[t]])),Hn=new Map(ji.map((s,t)=>[s,ei[t]])),ts=s=>ei.reduce((t,e)=>t.split(e).join(Un.get(e)),s),Qs=s=>ji.reduce((t,e)=>t.split(e).join(Hn.get(e)),s);var rr=(s,t)=>t?(s=f(s).replace(/^\.(\/|$)/,""),ut(t)+"/"+s):f(s),Wn=16*1024*1024,tr=Symbol("process"),er=Symbol("file"),ir=Symbol("directory"),is=Symbol("symlink"),sr=Symbol("hardlink"),fe=Symbol("header"),ii=Symbol("read"),ss=Symbol("lstat"),si=Symbol("onlstat"),rs=Symbol("onread"),ns=Symbol("onreadlink"),os=Symbol("openfile"),hs=Symbol("onopenfile"),pt=Symbol("close"),ri=Symbol("mode"),as=Symbol("awaitDrain"),es=Symbol("ondrain"),q=Symbol("prefix"),de=class extends A{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#t=!1;constructor(t,e={}){let i=se(e);super(),this.path=f(t),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||Wn,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=f(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?f(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,h]=ce(this.path);o&&typeof h=="string"&&(this.path=h,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=Qs(this.path.replaceAll(/\\/g,"/")),t=t.replaceAll(/\\/g,"/")),this.absolute=f(i.absolute||js.resolve(this.cwd,t)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[si](n):this[ss]()}warn(t,e,i={}){return Dt(this,t,e,i)}emit(t,...e){return t==="error"&&(this.#t=!0),super.emit(t,...e)}[ss](){X.lstat(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[si](e)})}[si](t){this.statCache.set(this.absolute,t),this.stat=t,t.isFile()||(t.size=0),this.type=Gn(t),this.emit("stat",t),this[tr]()}[tr](){switch(this.type){case"File":return this[er]();case"Directory":return this[ir]();case"SymbolicLink":return this[is]();default:return this.end()}}[ri](t){return Ji(t,this.type==="Directory",this.portable)}[q](t){return rr(t,this.prefix)}[fe](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this[ri](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let t=this.header?.block;if(!t)throw new Error("failed to encode header");super.write(t)}[ir](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[fe](),this.end()}[is](){X.readlink(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[ns](e)})}[ns](t){this.linkpath=f(t),this[fe](),this.end()}[sr](t){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=f(js.relative(this.cwd,t)),this.stat.size=0,this[fe](),this.end()}[er](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let t=`${this.stat.dev}:${this.stat.ino}`,e=this.linkCache.get(t);if(e?.indexOf(this.cwd)===0)return this[sr](e);this.linkCache.set(t,this.absolute)}if(this[fe](),this.stat.size===0)return this.end();this[os]()}[os](){X.open(this.absolute,"r",(t,e)=>{if(t)return this.emit("error",t);this[hs](e)})}[hs](t){if(this.fd=t,this.#t)return this[pt]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let e=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(e),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[ii]()}[ii](){let{fd:t,buf:e,offset:i,length:r,pos:n}=this;if(t===void 0||e===void 0)throw new Error("cannot read file without first opening");X.read(t,e,i,r,n,(o,h)=>{if(o)return this[pt](()=>this.emit("error",o));this[rs](h)})}[pt](t=()=>{}){this.fd!==void 0&&X.close(this.fd,t)}[rs](t){if(t<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(t>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(t===this.remain)for(let r=t;r<this.length&&t<this.blockRemain;r++)this.buf[r+this.offset]=0,t++,this.remain++;let e=this.offset===0&&t===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+t);this.write(e)?this[es]():this[as](()=>this[es]())}[as](t){this.once("drain",t)}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this.blockRemain<t.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=t.length,this.blockRemain-=t.length,this.pos+=t.length,this.offset+=t.length,super.write(t,null,i)}[es](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[pt](t=>t?this.emit("error",t):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[ii]()}},ni=class extends de{sync=!0;[ss](){this[si](X.lstatSync(this.absolute))}[is](){this[ns](X.readlinkSync(this.absolute))}[os](){this[hs](X.openSync(this.absolute,"r"))}[ii](){let t=!0;try{let{fd:e,buf:i,offset:r,length:n,pos:o}=this;if(e===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let h=X.readSync(e,i,r,n,o);this[rs](h),t=!1}finally{if(t)try{this[pt](()=>{})}catch{}}}[as](t){t()}[pt](t=()=>{}){this.fd!==void 0&&X.closeSync(this.fd),t()}},oi=class extends A{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(t,e,i={}){return Dt(this,t,e,i)}constructor(t,e={}){let i=se(e);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=t;let{type:r}=t;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=f(t.path),this.mode=t.mode!==void 0?this[ri](t.mode):void 0,this.uid=this.portable?void 0:t.uid,this.gid=this.portable?void 0:t.gid,this.uname=this.portable?void 0:t.uname,this.gname=this.portable?void 0:t.gname,this.size=t.size,this.mtime=this.noMtime?void 0:i.mtime||t.mtime,this.atime=this.portable?void 0:t.atime,this.ctime=this.portable?void 0:t.ctime,this.linkpath=t.linkpath!==void 0?f(t.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[h,a]=ce(this.path);h&&typeof a=="string"&&(this.path=a,n=h)}this.remain=t.size,this.blockRemain=t.startBlockSize,this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),t.pipe(this)}[q](t){return rr(t,this.prefix)}[ri](t){return Ji(t,this.type==="Directory",this.portable)}write(t,e,i){typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8"));let r=t.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(t,i)}end(t,e,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e??"utf8")),i&&this.once("finish",i),t?super.end(t,i):super.end(i),this}},Gn=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported";var hi=class s{tail;head;length=0;static create(t=[]){return new s(t)}constructor(t=[]){for(let e of t)this.push(e)}*[Symbol.iterator](){for(let t=this.head;t;t=t.next)yield t.value}removeNode(t){if(t.list!==this)throw new Error("removing node which does not belong to this list");let e=t.next,i=t.prev;return e&&(e.prev=i),i&&(i.next=e),t===this.head&&(this.head=e),t===this.tail&&(this.tail=i),this.length--,t.next=void 0,t.prev=void 0,t.list=void 0,e}unshiftNode(t){if(t===this.head)return;t.list&&t.list.removeNode(t);let e=this.head;t.list=this,t.next=e,e&&(e.prev=t),this.head=t,this.tail||(this.tail=t),this.length++}pushNode(t){if(t===this.tail)return;t.list&&t.list.removeNode(t);let e=this.tail;t.list=this,t.prev=e,e&&(e.next=t),this.tail=t,this.head||(this.head=t),this.length++}push(...t){for(let e=0,i=t.length;e<i;e++)Yn(this,t[e]);return this.length}unshift(...t){for(var e=0,i=t.length;e<i;e++)Kn(this,t[e]);return this.length}pop(){if(!this.tail)return;let t=this.tail.value,e=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,e.list=void 0,this.length--,t}shift(){if(!this.head)return;let t=this.head.value,e=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,e.list=void 0,this.length--,t}forEach(t,e){e=e||this;for(let i=this.head,r=0;i;r++)t.call(e,i.value,r,this),i=i.next}forEachReverse(t,e){e=e||this;for(let i=this.tail,r=this.length-1;i;r--)t.call(e,i.value,r,this),i=i.prev}get(t){let e=0,i=this.head;for(;i&&e<t;e++)i=i.next;if(e===t&&i)return i.value}getReverse(t){let e=0,i=this.tail;for(;i&&e<t;e++)i=i.prev;if(e===t&&i)return i.value}map(t,e){e=e||this;let i=new s;for(let r=this.head;r;)i.push(t.call(e,r.value,this)),r=r.next;return i}mapReverse(t,e){e=e||this;var i=new s;for(let r=this.tail;r;)i.push(t.call(e,r.value,this)),r=r.prev;return i}reduce(t,e){let i,r=this.head;if(arguments.length>1)i=e;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=t(i,r.value,n),r=r.next;return i}reduceReverse(t,e){let i,r=this.tail;if(arguments.length>1)i=e;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=t(i,r.value,n),r=r.prev;return i}toArray(){let t=new Array(this.length);for(let e=0,i=this.head;i;e++)t[e]=i.value,i=i.next;return t}toArrayReverse(){let t=new Array(this.length);for(let e=0,i=this.tail;i;e++)t[e]=i.value,i=i.prev;return t}slice(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.head,n=0;for(n=0;r&&n<t;n++)r=r.next;for(;r&&n<e;n++,r=r.next)i.push(r.value);return i}sliceReverse(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.length,n=this.tail;for(;n&&r>e;r--)n=n.prev;for(;n&&r>t;r--,n=n.prev)i.push(n.value);return i}splice(t,e=0,...i){t>this.length&&(t=this.length-1),t<0&&(t=this.length+t);let r=this.head;for(let o=0;r&&o<t;o++)r=r.next;let n=[];for(let o=0;r&&o<e;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=Zn(this,r,o);return n}reverse(){let t=this.head,e=this.tail;for(let i=t;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=e,this.tail=t,this}};function Zn(s,t,e){let i=t,r=t?t.next:s.head,n=new me(e,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function Yn(s,t){s.tail=new me(t,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Kn(s,t){s.head=new me(t,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var me=class{list;next;prev;value;constructor(t,e,i,r){this.list=r,this.value=t,e?(e.next=this,this.prev=e):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};import ar from"path";var pi=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(t,e){this.path=t||"./",this.absolute=e}},nr=Buffer.alloc(1024),li=Symbol("onStat"),ue=Symbol("ended"),W=Symbol("queue"),pe=Symbol("pendingLinks"),Et=Symbol("current"),Ft=Symbol("process"),Ee=Symbol("processing"),ai=Symbol("processJob"),G=Symbol("jobs"),ls=Symbol("jobDone"),ci=Symbol("addFSEntry"),or=Symbol("addTarEntry"),ds=Symbol("stat"),ms=Symbol("readdir"),fi=Symbol("onreaddir"),di=Symbol("pipe"),hr=Symbol("entry"),cs=Symbol("entryOpt"),mi=Symbol("writeEntryClass"),lr=Symbol("write"),fs=Symbol("ondrain"),wt=class extends A{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[mi];onWriteEntry;[W];[pe]=new Map;[G]=0;[Ee]=!1;[ue]=!1;constructor(t={}){if(super(),this.opt=t,this.file=t.file||"",this.cwd=t.cwd||process.cwd(),this.maxReadSize=t.maxReadSize,this.preservePaths=!!t.preservePaths,this.strict=!!t.strict,this.noPax=!!t.noPax,this.prefix=f(t.prefix||""),this.linkCache=t.linkCache||new Map,this.statCache=t.statCache||new Map,this.readdirCache=t.readdirCache||new Map,this.onWriteEntry=t.onWriteEntry,this[mi]=de,typeof t.onwarn=="function"&&this.on("warn",t.onwarn),this.portable=!!t.portable,t.gzip||t.brotli||t.zstd){if((t.gzip?1:0)+(t.brotli?1:0)+(t.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(t.gzip&&(typeof t.gzip!="object"&&(t.gzip={}),this.portable&&(t.gzip.portable=!0),this.zip=new ze(t.gzip)),t.brotli&&(typeof t.brotli!="object"&&(t.brotli={}),this.zip=new We(t.brotli)),t.zstd&&(typeof t.zstd!="object"&&(t.zstd={}),this.zip=new Ye(t.zstd)),!this.zip)throw new Error("impossible");let e=this.zip;e.on("data",i=>super.write(i)),e.on("end",()=>super.end()),e.on("drain",()=>this[fs]()),this.on("resume",()=>e.resume())}else this.on("drain",this[fs]);this.noDirRecurse=!!t.noDirRecurse,this.follow=!!t.follow,this.noMtime=!!t.noMtime,t.mtime&&(this.mtime=t.mtime),this.filter=typeof t.filter=="function"?t.filter:()=>!0,this[W]=new hi,this[G]=0,this.jobs=Number(t.jobs)||4,this[Ee]=!1,this[ue]=!1}[lr](t){return super.write(t)}add(t){return this.write(t),this}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&this.add(t),this[ue]=!0,this[Ft](),i&&i(),this}write(t){if(this[ue])throw new Error("write after end");return typeof t=="string"?this[ci](t):this[or](t),this.flowing}[or](t){let e=f(ar.resolve(this.cwd,t.path));if(!this.filter(t.path,t))t.resume();else{let i=new pi(t.path,e);i.entry=new oi(t,this[cs](i)),i.entry.on("end",()=>this[ls](i)),this[G]+=1,this[W].push(i)}this[Ft]()}[ci](t){let e=f(ar.resolve(this.cwd,t));this[W].push(new pi(t,e)),this[Ft]()}[ds](t){t.pending=!0,this[G]+=1;let e=this.follow?"stat":"lstat";ui[e](t.absolute,(i,r)=>{t.pending=!1,this[G]-=1,i?this.emit("error",i):this[li](t,r)})}[li](t,e){if(this.statCache.set(t.absolute,e),t.stat=e,!this.filter(t.path,e))t.ignore=!0;else if(e.isFile()&&e.nlink>1&&!this.linkCache.get(`${e.dev}:${e.ino}`)&&!this.sync)if(t===this[Et])this[ai](t);else{let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);r?r.push(t):this[pe].set(i,[t]),t.pendingLink=!0,t.pending=!0}this[Ft]()}[ms](t){t.pending=!0,this[G]+=1,ui.readdir(t.absolute,(e,i)=>{if(t.pending=!1,this[G]-=1,e)return this.emit("error",e);this[fi](t,i)})}[fi](t,e){this.readdirCache.set(t.absolute,e),t.readdir=e,this[Ft]()}[Ft](){if(!this[Ee]){this[Ee]=!0;for(let t=this[W].head;t&&this[G]<this.jobs;t=t.next)if(this[ai](t.value),t.value.ignore){let e=t.next;this[W].removeNode(t),t.next=e}this[Ee]=!1,this[ue]&&this[W].length===0&&this[G]===0&&(this.zip?this.zip.end(nr):(super.write(nr),super.end()))}}get[Et](){return this[W]&&this[W].head&&this[W].head.value}[ls](t){this[W].shift(),this[G]-=1;let{stat:e}=t;if(e&&e.isFile()&&e.nlink>1){let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);if(r){this[pe].delete(i);for(let n of r)n.pending=!1,this[ai](n)}}this[Ft]()}[ai](t){if(t.pending&&t.pendingLink&&t===this[Et]&&(t.pending=!1,t.pendingLink=!1),!t.pending){if(t.entry){t===this[Et]&&!t.piped&&this[di](t);return}if(!t.stat){let e=this.statCache.get(t.absolute);e?this[li](t,e):this[ds](t)}if(t.stat&&!t.ignore){if(!this.noDirRecurse&&t.stat.isDirectory()&&!t.readdir){let e=this.readdirCache.get(t.absolute);if(e?this[fi](t,e):this[ms](t),!t.readdir)return}if(t.entry=this[hr](t),!t.entry){t.ignore=!0;return}t===this[Et]&&!t.piped&&this[di](t)}}}[cs](t){return{onwarn:(e,i,r)=>this.warn(e,i,r),noPax:this.noPax,cwd:this.cwd,absolute:t.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[hr](t){this[G]+=1;try{return new this[mi](t.path,this[cs](t)).on("end",()=>this[ls](t)).on("error",i=>this.emit("error",i))}catch(e){this.emit("error",e)}}[fs](){this[Et]&&this[Et].entry&&this[Et].entry.resume()}[di](t){t.piped=!0,t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)});let e=t.entry,i=this.zip;if(!e)throw new Error("cannot pipe without source");i?e.on("data",r=>{i.write(r)||e.pause()}):e.on("data",r=>{super.write(r)||e.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(t,e,i={}){Dt(this,t,e,i)}},kt=class extends wt{sync=!0;constructor(t){super(t),this[mi]=ni}pause(){}resume(){}[ds](t){let e=this.follow?"statSync":"lstatSync";this[li](t,ui[e](t.absolute))}[ms](t){this[fi](t,ui.readdirSync(t.absolute))}[di](t){let e=t.entry,i=this.zip;if(t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)}),!e)throw new Error("Cannot pipe without source");i?e.on("data",r=>{i.write(r)}):e.on("data",r=>{super[lr](r)})}};var Vn=(s,t)=>{let e=new kt(s),i=new Wt(s.file,{mode:s.mode||438});e.pipe(i),fr(e,t)},$n=(s,t)=>{let e=new wt(s),i=new et(s.file,{mode:s.mode||438});e.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),e.on("error",o)});return dr(e,t).catch(n=>e.emit("error",n)),r},fr=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:cr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},dr=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:cr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(e);s.end()},Xn=(s,t)=>{let e=new kt(s);return fr(e,t),e},qn=(s,t)=>{let e=new wt(s);return dr(e,t).catch(i=>e.emit("error",i)),e},Qn=K(Vn,$n,Xn,qn,(s,t)=>{if(!t?.length)throw new TypeError("no paths specified to add to archive")});import Br from"node:fs";import co from"node:assert";import{randomBytes as Mr}from"node:crypto";import m from"node:fs";import R from"node:path";import pr from"fs";var Jn=process.env.__FAKE_PLATFORM__||process.platform,Er=Jn==="win32",{O_CREAT:wr,O_NOFOLLOW:mr,O_TRUNC:Sr,O_WRONLY:yr}=pr.constants,Rr=Number(process.env.__FAKE_FS_O_FILENAME__)||pr.constants.UV_FS_O_FILEMAP||0,jn=Er&&!!Rr,to=512*1024,eo=Rr|Sr|wr|yr,ur=!Er&&typeof mr=="number"?mr|Sr|wr|yr:null,us=ur!==null?()=>ur:jn?s=>s<to?eo:"w":()=>"w";import wi from"node:fs";import we from"node:path";var ps=(s,t,e)=>{try{return wi.lchownSync(s,t,e)}catch(i){if(i?.code!=="ENOENT")throw i}},Ei=(s,t,e,i)=>{wi.lchown(s,t,e,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},io=(s,t,e,i,r)=>{if(t.isDirectory())Es(we.resolve(s,t.name),e,i,n=>{if(n)return r(n);let o=we.resolve(s,t.name);Ei(o,e,i,r)});else{let n=we.resolve(s,t.name);Ei(n,e,i,r)}},Es=(s,t,e,i)=>{wi.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return Ei(s,t,e,i);let o=n.length,h=null,a=l=>{if(!h){if(l)return i(h=l);if(--o===0)return Ei(s,t,e,i)}};for(let l of n)io(s,l,t,e,a)})},so=(s,t,e,i)=>{t.isDirectory()&&ws(we.resolve(s,t.name),e,i),ps(we.resolve(s,t.name),e,i)},ws=(s,t,e)=>{let i;try{i=wi.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return ps(s,t,e);throw n}for(let r of i)so(s,r,t,e);return ps(s,t,e)};import k from"node:fs";import ro from"node:fs/promises";import Si from"node:path";var Se=class extends Error{path;code;syscall="chdir";constructor(t,e){super(`${e}: Cannot cd into '${t}'`),this.path=t,this.code=e}get name(){return"CwdError"}};var St=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(t,e){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=t,this.path=e}get name(){return"SymlinkError"}};var no=(s,t)=>{k.stat(s,(e,i)=>{(e||!i.isDirectory())&&(e=new Se(s,e?.code||"ENOTDIR")),t(e)})},gr=(s,t,e)=>{s=f(s);let i=t.umask??18,r=t.mode|448,n=(r&i)!==0,o=t.uid,h=t.gid,a=typeof o=="number"&&typeof h=="number"&&(o!==t.processUid||h!==t.processGid),l=t.preserve,c=t.unlink,d=f(t.cwd),S=(E,x)=>{E?e(E):x&&a?Es(x,o,h,Le=>S(Le)):n?k.chmod(s,r,e):e()};if(s===d)return no(s,S);if(l)return ro.mkdir(s,{mode:r,recursive:!0}).then(E=>S(null,E??void 0),S);let D=f(Si.relative(d,s)).split("/");Ss(d,D,r,c,d,void 0,S)},Ss=(s,t,e,i,r,n,o)=>{if(t.length===0)return o(null,n);let h=t.shift(),a=f(Si.resolve(s+"/"+h));k.mkdir(a,e,br(a,t,e,i,r,n,o))},br=(s,t,e,i,r,n,o)=>h=>{h?k.lstat(s,(a,l)=>{if(a)a.path=a.path&&f(a.path),o(a);else if(l.isDirectory())Ss(s,t,e,i,r,n,o);else if(i)k.unlink(s,c=>{if(c)return o(c);k.mkdir(s,e,br(s,t,e,i,r,n,o))});else{if(l.isSymbolicLink())return o(new St(s,s+"/"+t.join("/")));o(h)}}):(n=n||s,Ss(s,t,e,i,r,n,o))},oo=s=>{let t=!1,e;try{t=k.statSync(s).isDirectory()}catch(i){e=i?.code}finally{if(!t)throw new Se(s,e??"ENOTDIR")}},_r=(s,t)=>{s=f(s);let e=t.umask??18,i=t.mode|448,r=(i&e)!==0,n=t.uid,o=t.gid,h=typeof n=="number"&&typeof o=="number"&&(n!==t.processUid||o!==t.processGid),a=t.preserve,l=t.unlink,c=f(t.cwd),d=E=>{E&&h&&ws(E,n,o),r&&k.chmodSync(s,i)};if(s===c)return oo(c),d();if(a)return d(k.mkdirSync(s,{mode:i,recursive:!0})??void 0);let T=f(Si.relative(c,s)).split("/"),D;for(let E=T.shift(),x=c;E&&(x+="/"+E);E=T.shift()){x=f(Si.resolve(x));try{k.mkdirSync(x,i),D=D||x}catch{let Le=k.lstatSync(x);if(Le.isDirectory())continue;if(l){k.unlinkSync(x),k.mkdirSync(x,i),D=D||x;continue}else if(Le.isSymbolicLink())return new St(x,x+"/"+T.join("/"))}}return d(D)};import{join as xr}from"node:path";var ys=Object.create(null),Or=1e4,Vt=new Set,Tr=s=>{Vt.has(s)?Vt.delete(s):ys[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),Vt.add(s);let t=ys[s],e=Vt.size-Or;if(e>Or/10){for(let i of Vt)if(Vt.delete(i),delete ys[i],--e<=0)break}return t};var ho=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,ao=ho==="win32",lo=s=>s.split("/").slice(0,-1).reduce((e,i)=>{let r=e.at(-1);return r!==void 0&&(i=xr(r,i)),e.push(i||"/"),e},[]),yi=class{#t=new Map;#i=new Map;#s=new Set;reserve(t,e){t=ao?["win32 parallelization disabled"]:t.map(r=>ut(xr(Tr(r))));let i=new Set(t.map(r=>lo(r)).reduce((r,n)=>r.concat(n)));this.#i.set(e,{dirs:i,paths:t});for(let r of t){let n=this.#t.get(r);n?n.push(e):this.#t.set(r,[e])}for(let r of i){let n=this.#t.get(r);if(!n)this.#t.set(r,[new Set([e])]);else{let o=n.at(-1);o instanceof Set?o.add(e):n.push(new Set([e]))}}return this.#r(e)}#n(t){let e=this.#i.get(t);if(!e)throw new Error("function does not have any path reservations");return{paths:e.paths.map(i=>this.#t.get(i)),dirs:[...e.dirs].map(i=>this.#t.get(i))}}check(t){let{paths:e,dirs:i}=this.#n(t);return e.every(r=>r&&r[0]===t)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(t))}#r(t){return this.#s.has(t)||!this.check(t)?!1:(this.#s.add(t),t(()=>this.#e(t)),!0)}#e(t){if(!this.#s.has(t))return!1;let e=this.#i.get(t);if(!e)throw new Error("invalid reservation");let{paths:i,dirs:r}=e,n=new Set;for(let o of i){let h=this.#t.get(o);if(!h||h?.[0]!==t)continue;let a=h[1];if(!a){this.#t.delete(o);continue}if(h.shift(),typeof a=="function")n.add(a);else for(let l of a)n.add(l)}for(let o of r){let h=this.#t.get(o),a=h?.[0];if(!(!h||!(a instanceof Set)))if(a.size===1&&h.length===1){this.#t.delete(o);continue}else if(a.size===1){h.shift();let l=h[0];typeof l=="function"&&n.add(l)}else a.delete(t)}return this.#s.delete(t),n.forEach(o=>this.#r(o)),!0}};var Lr=()=>process.umask();var Dr=Symbol("onEntry"),_s=Symbol("checkFs"),Nr=Symbol("checkFs2"),Os=Symbol("isReusable"),P=Symbol("makeFs"),Ts=Symbol("file"),xs=Symbol("directory"),gi=Symbol("link"),Ar=Symbol("symlink"),Ir=Symbol("hardlink"),Re=Symbol("ensureNoSymlink"),Cr=Symbol("unsupported"),Fr=Symbol("checkPath"),Rs=Symbol("stripAbsolutePath"),yt=Symbol("mkdir"),O=Symbol("onError"),Ri=Symbol("pending"),kr=Symbol("pend"),$t=Symbol("unpend"),gs=Symbol("ended"),bs=Symbol("maybeClose"),Ls=Symbol("skip"),ge=Symbol("doChown"),be=Symbol("uid"),_e=Symbol("gid"),Oe=Symbol("checkedCwd"),fo=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,Te=fo==="win32",mo=1024,uo=(s,t)=>{if(!Te)return m.unlink(s,t);let e=s+".DELETE."+Mr(16).toString("hex");m.rename(s,e,i=>{if(i)return t(i);m.unlink(e,t)})},po=s=>{if(!Te)return m.unlinkSync(s);let t=s+".DELETE."+Mr(16).toString("hex");m.renameSync(s,t),m.unlinkSync(t)},vr=(s,t,e)=>s!==void 0&&s===s>>>0?s:t!==void 0&&t===t>>>0?t:e,Xt=class extends rt{[gs]=!1;[Oe]=!1;[Ri]=0;reservations=new yi;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(t={}){if(t.ondone=()=>{this[gs]=!0,this[bs]()},super(t),this.transform=t.transform,this.chmod=!!t.chmod,typeof t.uid=="number"||typeof t.gid=="number"){if(typeof t.uid!="number"||typeof t.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(t.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=t.uid,this.gid=t.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=t.preserveOwner===void 0&&typeof t.uid!="number"?process.getuid?.()===0:!!t.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof t.maxDepth=="number"?t.maxDepth:mo,this.forceChown=t.forceChown===!0,this.win32=!!t.win32||Te,this.newer=!!t.newer,this.keep=!!t.keep,this.noMtime=!!t.noMtime,this.preservePaths=!!t.preservePaths,this.unlink=!!t.unlink,this.cwd=f(R.resolve(t.cwd||process.cwd())),this.strip=Number(t.strip)||0,this.processUmask=this.chmod?typeof t.processUmask=="number"?t.processUmask:Lr():0,this.umask=typeof t.umask=="number"?t.umask:this.processUmask,this.dmode=t.dmode||511&~this.umask,this.fmode=t.fmode||438&~this.umask,this.on("entry",e=>this[Dr](e))}warn(t,e,i={}){return(t==="TAR_BAD_ARCHIVE"||t==="TAR_ABORT")&&(i.recoverable=!1),super.warn(t,e,i)}[bs](){this[gs]&&this[Ri]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[Rs](t,e){let i=t[e],{type:r}=t;if(!i||this.preservePaths)return!0;let[n,o]=ce(i),h=o.replaceAll(/\\/g,"/").split("/");if(h.includes("..")||Te&&/^[a-z]:\.\.$/i.test(h[0]??"")){if(e==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${e} contains '..'`,{entry:t,[e]:i}),!1;let a=R.posix.dirname(t.path),l=R.posix.normalize(R.posix.join(a,h.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${e} escapes extraction directory`,{entry:t,[e]:i}),!1}return n&&(t[e]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${e}`,{entry:t,[e]:i})),!0}[Fr](t){let e=f(t.path),i=e.split("/");if(this.strip){if(i.length<this.strip)return!1;if(t.type==="Link"){let r=f(String(t.linkpath)).split("/");if(r.length>=this.strip)t.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),t.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:t,path:e,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[Rs](t,"path")||!this[Rs](t,"linkpath"))return!1;if(t.absolute=R.isAbsolute(t.path)?f(R.resolve(t.path)):f(R.resolve(this.cwd,t.path)),!this.preservePaths&&typeof t.absolute=="string"&&t.absolute.indexOf(this.cwd+"/")!==0&&t.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:t,path:f(t.path),resolvedPath:t.absolute,cwd:this.cwd}),!1;if(t.absolute===this.cwd&&t.type!=="Directory"&&t.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=R.win32.parse(String(t.absolute));t.absolute=r+ts(String(t.absolute).slice(r.length));let{root:n}=R.win32.parse(t.path);t.path=n+ts(t.path.slice(n.length))}return!0}[Dr](t){if(!this[Fr](t))return t.resume();switch(co.equal(typeof t.absolute,"string"),t.type){case"Directory":case"GNUDumpDir":t.mode&&(t.mode=t.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[_s](t);default:return this[Cr](t)}}[O](t,e){t.name==="CwdError"?this.emit("error",t):(this.warn("TAR_ENTRY_ERROR",t,{entry:e}),this[$t](),e.resume())}[yt](t,e,i){gr(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e},i)}[ge](t){return this.forceChown||this.preserveOwner&&(typeof t.uid=="number"&&t.uid!==this.processUid||typeof t.gid=="number"&&t.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[be](t){return vr(this.uid,t.uid,this.processUid)}[_e](t){return vr(this.gid,t.gid,this.processGid)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=new et(String(t.absolute),{flags:us(t.size),mode:i,autoClose:!1});r.on("error",a=>{r.fd&&m.close(r.fd,()=>{}),r.write=()=>!0,this[O](a,t),e()});let n=1,o=a=>{if(a){r.fd&&m.close(r.fd,()=>{}),this[O](a,t),e();return}--n===0&&r.fd!==void 0&&m.close(r.fd,l=>{l?this[O](l,t):this[$t](),e()})};r.on("finish",()=>{let a=String(t.absolute),l=r.fd;if(typeof l=="number"&&t.mtime&&!this.noMtime){n++;let c=t.atime||new Date,d=t.mtime;m.futimes(l,c,d,S=>S?m.utimes(a,c,d,T=>o(T&&S)):o())}if(typeof l=="number"&&this[ge](t)){n++;let c=this[be](t),d=this[_e](t);typeof c=="number"&&typeof d=="number"&&m.fchown(l,c,d,S=>S?m.chown(a,c,d,T=>o(T&&S)):o())}o()});let h=this.transform&&this.transform(t)||t;h!==t&&(h.on("error",a=>{this[O](a,t),e()}),t.pipe(h)),h.pipe(r)}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode;this[yt](String(t.absolute),i,r=>{if(r){this[O](r,t),e();return}let n=1,o=()=>{--n===0&&(e(),this[$t](),t.resume())};t.mtime&&!this.noMtime&&(n++,m.utimes(String(t.absolute),t.atime||new Date,t.mtime,o)),this[ge](t)&&(n++,m.chown(String(t.absolute),Number(this[be](t)),Number(this[_e](t)),o)),o()})}[Cr](t){t.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${t.type}`,{entry:t}),t.resume()}[Ar](t,e){let i=f(R.relative(this.cwd,R.resolve(R.dirname(String(t.absolute)),String(t.linkpath)))).split("/");this[Re](t,this.cwd,i,()=>this[gi](t,String(t.linkpath),"symlink",e),r=>{this[O](r,t),e()})}[Ir](t,e){let i=f(R.resolve(this.cwd,String(t.linkpath))),r=f(String(t.linkpath)).split("/");this[Re](t,this.cwd,r,()=>this[gi](t,i,"link",e),n=>{this[O](n,t),e()})}[Re](t,e,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let h=R.resolve(e,o);m.lstat(h,(a,l)=>{if(a)return r();if(l?.isSymbolicLink())return n(new St(h,R.resolve(h,i.join("/"))));this[Re](t,h,i,r,n)})}[kr](){this[Ri]++}[$t](){this[Ri]--,this[bs]()}[Ls](t){this[$t](),t.resume()}[Os](t,e){return t.type==="File"&&!this.unlink&&e.isFile()&&e.nlink<=1&&!Te}[_s](t){this[kr]();let e=[t.path];t.linkpath&&e.push(t.linkpath),this.reservations.reserve(e,i=>this[Nr](t,i))}[Nr](t,e){let i=h=>{e(h)},r=()=>{this[yt](this.cwd,this.dmode,h=>{if(h){this[O](h,t),i();return}this[Oe]=!0,n()})},n=()=>{if(t.absolute!==this.cwd){let h=f(R.dirname(String(t.absolute)));if(h!==this.cwd)return this[yt](h,this.dmode,a=>{if(a){this[O](a,t),i();return}o()})}o()},o=()=>{m.lstat(String(t.absolute),(h,a)=>{if(a&&(this.keep||this.newer&&a.mtime>(t.mtime??a.mtime))){this[Ls](t),i();return}if(h||this[Os](t,a))return this[P](null,t,i);if(a.isDirectory()){if(t.type==="Directory"){let l=this.chmod&&t.mode&&(a.mode&4095)!==t.mode,c=d=>this[P](d??null,t,i);return l?m.chmod(String(t.absolute),Number(t.mode),c):c()}if(t.absolute!==this.cwd)return m.rmdir(String(t.absolute),l=>this[P](l??null,t,i))}if(t.absolute===this.cwd)return this[P](null,t,i);uo(String(t.absolute),l=>this[P](l??null,t,i))})};this[Oe]?n():r()}[P](t,e,i){if(t){this[O](t,e),i();return}switch(e.type){case"File":case"OldFile":case"ContiguousFile":return this[Ts](e,i);case"Link":return this[Ir](e,i);case"SymbolicLink":return this[Ar](e,i);case"Directory":case"GNUDumpDir":return this[xs](e,i)}}[gi](t,e,i,r){m[i](e,String(t.absolute),n=>{n?this[O](n,t):(this[$t](),t.resume()),r()})}},ye=s=>{try{return[null,s()]}catch(t){return[t,null]}},xe=class extends Xt{sync=!0;[P](t,e){return super[P](t,e,()=>{})}[_s](t){if(!this[Oe]){let n=this[yt](this.cwd,this.dmode);if(n)return this[O](n,t);this[Oe]=!0}if(t.absolute!==this.cwd){let n=f(R.dirname(String(t.absolute)));if(n!==this.cwd){let o=this[yt](n,this.dmode);if(o)return this[O](o,t)}}let[e,i]=ye(()=>m.lstatSync(String(t.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(t.mtime??i.mtime)))return this[Ls](t);if(e||this[Os](t,i))return this[P](null,t);if(i.isDirectory()){if(t.type==="Directory"){let o=this.chmod&&t.mode&&(i.mode&4095)!==t.mode,[h]=o?ye(()=>{m.chmodSync(String(t.absolute),Number(t.mode))}):[];return this[P](h,t)}let[n]=ye(()=>m.rmdirSync(String(t.absolute)));this[P](n,t)}let[r]=t.absolute===this.cwd?[]:ye(()=>po(String(t.absolute)));this[P](r,t)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=h=>{let a;try{m.closeSync(n)}catch(l){a=l}(h||a)&&this[O](h||a,t),e()},n;try{n=m.openSync(String(t.absolute),us(t.size),i)}catch(h){return r(h)}let o=this.transform&&this.transform(t)||t;o!==t&&(o.on("error",h=>this[O](h,t)),t.pipe(o)),o.on("data",h=>{try{m.writeSync(n,h,0,h.length)}catch(a){r(a)}}),o.on("end",()=>{let h=null;if(t.mtime&&!this.noMtime){let a=t.atime||new Date,l=t.mtime;try{m.futimesSync(n,a,l)}catch(c){try{m.utimesSync(String(t.absolute),a,l)}catch{h=c}}}if(this[ge](t)){let a=this[be](t),l=this[_e](t);try{m.fchownSync(n,Number(a),Number(l))}catch(c){try{m.chownSync(String(t.absolute),Number(a),Number(l))}catch{h=h||c}}}r(h)})}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode,r=this[yt](String(t.absolute),i);if(r){this[O](r,t),e();return}if(t.mtime&&!this.noMtime)try{m.utimesSync(String(t.absolute),t.atime||new Date,t.mtime)}catch{}if(this[ge](t))try{m.chownSync(String(t.absolute),Number(this[be](t)),Number(this[_e](t)))}catch{}e(),t.resume()}[yt](t,e){try{return _r(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e})}catch(i){return i}}[Re](t,e,i,r,n){if(this.preservePaths||i.length===0)return r();let o=e;for(let h of i){o=R.resolve(o,h);let[a,l]=ye(()=>m.lstatSync(o));if(a)return r();if(l.isSymbolicLink())return n(new St(o,R.resolve(e,i.join("/"))))}r()}[gi](t,e,i,r){let n=`${i}Sync`;try{m[n](e,String(t.absolute)),r(),t.resume()}catch(o){return this[O](o,t)}}};var Eo=s=>{let t=new xe(s),e=s.file,i=Br.statSync(e),r=s.maxReadSize||16*1024*1024;new Be(e,{readSize:r,size:i.size}).pipe(t)},wo=(s,t)=>{let e=new Xt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("close",o),Br.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},So=K(Eo,wo,s=>new xe(s),s=>new Xt(s),(s,t)=>{t?.length&&Qi(s,t)});import v from"node:fs";import Pr from"node:path";var yo=(s,t)=>{let e=new kt(s),i=!0,r,n;try{try{r=v.openSync(s.file,"r+")}catch(a){if(a?.code==="ENOENT")r=v.openSync(s.file,"w+");else throw a}let o=v.fstatSync(r),h=Buffer.alloc(512);t:for(n=0;n<o.size;n+=512){for(let c=0,d=0;c<512;c+=d){if(d=v.readSync(r,h,c,h.length-c,n+c),n===0&&h[0]===31&&h[1]===139)throw new Error("cannot append to compressed archives");if(!d)break t}let a=new F(h);if(!a.cksumValid)break;let l=512*Math.ceil((a.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&a.mtime&&s.mtimeCache.set(String(a.path),a.mtime)}i=!1,Ro(s,e,n,r,t)}finally{if(i)try{v.closeSync(r)}catch{}}},Ro=(s,t,e,i,r)=>{let n=new Wt(s.file,{fd:i,start:e});t.pipe(n),bo(t,r)},go=(s,t)=>{t=Array.from(t);let e=new wt(s),i=(n,o,h)=>{let a=(T,D)=>{T?v.close(n,E=>h(T)):h(null,D)},l=0;if(o===0)return a(null,0);let c=0,d=Buffer.alloc(512),S=(T,D)=>{if(T||D===void 0)return a(T);if(c+=D,c<512&&D)return v.read(n,d,c,d.length-c,l+c,S);if(l===0&&d[0]===31&&d[1]===139)return a(new Error("cannot append to compressed archives"));if(c<512)return a(null,l);let E=new F(d);if(!E.cksumValid)return a(null,l);let x=512*Math.ceil((E.size??0)/512);if(l+x+512>o||(l+=x+512,l>=o))return a(null,l);s.mtimeCache&&E.mtime&&s.mtimeCache.set(String(E.path),E.mtime),c=0,v.read(n,d,0,512,l,S)};v.read(n,d,0,512,l,S)};return new Promise((n,o)=>{e.on("error",o);let h="r+",a=(l,c)=>{if(l&&l.code==="ENOENT"&&h==="r+")return h="w+",v.open(s.file,h,a);if(l||!c)return o(l);v.fstat(c,(d,S)=>{if(d)return v.close(c,()=>o(d));i(c,S.size,(T,D)=>{if(T)return o(T);let E=new et(s.file,{fd:c,start:D});e.pipe(E),E.on("error",o),E.on("close",n),_o(e,t)})})};v.open(s.file,h,a)})},bo=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:Pr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},_o=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:Pr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e);s.end()},vt=K(yo,go,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,t)=>{if(!Bs(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!t?.length)throw new TypeError("no paths specified to add/replace")});var Oo=K(vt.syncFile,vt.asyncFile,vt.syncNoFile,vt.asyncNoFile,(s,t=[])=>{vt.validate?.(s,t),To(s)}),To=s=>{let t=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=t?(e,i)=>t(e,i)&&!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0)):(e,i)=>!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0))};export{F as Header,wt as Pack,pi as PackJob,kt as PackSync,rt as Parser,ft as Pax,$e as ReadEntry,Xt as Unpack,xe as UnpackSync,de as WriteEntry,ni as WriteEntrySync,oi as WriteEntryTar,Qn as c,Qn as create,So as extract,Qi as filesFilter,Ct as list,vt as r,vt as replace,Ct as t,Hi as types,Oo as u,Oo as update,So as x};
+`).reduce(xn,Object.create(null)),xn=(s,t)=>{let e=parseInt(t,10);if(e!==Buffer.byteLength(t)+1)return s;t=t.slice((e+" ").length);let i=t.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let h=+o;h>=0&&(s[n]=h);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s};var Ln=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,f=Ln!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/");var $e=class extends A{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(t,e,i){switch(super({}),this.pause(),this.extended=e,this.globalExtended=i,this.header=t,this.remain=t.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=t.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!t.path)throw new Error("no path provided for tar.ReadEntry");this.path=f(t.path),this.mode=t.mode,this.mode&&(this.mode=this.mode&4095),this.uid=t.uid,this.gid=t.gid,this.uname=t.uname,this.gname=t.gname,this.size=this.remain,this.mtime=t.mtime,this.atime=t.atime,this.ctime=t.ctime,this.linkpath=t.linkpath?f(t.linkpath):void 0,this.uname=t.uname,this.gname=t.gname,e&&this.#t(e),i&&this.#t(i,!0)}write(t){let e=t.length;if(e>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-e),this.blockRemain=Math.max(0,r-e),this.ignore?!0:i>=e?super.write(t):super.write(t.subarray(0,i))}#t(t,e=!1){t.path&&(t.path=f(t.path)),t.linkpath&&(t.linkpath=f(t.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="path"&&e))))}};var Dt=(s,t,e,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=e instanceof Error&&e.code||t,i.tarCode=t,!s.strict&&i.recoverable!==!1?(e instanceof Error&&(i=Object.assign(e,i),e=e.message),s.emit("warn",t,e,i)):e instanceof Error?s.emit("error",Object.assign(e,i)):s.emit("error",Object.assign(new Error(`${t}: ${e}`),i))};var Nn=1024*1024,Xi=Buffer.from([31,139]),qi=Buffer.from([40,181,47,253]),An=Math.max(Xi.length,qi.length),B=Symbol("state"),Nt=Symbol("writeEntry"),it=Symbol("readEntry"),Zi=Symbol("nextEntry"),Zs=Symbol("processEntry"),V=Symbol("extendedHeader"),he=Symbol("globalExtendedHeader"),dt=Symbol("meta"),Ys=Symbol("emitMeta"),p=Symbol("buffer"),st=Symbol("queue"),ut=Symbol("ended"),Yi=Symbol("emittedEnd"),At=Symbol("emit"),w=Symbol("unzip"),Xe=Symbol("consumeChunk"),qe=Symbol("consumeChunkSub"),Ki=Symbol("consumeBody"),Ks=Symbol("consumeMeta"),Vs=Symbol("consumeHeader"),ae=Symbol("consuming"),Vi=Symbol("bufferConcat"),Qe=Symbol("maybeEnd"),Yt=Symbol("writing"),$=Symbol("aborted"),Je=Symbol("onDone"),It=Symbol("sawValidEntry"),je=Symbol("sawNullBlock"),ti=Symbol("sawEOF"),$s=Symbol("closeStream"),In=1e3,le=Symbol("compressedBytesRead"),$i=Symbol("decompressedBytesRead"),Xs=Symbol("checkDecompressionRatio"),Cn=()=>!0,rt=class extends Dn{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[st]=[];[p];[it];[Nt];[B]="begin";[dt]="";[V];[he];[ut]=!1;[w];[$]=!1;[It];[je]=!1;[ti]=!1;[Yt]=!1;[ae]=!1;[Yi]=!1;[le]=0;[$i]=0;constructor(t={}){super(),this.file=t.file||"",this.on(Je,()=>{(this[B]==="begin"||this[It]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),t.ondone?this.on(Je,t.ondone):this.on(Je,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!t.strict,this.maxDecompressionRatio=typeof t.maxDecompressionRatio=="number"?t.maxDecompressionRatio:In,this.maxMetaEntrySize=t.maxMetaEntrySize||Nn,this.filter=typeof t.filter=="function"?t.filter:Cn;let e=t.file&&(t.file.endsWith(".tar.br")||t.file.endsWith(".tbr"));this.brotli=!(t.gzip||t.zstd)&&t.brotli!==void 0?t.brotli:e?void 0:!1;let i=t.file&&(t.file.endsWith(".tar.zst")||t.file.endsWith(".tzst"));this.zstd=!(t.gzip||t.brotli)&&t.zstd!==void 0?t.zstd:i?!0:void 0,this.on("end",()=>this[$s]()),typeof t.onwarn=="function"&&this.on("warn",t.onwarn),typeof t.onReadEntry=="function"&&this.on("entry",t.onReadEntry)}warn(t,e,i={}){Dt(this,t,e,i)}[Vs](t,e){this[It]===void 0&&(this[It]=!1);let i;try{i=new F(t,e,this[V],this[he])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[je]?(this[ti]=!0,this[B]==="begin"&&(this[B]="header"),this[At]("eof")):(this[je]=!0,this[At]("nullBlock"));else if(this[je]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[Nt]=new $e(i,this[V],this[he]);if(!this[It])if(n.remain){let o=()=>{n.invalid||(this[It]=!0)};n.on("end",o)}else this[It]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[At]("ignoredEntry",n),this[B]="ignore",n.resume()):n.size>0&&(this[dt]="",n.on("data",o=>this[dt]+=o),this[B]="meta"):(this[V]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[At]("ignoredEntry",n),this[B]=n.remain?"ignore":"header",n.resume()):(n.remain?this[B]="body":(this[B]="header",n.end()),this[it]?this[st].push(n):(this[st].push(n),this[Zi]())))}}}[$s](){queueMicrotask(()=>this.emit("close"))}[Zs](t){let e=!0;if(!t)this[it]=void 0,e=!1;else if(Array.isArray(t)){let[i,...r]=t;this.emit(i,...r)}else this[it]=t,this.emit("entry",t),t.emittedEnd||(t.on("end",()=>this[Zi]()),e=!1);return e}[Zi](){do;while(this[Zs](this[st].shift()));if(this[st].length===0){let t=this[it];!t||t.flowing||t.size===t.remain?this[Yt]||this.emit("drain"):t.once("drain",()=>this.emit("drain"))}}[Ki](t,e){let i=this[Nt];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=t.length&&e===0?t:t.subarray(e,e+r);return i.write(n),i.blockRemain||(this[B]="header",this[Nt]=void 0,i.end()),n.length}[Ks](t,e){let i=this[Nt],r=this[Ki](t,e);return!this[Nt]&&i&&this[Ys](i),r}[At](t,e,i){this[st].length===0&&!this[it]?this.emit(t,e,i):this[st].push([t,e,i])}[Ys](t){switch(this[At]("meta",this[dt]),t.type){case"ExtendedHeader":case"OldExtendedHeader":this[V]=ft.parse(this[dt],this[V],!1);break;case"GlobalExtendedHeader":this[he]=ft.parse(this[dt],this[he],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let e=this[V]??Object.create(null);this[V]=e,e.path=this[dt].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let e=this[V]||Object.create(null);this[V]=e,e.linkpath=this[dt].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+t.type)}}abort(t){if(!this[$]){if(this[w]){let e=this[w];e.write=()=>!0,e.end=()=>e,e.emit=()=>!1,e.destroy?.()}this[$]=!0,this.emit("abort",t),this.warn("TAR_ABORT",t,{recoverable:!1})}}[Xs](t){this[$i]+=t.length;let e=this[$i]/this[le];return e>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${e.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this[$])return i?.(),!1;if((this[w]===void 0||this.brotli===void 0&&this[w]===!1)&&t){if(this[p]&&(t=Buffer.concat([this[p],t]),this[p]=void 0),t.length<An)return this[p]=t,i?.(),!0;for(let a=0;this[w]===void 0&&a<Xi.length;a++)t[a]!==Xi[a]&&(this[w]=!1);let o=!1;if(this[w]===!1&&this.zstd!==!1){o=!0;for(let a=0;a<qi.length;a++)if(t[a]!==qi[a]){o=!1;break}}let h=this.brotli===void 0&&!o;if(this[w]===!1&&h)if(t.length<512)if(this[ut])this.brotli=!0;else return this[p]=t,i?.(),!0;else try{new F(t.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[w]===void 0||this[w]===!1&&(this.brotli||o)){let a=this[ut];this[ut]=!1,this[w]=this[w]===void 0?new Ue({}):o?new Ke({}):new Ge({}),this[w].on("data",c=>{this[Xs](c)&&this[Xe](c)}),this[w].on("error",c=>{this[$]||this.abort(c)}),this[w].on("end",()=>{this[ut]=!0,this[Xe]()}),this[Yt]=!0,this[le]+=t.length;let l=!!this[w][a?"end":"write"](t);return this[Yt]=!1,i?.(),l}}this[Yt]=!0,this[w]?(this[le]+=t.length,this[w].write(t)):this[Xe](t),this[Yt]=!1;let n=this[st].length>0?!1:this[it]?this[it].flowing:!0;return!n&&this[st].length===0&&this[it]?.once("drain",()=>this.emit("drain")),i?.(),n}[Vi](t){t&&!this[$]&&(this[p]=this[p]?Buffer.concat([this[p],t]):t)}[Qe](){if(this[ut]&&!this[Yi]&&!this[$]&&!this[ae]){this[Yi]=!0;let t=this[Nt];if(t?.blockRemain){let e=this[p]?this[p].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${t.blockRemain} more bytes, only ${e} available)`,{entry:t}),this[p]&&t.write(this[p]),t.end()}this[At](Je)}}[Xe](t){if(this[ae]&&t)this[Vi](t);else if(!t&&!this[p])this[Qe]();else if(t){if(this[ae]=!0,this[p]){this[Vi](t);let e=this[p];this[p]=void 0,this[qe](e)}else this[qe](t);for(;this[p]&&this[p]?.length>=512&&!this[$]&&!this[ti];){let e=this[p];this[p]=void 0,this[qe](e)}this[ae]=!1}(!this[p]||this[ut])&&this[Qe]()}[qe](t){let e=0,i=t.length;for(;e+512<=i&&!this[$]&&!this[ti];)switch(this[B]){case"begin":case"header":this[Vs](t,e),e+=512;break;case"ignore":case"body":e+=this[Ki](t,e);break;case"meta":e+=this[Ks](t,e);break;default:throw new Error("invalid state: "+this[B])}e<i&&(this[p]=this[p]?Buffer.concat([t.subarray(e),this[p]]):t.subarray(e))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e)),i&&this.once("finish",i),this[$]||(this[w]?(t&&(this[le]+=t.length,this[w].write(t)),this[w].end()):(this[ut]=!0,(this.brotli===void 0||this.zstd===void 0)&&(t=t||Buffer.alloc(0)),t&&this.write(t),this[Qe]())),this}};var mt=s=>{let t=s.length-1,e=-1;for(;t>-1&&s.charAt(t)==="/";)e=t,t--;return e===-1?s:s.slice(0,e)};var vn=s=>{let t=s.onReadEntry;s.onReadEntry=t?e=>{t(e),e.resume()}:e=>e.resume()},Qi=(s,t)=>{let e=new Map(t.map(o=>[mt(o),!0])),i=s.filter,r=100,n=(o,h="",a=0)=>{if(a>=r)return e.set(o,!1),!1;let l=h||kn(o).root||".",c;if(o===l)c=!1;else{let d=e.get(o);c=d!==void 0?d:n(Fn(o),l,a+1)}return e.set(o,c),c};s.filter=i?(o,h)=>i(o,h)&&n(mt(o)):o=>n(mt(o))},Mn=s=>{let t=new rt(s),e=s.file,i;try{i=Kt.openSync(e,"r");let r=Kt.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),h=Kt.readSync(i,o,0,r.size,0);t.end(h===o.byteLength?o:o.subarray(0,h))}else{let o=0,h=Buffer.allocUnsafe(n);for(;o<r.size;){let a=Kt.readSync(i,h,0,n,o);if(a===0)break;o+=a,t.write(h.subarray(0,a))}t.end()}}finally{if(typeof i=="number")try{Kt.closeSync(i)}catch{}}},Bn=(s,t)=>{let e=new rt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("end",o),Kt.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},Ct=K(Mn,Bn,s=>new rt(s),s=>new rt(s),(s,t)=>{t?.length&&Qi(s,t),s.noResume||vn(s)});import mi from"fs";import X from"fs";import js from"path";var Ji=(s,t,e)=>(s&=4095,e&&(s=(s|384)&-19),t&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);import{win32 as Pn}from"node:path";var{isAbsolute:zn,parse:qs}=Pn,ce=s=>{let t="",e=qs(s);for(;zn(s)||e.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":e.root;s=s.slice(i.length),t+=i,e=qs(s)}return[t,s]};var ei=["|","<",">","?",":"],ji=ei.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),Un=new Map(ei.map((s,t)=>[s,ji[t]])),Hn=new Map(ji.map((s,t)=>[s,ei[t]])),ts=s=>ei.reduce((t,e)=>t.split(e).join(Un.get(e)),s),Qs=s=>ji.reduce((t,e)=>t.split(e).join(Hn.get(e)),s);var rr=(s,t)=>t?(s=f(s).replace(/^\.(\/|$)/,""),mt(t)+"/"+s):f(s),Wn=16*1024*1024,tr=Symbol("process"),er=Symbol("file"),ir=Symbol("directory"),is=Symbol("symlink"),sr=Symbol("hardlink"),fe=Symbol("header"),ii=Symbol("read"),ss=Symbol("lstat"),si=Symbol("onlstat"),rs=Symbol("onread"),ns=Symbol("onreadlink"),os=Symbol("openfile"),hs=Symbol("onopenfile"),pt=Symbol("close"),ri=Symbol("mode"),as=Symbol("awaitDrain"),es=Symbol("ondrain"),q=Symbol("prefix"),de=class extends A{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#t=!1;constructor(t,e={}){let i=se(e);super(),this.path=f(t),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||Wn,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=f(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?f(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,h]=ce(this.path);o&&typeof h=="string"&&(this.path=h,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=Qs(this.path.replaceAll(/\\/g,"/")),t=t.replaceAll(/\\/g,"/")),this.absolute=f(i.absolute||js.resolve(this.cwd,t)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[si](n):this[ss]()}warn(t,e,i={}){return Dt(this,t,e,i)}emit(t,...e){return t==="error"&&(this.#t=!0),super.emit(t,...e)}[ss](){X.lstat(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[si](e)})}[si](t){this.statCache.set(this.absolute,t),this.stat=t,t.isFile()||(t.size=0),this.type=Gn(t),this.emit("stat",t),this[tr]()}[tr](){switch(this.type){case"File":return this[er]();case"Directory":return this[ir]();case"SymbolicLink":return this[is]();default:return this.end()}}[ri](t){return Ji(t,this.type==="Directory",this.portable)}[q](t){return rr(t,this.prefix)}[fe](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this[ri](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let t=this.header?.block;if(!t)throw new Error("failed to encode header");super.write(t)}[ir](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[fe](),this.end()}[is](){X.readlink(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[ns](e)})}[ns](t){this.linkpath=f(t),this[fe](),this.end()}[sr](t){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=f(js.relative(this.cwd,t)),this.stat.size=0,this[fe](),this.end()}[er](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let t=`${this.stat.dev}:${this.stat.ino}`,e=this.linkCache.get(t);if(e?.indexOf(this.cwd)===0)return this[sr](e);this.linkCache.set(t,this.absolute)}if(this[fe](),this.stat.size===0)return this.end();this[os]()}[os](){X.open(this.absolute,"r",(t,e)=>{if(t)return this.emit("error",t);this[hs](e)})}[hs](t){if(this.fd=t,this.#t)return this[pt]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let e=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(e),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[ii]()}[ii](){let{fd:t,buf:e,offset:i,length:r,pos:n}=this;if(t===void 0||e===void 0)throw new Error("cannot read file without first opening");X.read(t,e,i,r,n,(o,h)=>{if(o)return this[pt](()=>this.emit("error",o));this[rs](h)})}[pt](t=()=>{}){this.fd!==void 0&&X.close(this.fd,t)}[rs](t){if(t<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(t>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(t===this.remain)for(let r=t;r<this.length&&t<this.blockRemain;r++)this.buf[r+this.offset]=0,t++,this.remain++;let e=this.offset===0&&t===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+t);this.write(e)?this[es]():this[as](()=>this[es]())}[as](t){this.once("drain",t)}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this.blockRemain<t.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=t.length,this.blockRemain-=t.length,this.pos+=t.length,this.offset+=t.length,super.write(t,null,i)}[es](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[pt](t=>t?this.emit("error",t):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[ii]()}},ni=class extends de{sync=!0;[ss](){this[si](X.lstatSync(this.absolute))}[is](){this[ns](X.readlinkSync(this.absolute))}[os](){this[hs](X.openSync(this.absolute,"r"))}[ii](){let t=!0;try{let{fd:e,buf:i,offset:r,length:n,pos:o}=this;if(e===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let h=X.readSync(e,i,r,n,o);this[rs](h),t=!1}finally{if(t)try{this[pt](()=>{})}catch{}}}[as](t){t()}[pt](t=()=>{}){this.fd!==void 0&&X.closeSync(this.fd),t()}},oi=class extends A{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(t,e,i={}){return Dt(this,t,e,i)}constructor(t,e={}){let i=se(e);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=t;let{type:r}=t;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=f(t.path),this.mode=t.mode!==void 0?this[ri](t.mode):void 0,this.uid=this.portable?void 0:t.uid,this.gid=this.portable?void 0:t.gid,this.uname=this.portable?void 0:t.uname,this.gname=this.portable?void 0:t.gname,this.size=t.size,this.mtime=this.noMtime?void 0:i.mtime||t.mtime,this.atime=this.portable?void 0:t.atime,this.ctime=this.portable?void 0:t.ctime,this.linkpath=t.linkpath!==void 0?f(t.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[h,a]=ce(this.path);h&&typeof a=="string"&&(this.path=a,n=h)}this.remain=t.size,this.blockRemain=t.startBlockSize,this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),t.pipe(this)}[q](t){return rr(t,this.prefix)}[ri](t){return Ji(t,this.type==="Directory",this.portable)}write(t,e,i){typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8"));let r=t.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(t,i)}end(t,e,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e??"utf8")),i&&this.once("finish",i),t?super.end(t,i):super.end(i),this}},Gn=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported";var hi=class s{tail;head;length=0;static create(t=[]){return new s(t)}constructor(t=[]){for(let e of t)this.push(e)}*[Symbol.iterator](){for(let t=this.head;t;t=t.next)yield t.value}removeNode(t){if(t.list!==this)throw new Error("removing node which does not belong to this list");let e=t.next,i=t.prev;return e&&(e.prev=i),i&&(i.next=e),t===this.head&&(this.head=e),t===this.tail&&(this.tail=i),this.length--,t.next=void 0,t.prev=void 0,t.list=void 0,e}unshiftNode(t){if(t===this.head)return;t.list&&t.list.removeNode(t);let e=this.head;t.list=this,t.next=e,e&&(e.prev=t),this.head=t,this.tail||(this.tail=t),this.length++}pushNode(t){if(t===this.tail)return;t.list&&t.list.removeNode(t);let e=this.tail;t.list=this,t.prev=e,e&&(e.next=t),this.tail=t,this.head||(this.head=t),this.length++}push(...t){for(let e=0,i=t.length;e<i;e++)Yn(this,t[e]);return this.length}unshift(...t){for(var e=0,i=t.length;e<i;e++)Kn(this,t[e]);return this.length}pop(){if(!this.tail)return;let t=this.tail.value,e=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,e.list=void 0,this.length--,t}shift(){if(!this.head)return;let t=this.head.value,e=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,e.list=void 0,this.length--,t}forEach(t,e){e=e||this;for(let i=this.head,r=0;i;r++)t.call(e,i.value,r,this),i=i.next}forEachReverse(t,e){e=e||this;for(let i=this.tail,r=this.length-1;i;r--)t.call(e,i.value,r,this),i=i.prev}get(t){let e=0,i=this.head;for(;i&&e<t;e++)i=i.next;if(e===t&&i)return i.value}getReverse(t){let e=0,i=this.tail;for(;i&&e<t;e++)i=i.prev;if(e===t&&i)return i.value}map(t,e){e=e||this;let i=new s;for(let r=this.head;r;)i.push(t.call(e,r.value,this)),r=r.next;return i}mapReverse(t,e){e=e||this;var i=new s;for(let r=this.tail;r;)i.push(t.call(e,r.value,this)),r=r.prev;return i}reduce(t,e){let i,r=this.head;if(arguments.length>1)i=e;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=t(i,r.value,n),r=r.next;return i}reduceReverse(t,e){let i,r=this.tail;if(arguments.length>1)i=e;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=t(i,r.value,n),r=r.prev;return i}toArray(){let t=new Array(this.length);for(let e=0,i=this.head;i;e++)t[e]=i.value,i=i.next;return t}toArrayReverse(){let t=new Array(this.length);for(let e=0,i=this.tail;i;e++)t[e]=i.value,i=i.prev;return t}slice(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.head,n=0;for(n=0;r&&n<t;n++)r=r.next;for(;r&&n<e;n++,r=r.next)i.push(r.value);return i}sliceReverse(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.length,n=this.tail;for(;n&&r>e;r--)n=n.prev;for(;n&&r>t;r--,n=n.prev)i.push(n.value);return i}splice(t,e=0,...i){t>this.length&&(t=this.length-1),t<0&&(t=this.length+t);let r=this.head;for(let o=0;r&&o<t;o++)r=r.next;let n=[];for(let o=0;r&&o<e;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=Zn(this,r,o);return n}reverse(){let t=this.head,e=this.tail;for(let i=t;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=e,this.tail=t,this}};function Zn(s,t,e){let i=t,r=t?t.next:s.head,n=new ue(e,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function Yn(s,t){s.tail=new ue(t,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Kn(s,t){s.head=new ue(t,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ue=class{list;next;prev;value;constructor(t,e,i,r){this.list=r,this.value=t,e?(e.next=this,this.prev=e):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};import ar from"path";var pi=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(t,e){this.path=t||"./",this.absolute=e}},nr=Buffer.alloc(1024),li=Symbol("onStat"),me=Symbol("ended"),W=Symbol("queue"),pe=Symbol("pendingLinks"),Et=Symbol("current"),Ft=Symbol("process"),Ee=Symbol("processing"),ai=Symbol("processJob"),G=Symbol("jobs"),ls=Symbol("jobDone"),ci=Symbol("addFSEntry"),or=Symbol("addTarEntry"),ds=Symbol("stat"),us=Symbol("readdir"),fi=Symbol("onreaddir"),di=Symbol("pipe"),hr=Symbol("entry"),cs=Symbol("entryOpt"),ui=Symbol("writeEntryClass"),lr=Symbol("write"),fs=Symbol("ondrain"),wt=class extends A{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[ui];onWriteEntry;[W];[pe]=new Map;[G]=0;[Ee]=!1;[me]=!1;constructor(t={}){if(super(),this.opt=t,this.file=t.file||"",this.cwd=t.cwd||process.cwd(),this.maxReadSize=t.maxReadSize,this.preservePaths=!!t.preservePaths,this.strict=!!t.strict,this.noPax=!!t.noPax,this.prefix=f(t.prefix||""),this.linkCache=t.linkCache||new Map,this.statCache=t.statCache||new Map,this.readdirCache=t.readdirCache||new Map,this.onWriteEntry=t.onWriteEntry,this[ui]=de,typeof t.onwarn=="function"&&this.on("warn",t.onwarn),this.portable=!!t.portable,t.gzip||t.brotli||t.zstd){if((t.gzip?1:0)+(t.brotli?1:0)+(t.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(t.gzip&&(typeof t.gzip!="object"&&(t.gzip={}),this.portable&&(t.gzip.portable=!0),this.zip=new ze(t.gzip)),t.brotli&&(typeof t.brotli!="object"&&(t.brotli={}),this.zip=new We(t.brotli)),t.zstd&&(typeof t.zstd!="object"&&(t.zstd={}),this.zip=new Ye(t.zstd)),!this.zip)throw new Error("impossible");let e=this.zip;e.on("data",i=>super.write(i)),e.on("end",()=>super.end()),e.on("drain",()=>this[fs]()),this.on("resume",()=>e.resume())}else this.on("drain",this[fs]);this.noDirRecurse=!!t.noDirRecurse,this.follow=!!t.follow,this.noMtime=!!t.noMtime,t.mtime&&(this.mtime=t.mtime),this.filter=typeof t.filter=="function"?t.filter:()=>!0,this[W]=new hi,this[G]=0,this.jobs=Number(t.jobs)||4,this[Ee]=!1,this[me]=!1}[lr](t){return super.write(t)}add(t){return this.write(t),this}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&this.add(t),this[me]=!0,this[Ft](),i&&i(),this}write(t){if(this[me])throw new Error("write after end");return typeof t=="string"?this[ci](t):this[or](t),this.flowing}[or](t){let e=f(ar.resolve(this.cwd,t.path));if(!this.filter(t.path,t))t.resume();else{let i=new pi(t.path,e);i.entry=new oi(t,this[cs](i)),i.entry.on("end",()=>this[ls](i)),this[G]+=1,this[W].push(i)}this[Ft]()}[ci](t){let e=f(ar.resolve(this.cwd,t));this[W].push(new pi(t,e)),this[Ft]()}[ds](t){t.pending=!0,this[G]+=1;let e=this.follow?"stat":"lstat";mi[e](t.absolute,(i,r)=>{t.pending=!1,this[G]-=1,i?this.emit("error",i):this[li](t,r)})}[li](t,e){if(this.statCache.set(t.absolute,e),t.stat=e,!this.filter(t.path,e))t.ignore=!0;else if(e.isFile()&&e.nlink>1&&!this.linkCache.get(`${e.dev}:${e.ino}`)&&!this.sync)if(t===this[Et])this[ai](t);else{let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);r?r.push(t):this[pe].set(i,[t]),t.pendingLink=!0,t.pending=!0}this[Ft]()}[us](t){t.pending=!0,this[G]+=1,mi.readdir(t.absolute,(e,i)=>{if(t.pending=!1,this[G]-=1,e)return this.emit("error",e);this[fi](t,i)})}[fi](t,e){this.readdirCache.set(t.absolute,e),t.readdir=e,this[Ft]()}[Ft](){if(!this[Ee]){this[Ee]=!0;for(let t=this[W].head;t&&this[G]<this.jobs;t=t.next)if(this[ai](t.value),t.value.ignore){let e=t.next;this[W].removeNode(t),t.next=e}this[Ee]=!1,this[me]&&this[W].length===0&&this[G]===0&&(this.zip?this.zip.end(nr):(super.write(nr),super.end()))}}get[Et](){return this[W]&&this[W].head&&this[W].head.value}[ls](t){this[W].shift(),this[G]-=1;let{stat:e}=t;if(e&&e.isFile()&&e.nlink>1){let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);if(r){this[pe].delete(i);for(let n of r)n.pending=!1,this[ai](n)}}this[Ft]()}[ai](t){if(t.pending&&t.pendingLink&&t===this[Et]&&(t.pending=!1,t.pendingLink=!1),!t.pending){if(t.entry){t===this[Et]&&!t.piped&&this[di](t);return}if(!t.stat){let e=this.statCache.get(t.absolute);e?this[li](t,e):this[ds](t)}if(t.stat&&!t.ignore){if(!this.noDirRecurse&&t.stat.isDirectory()&&!t.readdir){let e=this.readdirCache.get(t.absolute);if(e?this[fi](t,e):this[us](t),!t.readdir)return}if(t.entry=this[hr](t),!t.entry){t.ignore=!0;return}t===this[Et]&&!t.piped&&this[di](t)}}}[cs](t){return{onwarn:(e,i,r)=>this.warn(e,i,r),noPax:this.noPax,cwd:this.cwd,absolute:t.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[hr](t){this[G]+=1;try{return new this[ui](t.path,this[cs](t)).on("end",()=>this[ls](t)).on("error",i=>this.emit("error",i))}catch(e){this.emit("error",e)}}[fs](){this[Et]&&this[Et].entry&&this[Et].entry.resume()}[di](t){t.piped=!0,t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)});let e=t.entry,i=this.zip;if(!e)throw new Error("cannot pipe without source");i?e.on("data",r=>{i.write(r)||e.pause()}):e.on("data",r=>{super.write(r)||e.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(t,e,i={}){Dt(this,t,e,i)}},kt=class extends wt{sync=!0;constructor(t){super(t),this[ui]=ni}pause(){}resume(){}[ds](t){let e=this.follow?"statSync":"lstatSync";this[li](t,mi[e](t.absolute))}[us](t){this[fi](t,mi.readdirSync(t.absolute))}[di](t){let e=t.entry,i=this.zip;if(t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)}),!e)throw new Error("Cannot pipe without source");i?e.on("data",r=>{i.write(r)}):e.on("data",r=>{super[lr](r)})}};var Vn=(s,t)=>{let e=new kt(s),i=new Wt(s.file,{mode:s.mode||438});e.pipe(i),fr(e,t)},$n=(s,t)=>{let e=new wt(s),i=new et(s.file,{mode:s.mode||438});e.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),e.on("error",o)});return dr(e,t).catch(n=>e.emit("error",n)),r},fr=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:cr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},dr=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:cr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(e);s.end()},Xn=(s,t)=>{let e=new kt(s);return fr(e,t),e},qn=(s,t)=>{let e=new wt(s);return dr(e,t).catch(i=>e.emit("error",i)),e},Qn=K(Vn,$n,Xn,qn,(s,t)=>{if(!t?.length)throw new TypeError("no paths specified to add to archive")});import Br from"node:fs";import co from"node:assert";import{randomBytes as Mr}from"node:crypto";import u from"node:fs";import R from"node:path";import pr from"fs";var Jn=process.env.__FAKE_PLATFORM__||process.platform,Er=Jn==="win32",{O_CREAT:wr,O_NOFOLLOW:ur,O_TRUNC:Sr,O_WRONLY:yr}=pr.constants,Rr=Number(process.env.__FAKE_FS_O_FILENAME__)||pr.constants.UV_FS_O_FILEMAP||0,jn=Er&&!!Rr,to=512*1024,eo=Rr|Sr|wr|yr,mr=!Er&&typeof ur=="number"?ur|Sr|wr|yr:null,ms=mr!==null?()=>mr:jn?s=>s<to?eo:"w":()=>"w";import wi from"node:fs";import we from"node:path";var ps=(s,t,e)=>{try{return wi.lchownSync(s,t,e)}catch(i){if(i?.code!=="ENOENT")throw i}},Ei=(s,t,e,i)=>{wi.lchown(s,t,e,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},io=(s,t,e,i,r)=>{if(t.isDirectory())Es(we.resolve(s,t.name),e,i,n=>{if(n)return r(n);let o=we.resolve(s,t.name);Ei(o,e,i,r)});else{let n=we.resolve(s,t.name);Ei(n,e,i,r)}},Es=(s,t,e,i)=>{wi.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return Ei(s,t,e,i);let o=n.length,h=null,a=l=>{if(!h){if(l)return i(h=l);if(--o===0)return Ei(s,t,e,i)}};for(let l of n)io(s,l,t,e,a)})},so=(s,t,e,i)=>{t.isDirectory()&&ws(we.resolve(s,t.name),e,i),ps(we.resolve(s,t.name),e,i)},ws=(s,t,e)=>{let i;try{i=wi.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return ps(s,t,e);throw n}for(let r of i)so(s,r,t,e);return ps(s,t,e)};import k from"node:fs";import ro from"node:fs/promises";import Si from"node:path";var Se=class extends Error{path;code;syscall="chdir";constructor(t,e){super(`${e}: Cannot cd into '${t}'`),this.path=t,this.code=e}get name(){return"CwdError"}};var St=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(t,e){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=t,this.path=e}get name(){return"SymlinkError"}};var no=(s,t)=>{k.stat(s,(e,i)=>{(e||!i.isDirectory())&&(e=new Se(s,e?.code||"ENOTDIR")),t(e)})},gr=(s,t,e)=>{s=f(s);let i=t.umask??18,r=t.mode|448,n=(r&i)!==0,o=t.uid,h=t.gid,a=typeof o=="number"&&typeof h=="number"&&(o!==t.processUid||h!==t.processGid),l=t.preserve,c=t.unlink,d=f(t.cwd),y=(E,x)=>{E?e(E):x&&a?Es(x,o,h,Le=>y(Le)):n?k.chmod(s,r,e):e()};if(s===d)return no(s,y);if(l)return ro.mkdir(s,{mode:r,recursive:!0}).then(E=>y(null,E??void 0),y);let D=f(Si.relative(d,s)).split("/");Ss(d,D,r,c,d,void 0,y)},Ss=(s,t,e,i,r,n,o)=>{if(t.length===0)return o(null,n);let h=t.shift(),a=f(Si.resolve(s+"/"+h));k.mkdir(a,e,br(a,t,e,i,r,n,o))},br=(s,t,e,i,r,n,o)=>h=>{h?k.lstat(s,(a,l)=>{if(a)a.path=a.path&&f(a.path),o(a);else if(l.isDirectory())Ss(s,t,e,i,r,n,o);else if(i)k.unlink(s,c=>{if(c)return o(c);k.mkdir(s,e,br(s,t,e,i,r,n,o))});else{if(l.isSymbolicLink())return o(new St(s,s+"/"+t.join("/")));o(h)}}):(n=n||s,Ss(s,t,e,i,r,n,o))},oo=s=>{let t=!1,e;try{t=k.statSync(s).isDirectory()}catch(i){e=i?.code}finally{if(!t)throw new Se(s,e??"ENOTDIR")}},_r=(s,t)=>{s=f(s);let e=t.umask??18,i=t.mode|448,r=(i&e)!==0,n=t.uid,o=t.gid,h=typeof n=="number"&&typeof o=="number"&&(n!==t.processUid||o!==t.processGid),a=t.preserve,l=t.unlink,c=f(t.cwd),d=E=>{E&&h&&ws(E,n,o),r&&k.chmodSync(s,i)};if(s===c)return oo(c),d();if(a)return d(k.mkdirSync(s,{mode:i,recursive:!0})??void 0);let T=f(Si.relative(c,s)).split("/"),D;for(let E=T.shift(),x=c;E&&(x+="/"+E);E=T.shift()){x=f(Si.resolve(x));try{k.mkdirSync(x,i),D=D||x}catch{let Le=k.lstatSync(x);if(Le.isDirectory())continue;if(l){k.unlinkSync(x),k.mkdirSync(x,i),D=D||x;continue}else if(Le.isSymbolicLink())return new St(x,x+"/"+T.join("/"))}}return d(D)};import{join as xr}from"node:path";var ys=Object.create(null),Or=1e4,Vt=new Set,Tr=s=>{Vt.has(s)?Vt.delete(s):ys[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),Vt.add(s);let t=ys[s],e=Vt.size-Or;if(e>Or/10){for(let i of Vt)if(Vt.delete(i),delete ys[i],--e<=0)break}return t};var ho=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,ao=ho==="win32",lo=s=>s.split("/").slice(0,-1).reduce((e,i)=>{let r=e.at(-1);return r!==void 0&&(i=xr(r,i)),e.push(i||"/"),e},[]),yi=class{#t=new Map;#i=new Map;#s=new Set;reserve(t,e){t=ao?["win32 parallelization disabled"]:t.map(r=>mt(xr(Tr(r))));let i=new Set(t.map(r=>lo(r)).reduce((r,n)=>r.concat(n)));this.#i.set(e,{dirs:i,paths:t});for(let r of t){let n=this.#t.get(r);n?n.push(e):this.#t.set(r,[e])}for(let r of i){let n=this.#t.get(r);if(!n)this.#t.set(r,[new Set([e])]);else{let o=n.at(-1);o instanceof Set?o.add(e):n.push(new Set([e]))}}return this.#r(e)}#n(t){let e=this.#i.get(t);if(!e)throw new Error("function does not have any path reservations");return{paths:e.paths.map(i=>this.#t.get(i)),dirs:[...e.dirs].map(i=>this.#t.get(i))}}check(t){let{paths:e,dirs:i}=this.#n(t);return e.every(r=>r&&r[0]===t)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(t))}#r(t){return this.#s.has(t)||!this.check(t)?!1:(this.#s.add(t),t(()=>this.#e(t)),!0)}#e(t){if(!this.#s.has(t))return!1;let e=this.#i.get(t);if(!e)throw new Error("invalid reservation");let{paths:i,dirs:r}=e,n=new Set;for(let o of i){let h=this.#t.get(o);if(!h||h?.[0]!==t)continue;let a=h[1];if(!a){this.#t.delete(o);continue}if(h.shift(),typeof a=="function")n.add(a);else for(let l of a)n.add(l)}for(let o of r){let h=this.#t.get(o),a=h?.[0];if(!(!h||!(a instanceof Set)))if(a.size===1&&h.length===1){this.#t.delete(o);continue}else if(a.size===1){h.shift();let l=h[0];typeof l=="function"&&n.add(l)}else a.delete(t)}return this.#s.delete(t),n.forEach(o=>this.#r(o)),!0}};var Lr=()=>process.umask();var Dr=Symbol("onEntry"),_s=Symbol("checkFs"),Nr=Symbol("checkFs2"),Os=Symbol("isReusable"),P=Symbol("makeFs"),Ts=Symbol("file"),xs=Symbol("directory"),gi=Symbol("link"),Ar=Symbol("symlink"),Ir=Symbol("hardlink"),Re=Symbol("ensureNoSymlink"),Cr=Symbol("unsupported"),Fr=Symbol("checkPath"),Rs=Symbol("stripAbsolutePath"),yt=Symbol("mkdir"),O=Symbol("onError"),Ri=Symbol("pending"),kr=Symbol("pend"),$t=Symbol("unpend"),gs=Symbol("ended"),bs=Symbol("maybeClose"),Ls=Symbol("skip"),ge=Symbol("doChown"),be=Symbol("uid"),_e=Symbol("gid"),Oe=Symbol("checkedCwd"),fo=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,Te=fo==="win32",uo=1024,mo=(s,t)=>{if(!Te)return u.unlink(s,t);let e=s+".DELETE."+Mr(16).toString("hex");u.rename(s,e,i=>{if(i)return t(i);u.unlink(e,t)})},po=s=>{if(!Te)return u.unlinkSync(s);let t=s+".DELETE."+Mr(16).toString("hex");u.renameSync(s,t),u.unlinkSync(t)},vr=(s,t,e)=>s!==void 0&&s===s>>>0?s:t!==void 0&&t===t>>>0?t:e,Xt=class extends rt{[gs]=!1;[Oe]=!1;[Ri]=0;reservations=new yi;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(t={}){if(t.ondone=()=>{this[gs]=!0,this[bs]()},super(t),this.transform=t.transform,this.chmod=!!t.chmod,typeof t.uid=="number"||typeof t.gid=="number"){if(typeof t.uid!="number"||typeof t.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(t.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=t.uid,this.gid=t.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=t.preserveOwner===void 0&&typeof t.uid!="number"?process.getuid?.()===0:!!t.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof t.maxDepth=="number"?t.maxDepth:uo,this.forceChown=t.forceChown===!0,this.win32=!!t.win32||Te,this.newer=!!t.newer,this.keep=!!t.keep,this.noMtime=!!t.noMtime,this.preservePaths=!!t.preservePaths,this.unlink=!!t.unlink,this.cwd=f(R.resolve(t.cwd||process.cwd())),this.strip=Number(t.strip)||0,this.processUmask=this.chmod?typeof t.processUmask=="number"?t.processUmask:Lr():0,this.umask=typeof t.umask=="number"?t.umask:this.processUmask,this.dmode=t.dmode||511&~this.umask,this.fmode=t.fmode||438&~this.umask,this.on("entry",e=>this[Dr](e))}warn(t,e,i={}){return(t==="TAR_BAD_ARCHIVE"||t==="TAR_ABORT")&&(i.recoverable=!1),super.warn(t,e,i)}[bs](){this[gs]&&this[Ri]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[Rs](t,e){let i=t[e],{type:r}=t;if(!i||this.preservePaths)return!0;let[n,o]=ce(i),h=o.replaceAll(/\\/g,"/").split("/");if(h.includes("..")||Te&&/^[a-z]:\.\.$/i.test(h[0]??"")){if(e==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${e} contains '..'`,{entry:t,[e]:i}),!1;let a=R.posix.dirname(t.path),l=R.posix.normalize(R.posix.join(a,h.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${e} escapes extraction directory`,{entry:t,[e]:i}),!1}return n&&(t[e]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${e}`,{entry:t,[e]:i})),!0}[Fr](t){let e=f(t.path),i=e.split("/");if(this.strip){if(i.length<this.strip)return!1;if(t.type==="Link"){let r=f(String(t.linkpath)).split("/");if(r.length>=this.strip)t.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),t.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:t,path:e,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[Rs](t,"path")||!this[Rs](t,"linkpath"))return!1;if(t.absolute=R.isAbsolute(t.path)?f(R.resolve(t.path)):f(R.resolve(this.cwd,t.path)),!this.preservePaths&&typeof t.absolute=="string"&&t.absolute.indexOf(this.cwd+"/")!==0&&t.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:t,path:f(t.path),resolvedPath:t.absolute,cwd:this.cwd}),!1;if(t.absolute===this.cwd&&t.type!=="Directory"&&t.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=R.win32.parse(String(t.absolute));t.absolute=r+ts(String(t.absolute).slice(r.length));let{root:n}=R.win32.parse(t.path);t.path=n+ts(t.path.slice(n.length))}return!0}[Dr](t){if(!this[Fr](t))return t.resume();switch(co.equal(typeof t.absolute,"string"),t.type){case"Directory":case"GNUDumpDir":t.mode&&(t.mode=t.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[_s](t);default:return this[Cr](t)}}[O](t,e){t.name==="CwdError"?this.emit("error",t):(this.warn("TAR_ENTRY_ERROR",t,{entry:e}),this[$t](),e.resume())}[yt](t,e,i){gr(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e},i)}[ge](t){return this.forceChown||this.preserveOwner&&(typeof t.uid=="number"&&t.uid!==this.processUid||typeof t.gid=="number"&&t.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[be](t){return vr(this.uid,t.uid,this.processUid)}[_e](t){return vr(this.gid,t.gid,this.processGid)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=new et(String(t.absolute),{flags:ms(t.size),mode:i,autoClose:!1});r.on("error",a=>{r.fd&&u.close(r.fd,()=>{}),r.write=()=>!0,this[O](a,t),e()});let n=1,o=a=>{if(a){r.fd&&u.close(r.fd,()=>{}),this[O](a,t),e();return}--n===0&&r.fd!==void 0&&u.close(r.fd,l=>{l?this[O](l,t):this[$t](),e()})};r.on("finish",()=>{let a=String(t.absolute),l=r.fd;if(typeof l=="number"&&t.mtime&&!this.noMtime){n++;let c=t.atime||new Date,d=t.mtime;u.futimes(l,c,d,y=>y?u.utimes(a,c,d,T=>o(T&&y)):o())}if(typeof l=="number"&&this[ge](t)){n++;let c=this[be](t),d=this[_e](t);typeof c=="number"&&typeof d=="number"&&u.fchown(l,c,d,y=>y?u.chown(a,c,d,T=>o(T&&y)):o())}o()});let h=this.transform&&this.transform(t)||t;h!==t&&(h.on("error",a=>{this[O](a,t),e()}),t.pipe(h)),h.pipe(r)}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode;this[yt](String(t.absolute),i,r=>{if(r){this[O](r,t),e();return}let n=1,o=()=>{--n===0&&(e(),this[$t](),t.resume())};t.mtime&&!this.noMtime&&(n++,u.utimes(String(t.absolute),t.atime||new Date,t.mtime,o)),this[ge](t)&&(n++,u.chown(String(t.absolute),Number(this[be](t)),Number(this[_e](t)),o)),o()})}[Cr](t){t.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${t.type}`,{entry:t}),t.resume()}[Ar](t,e){let i=f(R.relative(this.cwd,R.resolve(R.dirname(String(t.absolute)),String(t.linkpath)))).split("/");this[Re](t,this.cwd,i,()=>this[gi](t,String(t.linkpath),"symlink",e),r=>{this[O](r,t),e()})}[Ir](t,e){let i=f(R.resolve(this.cwd,String(t.linkpath))),r=f(String(t.linkpath)).split("/");this[Re](t,this.cwd,r,()=>this[gi](t,i,"link",e),n=>{this[O](n,t),e()})}[Re](t,e,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let h=R.resolve(e,o);u.lstat(h,(a,l)=>{if(a)return r();if(l?.isSymbolicLink())return n(new St(h,R.resolve(h,i.join("/"))));this[Re](t,h,i,r,n)})}[kr](){this[Ri]++}[$t](){this[Ri]--,this[bs]()}[Ls](t){this[$t](),t.resume()}[Os](t,e){return t.type==="File"&&!this.unlink&&e.isFile()&&e.nlink<=1&&!Te}[_s](t){this[kr]();let e=[t.path];t.linkpath&&e.push(t.linkpath),this.reservations.reserve(e,i=>this[Nr](t,i))}[Nr](t,e){let i=h=>{e(h)},r=()=>{this[yt](this.cwd,this.dmode,h=>{if(h){this[O](h,t),i();return}this[Oe]=!0,n()})},n=()=>{if(t.absolute!==this.cwd){let h=f(R.dirname(String(t.absolute)));if(h!==this.cwd)return this[yt](h,this.dmode,a=>{if(a){this[O](a,t),i();return}o()})}o()},o=()=>{u.lstat(String(t.absolute),(h,a)=>{if(a&&(this.keep||this.newer&&a.mtime>(t.mtime??a.mtime))){this[Ls](t),i();return}if(h||this[Os](t,a))return this[P](null,t,i);if(a.isDirectory()){if(t.type==="Directory"){let l=this.chmod&&t.mode&&(a.mode&4095)!==t.mode,c=d=>this[P](d??null,t,i);return l?u.chmod(String(t.absolute),Number(t.mode),c):c()}if(t.absolute!==this.cwd)return u.rmdir(String(t.absolute),l=>this[P](l??null,t,i))}if(t.absolute===this.cwd)return this[P](null,t,i);mo(String(t.absolute),l=>this[P](l??null,t,i))})};this[Oe]?n():r()}[P](t,e,i){if(t){this[O](t,e),i();return}switch(e.type){case"File":case"OldFile":case"ContiguousFile":return this[Ts](e,i);case"Link":return this[Ir](e,i);case"SymbolicLink":return this[Ar](e,i);case"Directory":case"GNUDumpDir":return this[xs](e,i)}}[gi](t,e,i,r){u[i](e,String(t.absolute),n=>{n?this[O](n,t):(this[$t](),t.resume()),r()})}},ye=s=>{try{return[null,s()]}catch(t){return[t,null]}},xe=class extends Xt{sync=!0;[P](t,e){return super[P](t,e,()=>{})}[_s](t){if(!this[Oe]){let n=this[yt](this.cwd,this.dmode);if(n)return this[O](n,t);this[Oe]=!0}if(t.absolute!==this.cwd){let n=f(R.dirname(String(t.absolute)));if(n!==this.cwd){let o=this[yt](n,this.dmode);if(o)return this[O](o,t)}}let[e,i]=ye(()=>u.lstatSync(String(t.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(t.mtime??i.mtime)))return this[Ls](t);if(e||this[Os](t,i))return this[P](null,t);if(i.isDirectory()){if(t.type==="Directory"){let o=this.chmod&&t.mode&&(i.mode&4095)!==t.mode,[h]=o?ye(()=>{u.chmodSync(String(t.absolute),Number(t.mode))}):[];return this[P](h,t)}let[n]=ye(()=>u.rmdirSync(String(t.absolute)));this[P](n,t)}let[r]=t.absolute===this.cwd?[]:ye(()=>po(String(t.absolute)));this[P](r,t)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=h=>{let a;try{u.closeSync(n)}catch(l){a=l}(h||a)&&this[O](h||a,t),e()},n;try{n=u.openSync(String(t.absolute),ms(t.size),i)}catch(h){return r(h)}let o=this.transform&&this.transform(t)||t;o!==t&&(o.on("error",h=>this[O](h,t)),t.pipe(o)),o.on("data",h=>{try{u.writeSync(n,h,0,h.length)}catch(a){r(a)}}),o.on("end",()=>{let h=null;if(t.mtime&&!this.noMtime){let a=t.atime||new Date,l=t.mtime;try{u.futimesSync(n,a,l)}catch(c){try{u.utimesSync(String(t.absolute),a,l)}catch{h=c}}}if(this[ge](t)){let a=this[be](t),l=this[_e](t);try{u.fchownSync(n,Number(a),Number(l))}catch(c){try{u.chownSync(String(t.absolute),Number(a),Number(l))}catch{h=h||c}}}r(h)})}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode,r=this[yt](String(t.absolute),i);if(r){this[O](r,t),e();return}if(t.mtime&&!this.noMtime)try{u.utimesSync(String(t.absolute),t.atime||new Date,t.mtime)}catch{}if(this[ge](t))try{u.chownSync(String(t.absolute),Number(this[be](t)),Number(this[_e](t)))}catch{}e(),t.resume()}[yt](t,e){try{return _r(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e})}catch(i){return i}}[Re](t,e,i,r,n){if(this.preservePaths||i.length===0)return r();let o=e;for(let h of i){o=R.resolve(o,h);let[a,l]=ye(()=>u.lstatSync(o));if(a)return r();if(l.isSymbolicLink())return n(new St(o,R.resolve(e,i.join("/"))))}r()}[gi](t,e,i,r){let n=`${i}Sync`;try{u[n](e,String(t.absolute)),r(),t.resume()}catch(o){return this[O](o,t)}}};var Eo=s=>{let t=new xe(s),e=s.file,i=Br.statSync(e),r=s.maxReadSize||16*1024*1024;new Be(e,{readSize:r,size:i.size}).pipe(t)},wo=(s,t)=>{let e=new Xt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("close",o),Br.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},So=K(Eo,wo,s=>new xe(s),s=>new Xt(s),(s,t)=>{t?.length&&Qi(s,t)});import v from"node:fs";import Pr from"node:path";var yo=(s,t)=>{let e=new kt(s),i=!0,r,n;try{try{r=v.openSync(s.file,"r+")}catch(a){if(a?.code==="ENOENT")r=v.openSync(s.file,"w+");else throw a}let o=v.fstatSync(r),h=Buffer.alloc(512);t:for(n=0;n<o.size;n+=512){for(let c=0,d=0;c<512;c+=d){if(d=v.readSync(r,h,c,h.length-c,n+c),n===0&&h[0]===31&&h[1]===139)throw new Error("cannot append to compressed archives");if(!d)break t}let a=new F(h);if(!a.cksumValid)break;let l=512*Math.ceil((a.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&a.mtime&&s.mtimeCache.set(String(a.path),a.mtime)}i=!1,Ro(s,e,n,r,t)}finally{if(i)try{v.closeSync(r)}catch{}}},Ro=(s,t,e,i,r)=>{let n=new Wt(s.file,{fd:i,start:e});t.pipe(n),bo(t,r)},go=(s,t)=>{t=Array.from(t);let e=new wt(s),i=(n,o,h)=>{let a=(T,D)=>{T?v.close(n,E=>h(T)):h(null,D)},l=0;if(o===0)return a(null,0);let c=0,d=Buffer.alloc(512),y=(T,D)=>{if(T||D===void 0)return a(T);if(c+=D,c<512&&D)return v.read(n,d,c,d.length-c,l+c,y);if(l===0&&d[0]===31&&d[1]===139)return a(new Error("cannot append to compressed archives"));if(c<512)return a(null,l);let E=new F(d);if(!E.cksumValid)return a(null,l);let x=512*Math.ceil((E.size??0)/512);if(l+x+512>o||(l+=x+512,l>=o))return a(null,l);s.mtimeCache&&E.mtime&&s.mtimeCache.set(String(E.path),E.mtime),c=0,v.read(n,d,0,512,l,y)};v.read(n,d,0,512,l,y)};return new Promise((n,o)=>{e.on("error",o);let h="r+",a=(l,c)=>{if(l&&l.code==="ENOENT"&&h==="r+")return h="w+",v.open(s.file,h,a);if(l||!c)return o(l);v.fstat(c,(d,y)=>{if(d)return v.close(c,()=>o(d));i(c,y.size,(T,D)=>{if(T)return o(T);let E=new et(s.file,{fd:c,start:D});e.pipe(E),E.on("error",o),E.on("close",n),_o(e,t)})})};v.open(s.file,h,a)})},bo=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:Pr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},_o=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:Pr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e);s.end()},vt=K(yo,go,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,t)=>{if(!Bs(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!t?.length)throw new TypeError("no paths specified to add/replace")});var Oo=K(vt.syncFile,vt.asyncFile,vt.syncNoFile,vt.asyncNoFile,(s,t=[])=>{vt.validate?.(s,t),To(s)}),To=s=>{let t=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=t?(e,i)=>t(e,i)&&!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0)):(e,i)=>!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0))};export{F as Header,wt as Pack,pi as PackJob,kt as PackSync,rt as Parser,ft as Pax,$e as ReadEntry,Xt as Unpack,xe as UnpackSync,de as WriteEntry,ni as WriteEntrySync,oi as WriteEntryTar,Qn as c,Qn as create,So as extract,Qi as filesFilter,Ct as list,vt as r,vt as replace,Ct as t,Hi as types,Oo as u,Oo as update,So as x};
 //# sourceMappingURL=index.min.js.map
diff --git a/deps/npm/node_modules/tar/dist/esm/list.js b/deps/npm/node_modules/tar/dist/esm/list.js
index 4c3af58192ec..08bdbe4ad85c 100644
--- a/deps/npm/node_modules/tar/dist/esm/list.js
+++ b/deps/npm/node_modules/tar/dist/esm/list.js
@@ -20,14 +20,22 @@ const onReadEntryFunction = (opt) => {
 export const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [stripTrailingSlashes(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || parse(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas(dirname(file), root);
+            ret = m !== undefined ? m : mapHas(dirname(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;
diff --git a/deps/npm/node_modules/tar/dist/esm/parse.js b/deps/npm/node_modules/tar/dist/esm/parse.js
index fb303a5171be..92add3a903fd 100644
--- a/deps/npm/node_modules/tar/dist/esm/parse.js
+++ b/deps/npm/node_modules/tar/dist/esm/parse.js
@@ -373,6 +373,16 @@ export class Parser extends EE {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode
diff --git a/deps/npm/node_modules/tar/package.json b/deps/npm/node_modules/tar/package.json
index 9d082e440494..f19ece377d9d 100644
--- a/deps/npm/node_modules/tar/package.json
+++ b/deps/npm/node_modules/tar/package.json
@@ -2,7 +2,7 @@
   "author": "Isaac Z. Schlueter",
   "name": "tar",
   "description": "tar for node",
-  "version": "7.5.19",
+  "version": "7.5.22",
   "repository": {
     "type": "git",
     "url": "https://github.com/isaacs/node-tar.git"
diff --git a/deps/npm/node_modules/undici/lib/core/request.js b/deps/npm/node_modules/undici/lib/core/request.js
index 4da60667ec29..8e7ecc73084b 100644
--- a/deps/npm/node_modules/undici/lib/core/request.js
+++ b/deps/npm/node_modules/undici/lib/core/request.js
@@ -350,7 +350,13 @@ function processHeader (request, key, val) {
       } else if (typeof val[i] === 'object') {
         throw new InvalidArgumentError(`invalid ${key} header`)
       } else {
-        arr.push(`${val[i]}`)
+        // Coerce primitives (and reject unsafe coercions such as functions
+        // with a crafted toString/Symbol.toPrimitive).
+        const str = `${val[i]}`
+        if (!isValidHeaderValue(str)) {
+          throw new InvalidArgumentError(`invalid ${key} header`)
+        }
+        arr.push(str)
       }
     }
     val = arr
@@ -361,7 +367,12 @@ function processHeader (request, key, val) {
   } else if (val === null) {
     val = ''
   } else {
+    // Coerce primitives (and reject unsafe coercions such as functions
+    // with a crafted toString/Symbol.toPrimitive).
     val = `${val}`
+    if (!isValidHeaderValue(val)) {
+      throw new InvalidArgumentError(`invalid ${key} header`)
+    }
   }
 
   if (headerName === 'host') {
diff --git a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
index 9455517a19b1..a801ecb36046 100644
--- a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
+++ b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
@@ -10,6 +10,7 @@ const {
   RequestContentLengthMismatchError,
   ResponseContentLengthMismatchError,
   RequestAbortedError,
+  InvalidArgumentError,
   HeadersTimeoutError,
   HeadersOverflowError,
   SocketError,
@@ -993,8 +994,16 @@ function writeH1 (client, request) {
     }
     body = bodyStream.stream
     contentLength = bodyStream.length
-  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-    headers.push('content-type', body.type)
+  } else if (util.isBlobLike(body) && request.contentType == null) {
+    const contentType = body.type
+    if (contentType) {
+      const contentTypeValue = `${contentType}`
+      if (!util.isValidHeaderValue(contentTypeValue)) {
+        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'))
+        return false
+      }
+      headers.push('content-type', contentTypeValue)
+    }
   }
 
   if (body && typeof body.read === 'function') {
diff --git a/deps/npm/node_modules/undici/lib/handler/retry-handler.js b/deps/npm/node_modules/undici/lib/handler/retry-handler.js
index 5d1ccf005387..c62a2409f3ae 100644
--- a/deps/npm/node_modules/undici/lib/handler/retry-handler.js
+++ b/deps/npm/node_modules/undici/lib/handler/retry-handler.js
@@ -15,6 +15,28 @@ function calculateRetryAfterHeader (retryAfter) {
   return new Date(retryAfter).getTime() - current
 }
 
+function validatePartialResponseContentLength (headers, range, statusCode, retryCount) {
+  const contentLength = headers['content-length']
+  if (contentLength == null) {
+    return null
+  }
+
+  if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) {
+    return null
+  }
+
+  const length = Number(contentLength)
+  const expectedLength = range.end - range.start + 1
+  if (!Number.isFinite(length) || length !== expectedLength) {
+    return new RequestRetryError('Content-Length mismatch', statusCode, {
+      headers,
+      data: { count: retryCount }
+    })
+  }
+
+  return null
+}
+
 class RetryHandler {
   constructor (opts, handlers) {
     const { retryOptions, ...dispatchOpts } = opts
@@ -229,6 +251,12 @@ class RetryHandler {
         return false
       }
 
+      const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount)
+      if (contentLengthError != null) {
+        this.abort(contentLengthError)
+        return false
+      }
+
       const { start, size, end = size - 1 } = contentRange
 
       assert(this.start === start, 'content-range mismatch')
@@ -252,6 +280,12 @@ class RetryHandler {
           )
         }
 
+        const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount)
+        if (contentLengthError != null) {
+          this.abort(contentLengthError)
+          return false
+        }
+
         const { start, size, end = size - 1 } = range
         assert(
           start != null && Number.isFinite(start),
diff --git a/deps/npm/node_modules/undici/lib/web/cookies/util.js b/deps/npm/node_modules/undici/lib/web/cookies/util.js
index 254f5419e905..ca408e153abb 100644
--- a/deps/npm/node_modules/undici/lib/web/cookies/util.js
+++ b/deps/npm/node_modules/undici/lib/web/cookies/util.js
@@ -105,7 +105,7 @@ function validateCookiePath (path) {
 
     if (
       code < 0x20 || // exclude CTLs (0-31)
-      code === 0x7F || // DEL
+      code > 0x7E || // exclude DEL and non-ascii
       code === 0x3B // ;
     ) {
       throw new Error('Invalid cookie path')
@@ -114,16 +114,80 @@ function validateCookiePath (path) {
 }
 
 /**
- * I have no idea why these values aren't allowed to be honest,
- * but Deno tests these. - Khafra
+ * <let-dig> ::= <letter> | <digit>
+ *
+ * <letter> ::= any one of the 52 alphabetic characters A through Z in
+ * upper case and a through z in lower case
+ *
+ * <digit> ::= any one of the ten digits 0 through 9r
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+ * @param {number} code
+ */
+function isLetterOrDigit (code) {
+  return (
+    (code >= 0x30 && code <= 0x39) || // 0-9
+    (code >= 0x41 && code <= 0x5A) || // A-Z
+    (code >= 0x61 && code <= 0x7A) // a-z
+  )
+}
+
+/**
+ * Validates a cookie domain against the "preferred name syntax".
+ *
+ * <domain>      ::= <subdomain> | " "
+ * <subdomain>   ::= <label> | <subdomain> "." <label>
+ * <label>       ::= <let-dig> [ [ <ldh-str> ] <let-dig> ]
+ * <ldh-str>     ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+ * <let-dig-hyp> ::= <let-dig> | "-"
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+ * @see https://www.rfc-editor.org/rfc/rfc1123#section-2.1
+ * @see https://www.rfc-editor.org/rfc/rfc1035#section-2.3.4
  * @param {string} domain
  */
 function validateCookieDomain (domain) {
-  if (
-    domain.startsWith('-') ||
-    domain.endsWith('.') ||
-    domain.endsWith('-')
-  ) {
+  // <domain> ::= <subdomain> | " "
+  if (domain === ' ') {
+    return
+  }
+
+  if (domain.length > 255) {
+    throw new Error('Invalid cookie domain')
+  }
+
+  let labelLength = 0
+
+  for (let i = 0; i < domain.length; ++i) {
+    const code = domain.charCodeAt(i)
+
+    if (code === 0x2E) {
+      if (labelLength === 0) {
+        throw new Error('Invalid cookie domain')
+      }
+
+      if (domain.charCodeAt(i - 1) === 0x2D) { // "-"
+        throw new Error('Invalid cookie domain')
+      }
+
+      labelLength = 0
+      continue
+    }
+
+    if (labelLength === 0 && !isLetterOrDigit(code)) {
+      throw new Error('Invalid cookie domain')
+    }
+
+    if (!isLetterOrDigit(code) && code !== 0x2D) { // "-"
+      throw new Error('Invalid cookie domain')
+    }
+
+    if (++labelLength > 63) {
+      throw new Error('Invalid cookie domain')
+    }
+  }
+
+  if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 0x2D) { // "-"
     throw new Error('Invalid cookie domain')
   }
 }
@@ -266,7 +330,13 @@ function stringify (cookie) {
 
     const [key, ...value] = part.split('=')
 
-    out.push(`${key.trim()}=${value.join('=')}`)
+    const trimmedKey = key.trim()
+    const joinedValue = value.join('=')
+
+    validateCookieName(trimmedKey)
+    validateCookieValue(joinedValue)
+
+    out.push(`${trimmedKey}=${joinedValue}`)
   }
 
   return out.join('; ')
diff --git a/deps/npm/node_modules/undici/package.json b/deps/npm/node_modules/undici/package.json
index 3c2001f391e3..cd46deca2448 100644
--- a/deps/npm/node_modules/undici/package.json
+++ b/deps/npm/node_modules/undici/package.json
@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "6.27.0",
+  "version": "6.28.0",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
diff --git a/deps/npm/package.json b/deps/npm/package.json
index 5ce61281a2b0..a67f34569558 100644
--- a/deps/npm/package.json
+++ b/deps/npm/package.json
@@ -1,5 +1,5 @@
 {
-  "version": "11.19.0",
+  "version": "11.19.1",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
@@ -81,7 +81,7 @@
     "libnpmexec": "^10.3.2",
     "libnpmfund": "^7.0.26",
     "libnpmorg": "^8.0.1",
-    "libnpmpack": "^9.1.12",
+    "libnpmpack": "^9.1.13",
     "libnpmpublish": "^11.2.0",
     "libnpmsearch": "^9.0.1",
     "libnpmteam": "^8.0.2",
@@ -110,7 +110,7 @@
     "spdx-expression-parse": "^4.0.0",
     "ssri": "^13.0.1",
     "supports-color": "^10.2.2",
-    "tar": "^7.5.19",
+    "tar": "^7.5.22",
     "text-table": "~0.2.0",
     "tiny-relative-date": "^2.0.2",
     "treeverse": "^3.0.0",
diff --git a/deps/npm/test/lib/commands/pack.js b/deps/npm/test/lib/commands/pack.js
index 9805427de4f6..21d961ebef6e 100644
--- a/deps/npm/test/lib/commands/pack.js
+++ b/deps/npm/test/lib/commands/pack.js
@@ -113,6 +113,25 @@ t.test('dry run', async t => {
   t.throws(() => fs.statSync(path.resolve(npm.prefix, filename)))
 })
 
+for (const allowDirectory of ['none', 'root']) {
+  t.test(`dry run with allow-directory=${allowDirectory}`, async t => {
+    const { npm, outputs } = await loadMockNpm(t, {
+      prefixDir: {
+        'package.json': JSON.stringify({
+          name: 'test-package',
+          version: '1.0.0',
+        }),
+      },
+      config: {
+        'allow-directory': allowDirectory,
+        'dry-run': true,
+      },
+    })
+    await npm.exec('pack', [])
+    t.strictSame(outputs, ['test-package-1.0.0.tgz'])
+  })
+}
+
 t.test('foreground-scripts defaults to true', async t => {
   const { npm, outputs, logs } = await loadMockNpm(t, {
     prefixDir: {
diff --git a/deps/npm/test/lib/commands/publish.js b/deps/npm/test/lib/commands/publish.js
index b204f7452a65..98576b08ea30 100644
--- a/deps/npm/test/lib/commands/publish.js
+++ b/deps/npm/test/lib/commands/publish.js
@@ -151,6 +151,25 @@ t.test('dry-run', async t => {
   t.matchSnapshot(logs.notice)
 })
 
+for (const allowDirectory of ['none', 'root']) {
+  t.test(`dry-run with allow-directory=${allowDirectory}`, async t => {
+    const { joinedOutput, npm, registry } = await loadNpmWithRegistry(t, {
+      config: {
+        'allow-directory': allowDirectory,
+        'dry-run': true,
+        ...auth,
+      },
+      prefixDir: {
+        'package.json': JSON.stringify(pkgJson, null, 2),
+      },
+      authorization: token,
+    })
+    registry.publish(pkg, { noPut: true })
+    await npm.exec('publish', [])
+    t.equal(joinedOutput(), `+ ${pkg}@1.0.0`)
+  })
+}
+
 t.test('foreground-scripts defaults to true', async t => {
   const { outputs, npm, logs, registry } = await loadNpmWithRegistry(t, {
     config: {
diff --git a/deps/openssl/openssl_asm.gypi b/deps/openssl/openssl_asm.gypi
index d1b3fbbcd6a7..6ad606568074 100644
--- a/deps/openssl/openssl_asm.gypi
+++ b/deps/openssl/openssl_asm.gypi
@@ -77,5 +77,8 @@
       # Other architectures don't use assembly
       'includes': ['config/archs/linux-x86_64/asm/openssl.gypi'],
     }],
+    [ 'clang==1 and OS!="win"', {
+      'cflags': [ '-Wno-unused-command-line-argument' ],
+    }],
   ],
 }
diff --git a/deps/simdjson/simdjson.cpp b/deps/simdjson/simdjson.cpp
index 7b8b0c44f057..71f443b3d2bb 100644
--- a/deps/simdjson/simdjson.cpp
+++ b/deps/simdjson/simdjson.cpp
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-08-14 12:14:27 -0400. version 4.6.7 Do not edit! */
+/* auto-generated on 2026-09-04 16:04:31 -0400. version 4.6.11 Do not edit! */
 /* including simdjson.cpp:  */
 /* begin file simdjson.cpp */
 #define SIMDJSON_SRC_SIMDJSON_CPP
@@ -240,7 +240,7 @@ using std::size_t;
 #endif
 #elif defined(__PPC64__) || defined(_M_PPC64)
 #define SIMDJSON_IS_PPC64 1
-#if defined(__ALTIVEC__)
+#if defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #define SIMDJSON_IS_PPC64_VMX 1
 #endif // defined(__ALTIVEC__)
 #else
@@ -10052,9 +10052,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -10065,6 +10070,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -13541,7 +13547,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -13575,7 +13588,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -13597,7 +13610,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -13976,11 +13989,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -14005,6 +14013,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -14021,7 +14035,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -16588,9 +16602,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -16601,6 +16620,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -19936,7 +19956,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -19970,7 +19997,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -19992,7 +20019,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -20371,11 +20398,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -20400,6 +20422,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -20416,7 +20444,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -22979,9 +23007,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -22992,6 +23025,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -26326,7 +26360,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -26360,7 +26401,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -26382,7 +26423,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -26761,11 +26802,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -26790,6 +26826,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -26806,7 +26848,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -29527,9 +29569,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -29540,6 +29587,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -32987,7 +33035,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -33021,7 +33076,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -33043,7 +33098,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -33422,11 +33477,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -33451,6 +33501,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -33467,7 +33523,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -36435,9 +36491,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -36448,6 +36509,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -40210,7 +40272,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -40244,7 +40313,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -40266,7 +40335,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -40645,11 +40714,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -40674,6 +40738,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -40690,7 +40760,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -43189,9 +43259,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -43202,6 +43277,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -46464,7 +46540,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -46498,7 +46581,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -46520,7 +46603,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -46899,11 +46982,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -46928,6 +47006,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -46944,7 +47028,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -49380,9 +49464,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -49393,6 +49482,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -52622,7 +52712,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -52656,7 +52753,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -52678,7 +52775,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -53057,11 +53154,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -53086,6 +53178,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -53102,7 +53200,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -55559,9 +55657,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -55572,6 +55675,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -59199,7 +59303,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -59233,7 +59344,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -59255,7 +59366,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -59634,11 +59745,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -59663,6 +59769,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -59679,7 +59791,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -61715,9 +61827,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -61728,6 +61845,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -63685,7 +63803,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -63719,7 +63844,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -63741,7 +63866,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -64949,8 +65074,8 @@ simdjson_inline void validate_utf8_character() {
   // 2-byte
   if ((buf[idx] & 0x20) == 0) {
     // missing continuation
-    if (simdjson_unlikely(idx+1 > len || !is_continuation(buf[idx+1]))) {
-      if (idx+1 > len && is_streaming(partial)) { idx = len; return; }
+    if (simdjson_unlikely(idx+1 >= len || !is_continuation(buf[idx+1]))) {
+      if (idx+1 >= len && is_streaming(partial)) { idx = len; return; }
       error = UTF8_ERROR;
       idx++;
       return;
@@ -64964,8 +65089,8 @@ simdjson_inline void validate_utf8_character() {
   // 3-byte
   if ((buf[idx] & 0x10) == 0) {
     // missing continuation
-    if (simdjson_unlikely(idx+2 > len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]))) {
-      if (idx+2 > len && is_streaming(partial)) { idx = len; return; }
+    if (simdjson_unlikely(idx+2 >= len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]))) {
+      if (idx+2 >= len && is_streaming(partial)) { idx = len; return; }
       error = UTF8_ERROR;
       idx++;
       return;
@@ -64980,8 +65105,8 @@ simdjson_inline void validate_utf8_character() {
 
   // 4-byte
   // missing continuation
-  if (simdjson_unlikely(idx+3 > len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]) || !is_continuation(buf[idx+3]))) {
-    if (idx+2 > len && is_streaming(partial)) { idx = len; return; }
+  if (simdjson_unlikely(idx+3 >= len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]) || !is_continuation(buf[idx+3]))) {
+    if (idx+3 >= len && is_streaming(partial)) { idx = len; return; }
     error = UTF8_ERROR;
     idx++;
     return;
@@ -65103,9 +65228,15 @@ simdjson_warn_unused simdjson_inline error_code scan() {
       add_structural();
     // Primitive or invalid character (invalid characters will be checked in stage 2)
     } else {
-      // Anything else, add the structural and go until we find the next one
+      // Anything else, add the structural and go until we find the next one.
+      // We also stop on '"' so that an unclosed string still reaches
+      // validate_string(); a quote swallowed by the run would hide it. A
+      // quote cannot occur inside a valid primitive. We deliberately do not
+      // stop on every ESC_ASCII character: that also covers a backslash and the
+      // control characters, and ending the run there makes the fallback
+      // disagree with the SIMD kernels.
       add_structural();
-      while (idx+1<len && !char_is_space_or_operator(buf[idx+1])) {
+      while (idx+1<len && !char_is_space_or_operator(buf[idx+1]) && buf[idx+1] != '"') {
         idx++;
       };
     }
@@ -65125,7 +65256,7 @@ simdjson_warn_unused simdjson_inline error_code scan() {
       if (simdjson_unlikely(parser.n_structural_indexes == 0)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
index afcca85ad6bf..43fe09631c01 100644
--- a/deps/simdjson/simdjson.h
+++ b/deps/simdjson/simdjson.h
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-08-14 12:14:27 -0400. version 4.6.7 Do not edit! */
+/* auto-generated on 2026-09-04 16:04:31 -0400. version 4.6.11 Do not edit! */
 /* including simdjson.h:  */
 /* begin file simdjson.h */
 #ifndef SIMDJSON_H
@@ -260,7 +260,7 @@ using std::size_t;
 #endif
 #elif defined(__PPC64__) || defined(_M_PPC64)
 #define SIMDJSON_IS_PPC64 1
-#if defined(__ALTIVEC__)
+#if defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #define SIMDJSON_IS_PPC64_VMX 1
 #endif // defined(__ALTIVEC__)
 #else
@@ -2538,7 +2538,7 @@ namespace std {
 #define SIMDJSON_SIMDJSON_VERSION_H
 
 /** The version of simdjson being used (major.minor.revision) */
-#define SIMDJSON_VERSION "4.6.7"
+#define SIMDJSON_VERSION "4.6.11"
 
 namespace simdjson {
 enum {
@@ -2553,7 +2553,7 @@ enum {
   /**
    * The revision (major.minor.REVISION) of simdjson being used.
    */
-  SIMDJSON_VERSION_REVISION = 7
+  SIMDJSON_VERSION_REVISION = 11
 };
 } // namespace simdjson
 
@@ -4734,6 +4734,7 @@ inline char *allocate_padded_buffer(size_t length) noexcept {
 inline padded_string::padded_string() noexcept = default;
 inline padded_string::padded_string(size_t length) noexcept
     : viable_size(length), data_ptr(internal::allocate_padded_buffer(length)) {
+  if (data_ptr == nullptr) { viable_size = 0; }
 }
 inline padded_string::padded_string(const char *data, size_t length) noexcept
     : viable_size(length), data_ptr(internal::allocate_padded_buffer(length)) {
@@ -6351,6 +6352,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
   /**
@@ -9945,6 +9958,9 @@ simdjson_inline size_t document_stream::iterator::current_index() const noexcept
 
 simdjson_inline std::string_view document_stream::iterator::source() const noexcept {
   const char* start = reinterpret_cast<const char*>(stream->buf) + current_index();
+  if (stream->error) {
+    return std::string_view(start, stream->len - current_index());
+  }
   bool object_or_array = ((*start == '[') || (*start == '{'));
   if(object_or_array) {
     size_t next_doc_index = stream->batch_start + stream->parser->implementation->structural_indexes[stream->parser->implementation->next_structural_index - 1];
@@ -14993,9 +15009,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -15006,6 +15027,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -17206,9 +17228,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -17219,6 +17246,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -19906,9 +19934,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -19919,6 +19952,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -22606,9 +22640,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -22619,6 +22658,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -25421,9 +25461,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -25434,6 +25479,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -28553,9 +28599,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -28566,6 +28617,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -31185,9 +31237,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -31198,6 +31255,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -33795,9 +33853,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -33808,6 +33871,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -36422,9 +36486,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -36435,6 +36504,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -39845,7 +39915,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -41940,7 +42010,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -44522,7 +44592,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -47104,7 +47174,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -49801,7 +49871,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -52815,7 +52885,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -55303,7 +55373,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -57814,7 +57884,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -60329,7 +60399,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -66951,6 +67021,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -69201,6 +69283,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -70986,7 +71069,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -72864,13 +72947,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -80333,6 +80412,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -82583,6 +82674,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -84368,7 +84460,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -86246,13 +86338,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -94202,6 +94290,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -96452,6 +96552,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -98237,7 +98338,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -100115,13 +100216,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -108071,6 +108168,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -110321,6 +110430,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -112106,7 +112216,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -113984,13 +114094,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -122055,6 +122161,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -124305,6 +124423,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -126090,7 +126209,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -127968,13 +128087,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -136356,6 +136471,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -138606,6 +138733,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -140391,7 +140519,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -142269,13 +142397,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -150131,6 +150255,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -152381,6 +152517,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -154166,7 +154303,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -156044,13 +156181,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -163929,6 +164062,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -166179,6 +166324,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -167964,7 +168110,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -169842,13 +169988,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
@@ -177731,6 +177873,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -179981,6 +180135,7 @@ template <typename Func>
 template <typename Func>
 #endif
 inline error_code value::for_each_at_path_with_wildcard(std::string_view json_path, Func&& callback) noexcept {
+  if (size_t(iter.depth()) >= iter.json_iter().parser->max_depth()) { return DEPTH_ERROR; }
   json_type t;
   SIMDJSON_TRY(type().get(t));
   switch (t) {
@@ -181766,7 +181921,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -183644,13 +183799,9 @@ simdjson_inline bool raw_json_string::unsafe_is_equal(std::string_view target) c
   if(target.size() <= SIMDJSON_PADDING) {
     return (raw()[target.size()] == '"') && !memcmp(raw(), target.data(), target.size());
   }
-  const char * r{raw()};
-  size_t pos{0};
-  for(;pos < target.size();pos++) {
-    if(r[pos] != target[pos]) { return false; }
-  }
-  if(r[pos] != '"') { return false; }
-  return true;
+  // Past SIMDJSON_PADDING we can no longer rely on the padding to keep the
+  // comparison in bounds, so we must stop at the quote terminating the key.
+  return is_equal(target);
 }
 
 simdjson_inline bool raw_json_string::is_equal(std::string_view target) const noexcept {
diff --git a/deps/sqlite/unofficial.gni b/deps/sqlite/unofficial.gni
index 0e62accfb699..a0957c5769d6 100644
--- a/deps/sqlite/unofficial.gni
+++ b/deps/sqlite/unofficial.gni
@@ -4,47 +4,67 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("sqlite_gn_build") {
-  config("sqlite_config") {
-    include_dirs = [ "." ]
-    defines = [
-      "SQLITE_ENABLE_COLUMN_METADATA",
-      "SQLITE_ENABLE_DBSTAT_VTAB",
-      "SQLITE_ENABLE_FTS3",
-      "SQLITE_ENABLE_FTS3_PARENTHESIS",
-      "SQLITE_ENABLE_FTS5",
-      "SQLITE_ENABLE_GEOPOLY",
-      "SQLITE_ENABLE_MATH_FUNCTIONS",
-      "SQLITE_ENABLE_PERCENTILE",
-      "SQLITE_ENABLE_PREUPDATE_HOOK",
-      "SQLITE_ENABLE_RBU",
-      "SQLITE_ENABLE_RTREE",
-      "SQLITE_ENABLE_SESSION",
-    ]
-  }
+  if (node_shared_sqlite) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("sqlite_config") {
+      packages = [ "sqlite3" ]
+    }
+    # sqlite3.h only declares the session extension when this is defined.
+    config("sqlite_defines") {
+      defines = [ "SQLITE_ENABLE_SESSION" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [
+        ":sqlite_config",
+        ":sqlite_defines",
+      ]
+    }
+  } else {
+    config("sqlite_config") {
+      include_dirs = [ "." ]
+      defines = [
+        "SQLITE_ENABLE_COLUMN_METADATA",
+        "SQLITE_ENABLE_DBSTAT_VTAB",
+        "SQLITE_ENABLE_FTS3",
+        "SQLITE_ENABLE_FTS3_PARENTHESIS",
+        "SQLITE_ENABLE_FTS5",
+        "SQLITE_ENABLE_GEOPOLY",
+        "SQLITE_ENABLE_MATH_FUNCTIONS",
+        "SQLITE_ENABLE_PERCENTILE",
+        "SQLITE_ENABLE_PREUPDATE_HOOK",
+        "SQLITE_ENABLE_RBU",
+        "SQLITE_ENABLE_RTREE",
+        "SQLITE_ENABLE_SESSION",
+      ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("sqlite.gyp") ],
-                            "scope",
-                            [ "sqlite.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("sqlite.gyp") ],
+                              "scope",
+                              [ "sqlite.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":sqlite_config" ]
-    sources = gypi_values.sqlite_sources
-    cflags_c = [
-      "-Wno-implicit-fallthrough",
-      "-Wno-unreachable-code-return",
-      "-Wno-unreachable-code-break",
-      "-Wno-unreachable-code",
-    ]
-    if (is_win) {
-      cflags_c += [
-        "-Wno-sign-compare",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-variable",
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":sqlite_config" ]
+      sources = gypi_values.sqlite_sources
+      cflags_c = [
+        "-Wno-implicit-fallthrough",
+        "-Wno-unreachable-code-return",
+        "-Wno-unreachable-code-break",
+        "-Wno-unreachable-code",
       ]
+      if (is_win) {
+        cflags_c += [
+          "-Wno-sign-compare",
+          "-Wno-unused-but-set-variable",
+          "-Wno-unused-function",
+          "-Wno-unused-variable",
+        ]
+      }
     }
   }
 }
diff --git a/deps/uv/unofficial.gni b/deps/uv/unofficial.gni
index 0944d6ddd241..a2891887839b 100644
--- a/deps/uv/unofficial.gni
+++ b/deps/uv/unofficial.gni
@@ -4,113 +4,126 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("uv_gn_build") {
-  config("uv_external_config") {
-    include_dirs = [ "include" ]
-    if (is_clang || !is_win) {
-      cflags_cc = [
-        "-Wno-deprecated-pragma",  # for using ENODATA in errno.h
-      ]
-    }
-  }
-
-  config("uv_internal_config") {
-    include_dirs = [
-      "include",
-      "src",
-    ]
+import("../../node.gni")
 
-    defines = [ "BUILDING_UV_SHARED" ]  # always export symbols
-    if (is_posix) {
-      defines += [
-        "_LARGEFILE_SOURCE",
-        "_FILE_OFFSET_BITS=64",
-      ]
+template("uv_gn_build") {
+  if (node_shared_libuv) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("uv_external_config") {
+      packages = [ "libuv" ]
     }
-    if (is_linux) {
-      defines += [
-        "_POSIX_C_SOURCE=200112",
-        "_GNU_SOURCE",
-      ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":uv_external_config" ]
     }
-    if (is_apple) {
-      defines += [
-        "_DARWIN_USE_64_BIT_INODE=1",
-        "_DARWIN_UNLIMITED_SELECT=1",
-      ]
+  } else {
+    config("uv_external_config") {
+      include_dirs = [ "include" ]
+      if (is_clang || !is_win) {
+        cflags_cc = [
+          "-Wno-deprecated-pragma",  # for using ENODATA in errno.h
+        ]
+      }
     }
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-deprecated-declarations",
-        "-Wno-extra-semi",
-        "-Wno-implicit-fallthrough",
-        "-Wno-missing-braces",
-        "-Wno-sign-compare",
-        "-Wno-string-conversion",
-        "-Wno-shadow",
-        "-Wno-unreachable-code",
-        "-Wno-unreachable-code-return",
-        "-Wno-unused-but-set-parameter",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-result",
-        "-Wno-unused-variable",
+
+    config("uv_internal_config") {
+      include_dirs = [
+        "include",
+        "src",
       ]
+
+      defines = [ "BUILDING_UV_SHARED" ]  # always export symbols
+      if (is_posix) {
+        defines += [
+          "_LARGEFILE_SOURCE",
+          "_FILE_OFFSET_BITS=64",
+        ]
+      }
+      if (is_linux) {
+        defines += [
+          "_POSIX_C_SOURCE=200112",
+          "_GNU_SOURCE",
+        ]
+      }
+      if (is_apple) {
+        defines += [
+          "_DARWIN_USE_64_BIT_INODE=1",
+          "_DARWIN_UNLIMITED_SELECT=1",
+        ]
+      }
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-deprecated-declarations",
+          "-Wno-extra-semi",
+          "-Wno-implicit-fallthrough",
+          "-Wno-missing-braces",
+          "-Wno-sign-compare",
+          "-Wno-string-conversion",
+          "-Wno-shadow",
+          "-Wno-unreachable-code",
+          "-Wno-unreachable-code-return",
+          "-Wno-unused-but-set-parameter",
+          "-Wno-unused-but-set-variable",
+          "-Wno-unused-function",
+          "-Wno-unused-result",
+          "-Wno-unused-variable",
+        ]
+      }
     }
-  }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("uv.gyp") ],
-                            "scope",
-                            [ "uv.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("uv.gyp") ],
+                              "scope",
+                              [ "uv.gyp" ])
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
+    component(target_name) {
+      forward_variables_from(invoker, "*")
 
-    configs += [ ":uv_internal_config" ]
-    public_configs = [ ":uv_external_config" ]
+      configs += [ ":uv_internal_config" ]
+      public_configs = [ ":uv_external_config" ]
 
-    if (is_posix) {
-      configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
-      configs += [ "//build/config/gcc:symbol_visibility_default" ]
-    }
+      if (is_posix) {
+        configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
+        configs += [ "//build/config/gcc:symbol_visibility_default" ]
+      }
 
-    if (is_win) {
-      libs = [
-        "advapi32.lib",
-        "iphlpapi.lib",
-        "psapi.lib",
-        "shell32.lib",
-        "user32.lib",
-        "userenv.lib",
-        "ws2_32.lib",
-      ]
-    }
-    if (is_posix) {
-      ldflags = [ "-pthread" ]
-    }
-    if (is_linux) {
-      libs = [
-        "m",
-        "dl",
-        "rt",
-      ]
-    }
+      if (is_win) {
+        libs = [
+          "advapi32.lib",
+          "iphlpapi.lib",
+          "psapi.lib",
+          "shell32.lib",
+          "user32.lib",
+          "userenv.lib",
+          "ws2_32.lib",
+        ]
+      }
+      if (is_posix) {
+        ldflags = [ "-pthread" ]
+      }
+      if (is_linux) {
+        libs = [
+          "m",
+          "dl",
+          "rt",
+        ]
+      }
 
-    sources = gypi_values.uv_sources_common
-    if (is_win) {
-      sources += gypi_values.uv_sources_win
-    }
-    if (is_posix) {
-      sources += gypi_values.uv_sources_posix +
-                 [ "src/unix/proctitle.c" ]
-    }
-    if (is_linux) {
-      sources += gypi_values.uv_sources_linux
-    }
-    if (is_apple) {
-      sources += gypi_values.uv_sources_apple +
-                 gypi_values.uv_sources_bsd_common
+      sources = gypi_values.uv_sources_common
+      if (is_win) {
+        sources += gypi_values.uv_sources_win
+      }
+      if (is_posix) {
+        sources += gypi_values.uv_sources_posix +
+                   [ "src/unix/proctitle.c" ]
+      }
+      if (is_linux) {
+        sources += gypi_values.uv_sources_linux
+      }
+      if (is_apple) {
+        sources += gypi_values.uv_sources_apple +
+                   gypi_values.uv_sources_bsd_common
+      }
     }
   }
 }
diff --git a/deps/v8/src/base/platform/platform-aix.cc b/deps/v8/src/base/platform/platform-aix.cc
index ed4b59133875..40097395f4e4 100644
--- a/deps/v8/src/base/platform/platform-aix.cc
+++ b/deps/v8/src/base/platform/platform-aix.cc
@@ -171,34 +171,9 @@ bool OS::DecommitPages(void* address, size_t size) {
   // with MAP_FIXED will fail and return -1 unless the application has requested
   // SPEC1170 compliant behaviour:
   // https://www.ibm.com/docs/en/aix/7.3?topic=m-mmap-mmap64-subroutine
-  // Therefore in case if failure we need to unmap the address before trying to
-  // map it again. The downside is another thread could place another mapping at
-  // the same address after the munmap but before the mmap, therefore a CHECK is
-  // also added to assure the address is mapped successfully. Refer to the
-  // comments under https://crrev.com/c/3010195 for more details.
-#define MMAP() \
-  mmap(address, size, PROT_NONE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0)
   DCHECK_EQ(0, reinterpret_cast<uintptr_t>(address) % CommitPageSize());
   DCHECK_EQ(0, size % CommitPageSize());
-  void* ptr;
-  // Try without mapping first.
-  ptr = MMAP();
-  if (ptr != address) {
-    DCHECK_EQ(ptr, MAP_FAILED);
-    // Returns 0 when successful.
-    if (munmap(address, size)) {
-      return false;
-    }
-    // Try again after unmap.
-    ptr = MMAP();
-    // If this check fails it's most likely due to a racing condition where
-    // another thread has mapped the same address right before we do.
-    // Since this could cause hard-to-debug issues, potentially with security
-    // impact, and we can't recover from this, the best we can do is abort the
-    // process.
-    CHECK_EQ(ptr, address);
-  }
-#undef MMAP
+  if (mprotect(address, size, PROT_NONE) != 0) return false;
   return true;
 }
 
diff --git a/deps/v8/src/builtins/arm64/builtins-arm64.cc b/deps/v8/src/builtins/arm64/builtins-arm64.cc
index 1a2d310bfeed..e99d10aacf9f 100644
--- a/deps/v8/src/builtins/arm64/builtins-arm64.cc
+++ b/deps/v8/src/builtins/arm64/builtins-arm64.cc
@@ -1293,11 +1293,12 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
 
     FrameScope frame_scope(masm, StackFrame::INTERNAL);
     // Save incoming new target or generator
-    Register maybe_dispatch_handle = V8_ENABLE_LEAPTIERING_BOOL
+    Register maybe_dispatch_handle = V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE_BOOL
                                          ? kJavaScriptCallDispatchHandleRegister
                                          : padreg;
     // No need to SmiTag as dispatch handles always look like Smis.
     static_assert(kJSDispatchHandleShift > 0);
+    __ AssertSmi(maybe_dispatch_handle);
     __ Push(maybe_dispatch_handle, new_target);
     __ SmiTag(frame_size);
     __ PushArgument(frame_size);
diff --git a/deps/v8/src/builtins/loong64/builtins-loong64.cc b/deps/v8/src/builtins/loong64/builtins-loong64.cc
index 42f6c346733d..2206ec09182c 100644
--- a/deps/v8/src/builtins/loong64/builtins-loong64.cc
+++ b/deps/v8/src/builtins/loong64/builtins-loong64.cc
@@ -1103,15 +1103,16 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
     FrameScope frame_scope(masm, StackFrame::INTERNAL);
     // Save incoming new target or generator
     __ Push(kJavaScriptCallNewTargetRegister);
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
     // No need to SmiTag as dispatch handles always look like Smis.
     static_assert(kJSDispatchHandleShift > 0);
+    __ AssertSmi(kJavaScriptCallDispatchHandleRegister);
     __ Push(kJavaScriptCallDispatchHandleRegister);
 #endif
     __ SmiTag(frame_size);
     __ Push(frame_size);
     __ CallRuntime(Runtime::kStackGuardWithGap);
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
     __ Pop(kJavaScriptCallDispatchHandleRegister);
 #endif
     __ Pop(kJavaScriptCallNewTargetRegister);
diff --git a/deps/v8/src/builtins/mips64/builtins-mips64.cc b/deps/v8/src/builtins/mips64/builtins-mips64.cc
index cf7ee09c52a8..05333d63e972 100644
--- a/deps/v8/src/builtins/mips64/builtins-mips64.cc
+++ b/deps/v8/src/builtins/mips64/builtins-mips64.cc
@@ -1065,15 +1065,16 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
     FrameScope frame_scope(masm, StackFrame::INTERNAL);
     // Save incoming new target or generator
     __ Push(kJavaScriptCallNewTargetRegister);
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
     // No need to SmiTag as dispatch handles always look like Smis.
     static_assert(kJSDispatchHandleShift > 0);
+    __ AssertSmi(kJavaScriptCallDispatchHandleRegister);
     __ Push(kJavaScriptCallDispatchHandleRegister);
 #endif
     __ SmiTag(frame_size);
     __ Push(frame_size);
     __ CallRuntime(Runtime::kStackGuardWithGap);
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
     __ Pop(kJavaScriptCallDispatchHandleRegister);
 #endif
     __ Pop(kJavaScriptCallNewTargetRegister);
diff --git a/deps/v8/src/builtins/riscv/builtins-riscv.cc b/deps/v8/src/builtins/riscv/builtins-riscv.cc
index 06649f0a8134..260bd1b22df2 100644
--- a/deps/v8/src/builtins/riscv/builtins-riscv.cc
+++ b/deps/v8/src/builtins/riscv/builtins-riscv.cc
@@ -1099,15 +1099,18 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
     FrameScope frame_scope(masm, StackFrame::INTERNAL);
     // Save incoming new target or generator
     __ Push(kJavaScriptCallNewTargetRegister);
-#if defined(V8_ENABLE_LEAPTIERING) && defined(V8_TARGET_ARCH_RISCV64)
+#if defined(V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE) && \
+    defined(V8_TARGET_ARCH_RISCV64)
     // No need to SmiTag as dispatch handles always look like Smis.
     static_assert(kJSDispatchHandleShift > 0);
+    __ AssertSmi(kJavaScriptCallDispatchHandleRegister);
     __ Push(kJavaScriptCallDispatchHandleRegister);
 #endif
     __ SmiTag(frame_size);
     __ Push(frame_size);
     __ CallRuntime(Runtime::kStackGuardWithGap);
-#if defined(V8_ENABLE_LEAPTIERING) && defined(V8_TARGET_ARCH_RISCV64)
+#if defined(V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE) && \
+    defined(V8_TARGET_ARCH_RISCV64)
     __ Pop(kJavaScriptCallDispatchHandleRegister);
 #endif
     __ Pop(kJavaScriptCallNewTargetRegister);
diff --git a/deps/v8/src/builtins/x64/builtins-x64.cc b/deps/v8/src/builtins/x64/builtins-x64.cc
index b212110efb7b..f6edcf8fd086 100644
--- a/deps/v8/src/builtins/x64/builtins-x64.cc
+++ b/deps/v8/src/builtins/x64/builtins-x64.cc
@@ -2018,15 +2018,16 @@ void Builtins::Generate_BaselineOutOfLinePrologue(MacroAssembler* masm) {
       FrameScope inner_frame_scope(masm, StackFrame::INTERNAL);
       // Save incoming new target or generator
       __ Push(new_target);
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
       // No need to SmiTag as dispatch handles always look like Smis.
       static_assert(kJSDispatchHandleShift > 0);
+      __ AssertSmi(kJavaScriptCallDispatchHandleRegister);
       __ Push(kJavaScriptCallDispatchHandleRegister);
 #endif
       __ SmiTag(frame_size);
       __ Push(frame_size);
       __ CallRuntime(Runtime::kStackGuardWithGap, 1);
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
       __ Pop(kJavaScriptCallDispatchHandleRegister);
 #endif
       __ Pop(new_target);
diff --git a/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc b/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
index 18caab8c5b9f..9a14650a1521 100644
--- a/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
+++ b/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
@@ -1518,14 +1518,15 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
     FrameScope scope(this, StackFrame::INTERNAL);
     // Push a copy of the target function, the new target, the actual
     // argument count, and the dispatch handle.
-    Register lastreg = V8_ENABLE_LEAPTIERING_BOOL
-                           ? kJavaScriptCallDispatchHandleRegister
-                           : padreg;
+    Register maybe_dispatch_handle = V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE_BOOL
+                                         ? kJavaScriptCallDispatchHandleRegister
+                                         : padreg;
     SmiTag(kJavaScriptCallArgCountRegister);
     // No need to SmiTag the dispatch handle as it always looks like a Smi.
     static_assert(kJSDispatchHandleShift > 0);
+    AssertSmi(maybe_dispatch_handle);
     Push(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
-         kJavaScriptCallArgCountRegister, lastreg);
+         kJavaScriptCallArgCountRegister, maybe_dispatch_handle);
     // Push another copy as a parameter to the runtime call.
     PushArgument(kJavaScriptCallTargetRegister);
 
@@ -1534,7 +1535,7 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
 
     // Restore target function, new target, actual argument count, and dispatch
     // handle.
-    Pop(lastreg, kJavaScriptCallArgCountRegister,
+    Pop(maybe_dispatch_handle, kJavaScriptCallArgCountRegister,
         kJavaScriptCallNewTargetRegister, kJavaScriptCallTargetRegister);
     SmiUntag(kJavaScriptCallArgCountRegister);
   }
diff --git a/deps/v8/src/codegen/loong64/macro-assembler-loong64.cc b/deps/v8/src/codegen/loong64/macro-assembler-loong64.cc
index 2bb8052af7b7..b227f5757b55 100644
--- a/deps/v8/src/codegen/loong64/macro-assembler-loong64.cc
+++ b/deps/v8/src/codegen/loong64/macro-assembler-loong64.cc
@@ -5113,9 +5113,10 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
     SmiTag(kJavaScriptCallArgCountRegister);
     Push(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
          kJavaScriptCallArgCountRegister);
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
     // No need to SmiTag since dispatch handles always look like Smis.
     static_assert(kJSDispatchHandleShift > 0);
+    AssertSmi(kJavaScriptCallDispatchHandleRegister);
     Push(kJavaScriptCallDispatchHandleRegister);
 #endif
     // Function is also the parameter to the runtime call.
@@ -5126,7 +5127,7 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
 
     // Restore target function, new target, actual argument count and dispatch
     // handle.
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
     Pop(kJavaScriptCallDispatchHandleRegister);
 #endif
     Pop(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
diff --git a/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc b/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc
index 30bf3dbd2055..13fde931d186 100644
--- a/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc
+++ b/deps/v8/src/codegen/mips64/macro-assembler-mips64.cc
@@ -6578,16 +6578,17 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
     SmiTag(kJavaScriptCallArgCountRegister);
     Push(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
          kJavaScriptCallArgCountRegister);
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
     // No need to SmiTag since dispatch handles always look like Smis.
     static_assert(kJSDispatchHandleShift > 0);
+    AssertSmi(kJavaScriptCallDispatchHandleRegister);
     Push(kJavaScriptCallDispatchHandleRegister);
 #endif
     // Function is also the parameter to the runtime call.
     Push(kJavaScriptCallTargetRegister);
     CallRuntime(function_id, 1);
     // Restore target function, new target and actual argument count.
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
     Pop(kJavaScriptCallDispatchHandleRegister);
 #endif
     Pop(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
diff --git a/deps/v8/src/codegen/riscv/macro-assembler-riscv.cc b/deps/v8/src/codegen/riscv/macro-assembler-riscv.cc
index 203b2bcd61c7..558a6adb1866 100644
--- a/deps/v8/src/codegen/riscv/macro-assembler-riscv.cc
+++ b/deps/v8/src/codegen/riscv/macro-assembler-riscv.cc
@@ -186,15 +186,23 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
   //  -- a0 : actual argument count
   //  -- a1 : target function (preserved for callee)
   //  -- a3 : new target (preserved for callee)
+  //  -- a4 : dispatch handle (preserved for callee)
   // -----------------------------------
   {
     FrameScope scope(this, StackFrame::INTERNAL);
-    // Push a copy of the target function, the new target and the actual
-    // argument count.
+    // Push a copy of the target function, the new target, the actual
+    // argument count, and the dispatch handle.
     // Push function as parameter to the runtime call.
     SmiTag(kJavaScriptCallArgCountRegister);
+#if defined(V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE) && \
+    defined(V8_TARGET_ARCH_RISCV64)
+    // No need to SmiTag as dispatch handles always look like Smis.
+    static_assert(kJSDispatchHandleShift > 0);
+    AssertSmi(kJavaScriptCallDispatchHandleRegister);
+    Push(kJavaScriptCallDispatchHandleRegister);
+#endif
     Push(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
-         kJavaScriptCallArgCountRegister, kJavaScriptCallTargetRegister);
+         kJavaScriptCallArgCountRegister);
 
     CallRuntime(function_id, 1);
     // Use the return value before restoring a0
@@ -202,6 +210,10 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
     // Restore target function, new target and actual argument count.
     Pop(kJavaScriptCallTargetRegister, kJavaScriptCallNewTargetRegister,
         kJavaScriptCallArgCountRegister);
+#if defined(V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE) && \
+    defined(V8_TARGET_ARCH_RISCV64)
+    Pop(kJavaScriptCallDispatchHandleRegister);
+#endif
     SmiUntag(kJavaScriptCallArgCountRegister);
   }
 
diff --git a/deps/v8/src/codegen/x64/macro-assembler-x64.cc b/deps/v8/src/codegen/x64/macro-assembler-x64.cc
index 243438b57f3c..46b644fac005 100644
--- a/deps/v8/src/codegen/x64/macro-assembler-x64.cc
+++ b/deps/v8/src/codegen/x64/macro-assembler-x64.cc
@@ -1247,9 +1247,10 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
     Push(kJavaScriptCallNewTargetRegister);
     SmiTag(kJavaScriptCallArgCountRegister);
     Push(kJavaScriptCallArgCountRegister);
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
     // No need to SmiTag since dispatch handles always look like Smis.
     static_assert(kJSDispatchHandleShift > 0);
+    AssertSmi(kJavaScriptCallDispatchHandleRegister);
     Push(kJavaScriptCallDispatchHandleRegister);
 #endif
     // Function is also the parameter to the runtime call.
@@ -1260,7 +1261,7 @@ void MacroAssembler::GenerateTailCallToReturnedCode(
 
     // Restore target function, new target, actual argument count, and dispatch
     // handle.
-#ifdef V8_ENABLE_LEAPTIERING
+#ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
     Pop(kJavaScriptCallDispatchHandleRegister);
 #endif
     Pop(kJavaScriptCallArgCountRegister);
diff --git a/deps/v8/src/compiler/heap-refs.cc b/deps/v8/src/compiler/heap-refs.cc
index 7a470132d7fc..1d379a2fc6e1 100644
--- a/deps/v8/src/compiler/heap-refs.cc
+++ b/deps/v8/src/compiler/heap-refs.cc
@@ -839,34 +839,33 @@ InstanceType HeapObjectData::GetMapInstanceType() const {
 
 namespace {
 
-bool IsReadOnlyLengthDescriptor(Isolate* isolate,
-                                DirectHandle<Map> jsarray_map) {
-  DCHECK(!jsarray_map->is_dictionary_map());
-  Tagged<DescriptorArray> descriptors =
-      jsarray_map->instance_descriptors(isolate, kRelaxedLoad);
+bool IsReadOnlyLengthDescriptor(JSHeapBroker* broker, MapRef jsarray_map) {
+  DCHECK(!jsarray_map.is_dictionary_map());
+  DescriptorArrayRef descriptors = jsarray_map.instance_descriptors(broker);
   static_assert(
       JSArray::kLengthOffset == JSObject::kHeaderSize,
       "The length should be the first property on the descriptor array");
   InternalIndex offset(0);
-  return descriptors->GetDetails(offset).IsReadOnly();
+  return descriptors.GetPropertyDetails(offset).IsReadOnly();
 }
 
 // Important: this predicate does not check Protectors::IsNoElementsIntact. The
 // compiler checks protectors through the compilation dependency mechanism; it
 // doesn't make sense to do that here as part of every MapData construction.
 // Callers *must* take care to take the correct dependency themselves.
-bool SupportsFastArrayIteration(JSHeapBroker* broker, DirectHandle<Map> map) {
-  return map->instance_type() == JS_ARRAY_TYPE &&
-         IsFastElementsKind(map->elements_kind()) &&
-         IsJSArray(map->prototype()) &&
-         broker->IsArrayOrObjectPrototype(broker->CanonicalPersistentHandle(
-             Cast<JSArray>(map->prototype())));
+bool SupportsFastArrayIteration(JSHeapBroker* broker, MapRef map) {
+  if (map.instance_type() != JS_ARRAY_TYPE ||
+      !IsFastElementsKind(map.elements_kind())) {
+    return false;
+  }
+  HeapObjectRef prototype = map.prototype(broker);
+  return prototype.IsJSArray() &&
+         prototype.AsJSArray().IsArrayOrObjectPrototype(broker);
 }
 
-bool SupportsFastArrayResize(JSHeapBroker* broker, DirectHandle<Map> map) {
-  return SupportsFastArrayIteration(broker, map) && map->is_extensible() &&
-         !map->is_dictionary_map() &&
-         !IsReadOnlyLengthDescriptor(broker->isolate(), map);
+bool SupportsFastArrayResize(JSHeapBroker* broker, MapRef map) {
+  return SupportsFastArrayIteration(broker, map) && map.is_extensible() &&
+         !map.is_dictionary_map() && !IsReadOnlyLengthDescriptor(broker, map);
 }
 
 }  // namespace
@@ -1039,8 +1038,6 @@ void JSHeapBroker::InitializeAndStartSerializing(
   refs_ =
       zone()->New<RefsMap>(kInitialRefsBucketCount, AddressMatcher(), zone());
 
-  CollectArrayAndObjectPrototypes();
-
   SetTargetNativeContextRef(target_native_context);
 }
 
@@ -1250,11 +1247,11 @@ bool MapRef::PrototypesElementsDoNotHaveAccessorsOrThrow(
 }
 
 bool MapRef::supports_fast_array_iteration(JSHeapBroker* broker) const {
-  return SupportsFastArrayIteration(broker, object());
+  return SupportsFastArrayIteration(broker, *this);
 }
 
 bool MapRef::supports_fast_array_resize(JSHeapBroker* broker) const {
-  return SupportsFastArrayResize(broker, object());
+  return SupportsFastArrayResize(broker, *this);
 }
 
 namespace {
@@ -1626,6 +1623,7 @@ HEAP_ACCESSOR_B(Map, bit_field3, NumberOfOwnDescriptors,
                 Map::Bits3::NumberOfOwnDescriptorsBits)
 HEAP_ACCESSOR_B(Map, bit_field3, is_migration_target,
                 Map::Bits3::IsMigrationTargetBit)
+BIMODAL_ACCESSOR_B(Map, bit_field3, is_extensible, Map::Bits3::IsExtensibleBit)
 BIMODAL_ACCESSOR_B(Map, bit_field3, construction_counter,
                    Map::Bits3::ConstructionCounterBits)
 HEAP_ACCESSOR_B(Map, bit_field, has_prototype_slot,
@@ -1807,6 +1805,11 @@ ObjectRef MapRef::GetConstructor(JSHeapBroker* broker) const {
   return MakeRefAssumeMemoryFence(broker, object()->GetConstructor());
 }
 
+NativeContextRef MapRef::native_context(JSHeapBroker* broker) const {
+  // Immutable after initialization.
+  return MakeRefAssumeMemoryFence(broker, object()->native_context());
+}
+
 HeapObjectRef MapRef::GetBackPointer(JSHeapBroker* broker) const {
   // Immutable after initialization.
   return MakeRefAssumeMemoryFence(broker,
@@ -2461,6 +2464,19 @@ OptionalMapRef JSObjectRef::GetObjectCreateMap(JSHeapBroker* broker) const {
       maybe_object_create_map.GetHeapObjectAssumeWeak(), kAssumeMemoryFence));
 }
 
+bool JSObjectRef::IsArrayOrObjectPrototype(JSHeapBroker* broker) const {
+  MapRef map = this->map(broker);
+  if (map.instance_type() == JS_OBJECT_PROTOTYPE_TYPE) return true;
+  // Keep in sync with Isolate::IsInCreationContext:
+  MapRef metamap = map.map(broker);
+  // Filter out native-context independent objects.
+  if (*metamap.object() == ReadOnlyRoots(broker->isolate()).meta_map())
+    return false;
+  OptionalNativeContextRef native_context = metamap.native_context(broker);
+  if (!native_context.has_value()) return false;
+  return native_context->initial_array_prototype(broker).equals(*this);
+}
+
 bool PropertyCellRef::Cache(JSHeapBroker* broker) const {
   if (data_->should_access_heap()) return true;
   CHECK(broker->mode() == JSHeapBroker::kSerializing ||
diff --git a/deps/v8/src/compiler/heap-refs.h b/deps/v8/src/compiler/heap-refs.h
index cdf57451546e..04917b153df6 100644
--- a/deps/v8/src/compiler/heap-refs.h
+++ b/deps/v8/src/compiler/heap-refs.h
@@ -623,6 +623,10 @@ class JSObjectRef : public JSReceiverRef {
   bool IsElementsTenured(FixedArrayBaseRef elements);
 
   OptionalMapRef GetObjectCreateMap(JSHeapBroker* broker) const;
+
+  // Check if this object is its creation context's %ArrayPrototype% or
+  // %ObjectPrototype%.
+  bool IsArrayOrObjectPrototype(JSHeapBroker* broker) const;
 };
 
 class JSDataViewRef : public JSObjectRef {
@@ -899,6 +903,7 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
   bool has_indexed_interceptor() const;
   int construction_counter() const;
   bool is_migration_target() const;
+  bool is_extensible() const;
   bool supports_fast_array_iteration(JSHeapBroker* broker) const;
   bool supports_fast_array_resize(JSHeapBroker* broker) const;
   bool is_abandoned_prototype_map() const;
@@ -940,6 +945,7 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
 
   MapRef FindRootMap(JSHeapBroker* broker) const;
   ObjectRef GetConstructor(JSHeapBroker* broker) const;
+  NativeContextRef native_context(JSHeapBroker* broker) const;
 };
 
 struct HolderLookupResult {
diff --git a/deps/v8/src/compiler/js-heap-broker.cc b/deps/v8/src/compiler/js-heap-broker.cc
index 3a7949ce8e43..2fddcf1c06c4 100644
--- a/deps/v8/src/compiler/js-heap-broker.cc
+++ b/deps/v8/src/compiler/js-heap-broker.cc
@@ -47,7 +47,6 @@ JSHeapBroker::JSHeapBroker(Isolate* isolate, Zone* broker_zone,
       refs_(zone()->New<RefsMap>(kMinimalRefsBucketCount, AddressMatcher(),
                                  zone())),
       root_index_map_(isolate),
-      array_and_object_prototypes_(zone()),
       tracing_enabled_(tracing_enabled),
       code_kind_(code_kind),
       feedback_(zone()),
@@ -118,28 +117,6 @@ void JSHeapBroker::SetTargetNativeContextRef(
   target_native_context_ = MakeRef(this, *native_context);
 }
 
-void JSHeapBroker::CollectArrayAndObjectPrototypes() {
-  DisallowGarbageCollection no_gc;
-  CHECK_EQ(mode(), kSerializing);
-  CHECK(array_and_object_prototypes_.empty());
-
-  Tagged<Object> maybe_context = isolate()->heap()->native_contexts_list();
-  while (!IsUndefined(maybe_context, isolate())) {
-    Tagged<Context> context = Cast<Context>(maybe_context);
-    Tagged<Object> array_prot =
-        context->get(Context::INITIAL_ARRAY_PROTOTYPE_INDEX);
-    Tagged<Object> object_prot =
-        context->get(Context::INITIAL_OBJECT_PROTOTYPE_INDEX);
-    array_and_object_prototypes_.emplace(
-        CanonicalPersistentHandle(Cast<JSObject>(array_prot)));
-    array_and_object_prototypes_.emplace(
-        CanonicalPersistentHandle(Cast<JSObject>(object_prot)));
-    maybe_context = context->next_context_link();
-  }
-
-  CHECK(!array_and_object_prototypes_.empty());
-}
-
 StringRef JSHeapBroker::GetTypedArrayStringTag(ElementsKind kind) {
   DCHECK(IsTypedArrayOrRabGsabTypedArrayElementsKind(kind));
   switch (kind) {
@@ -154,21 +131,6 @@ StringRef JSHeapBroker::GetTypedArrayStringTag(ElementsKind kind) {
   }
 }
 
-bool JSHeapBroker::IsArrayOrObjectPrototype(JSObjectRef object) const {
-  return IsArrayOrObjectPrototype(object.object());
-}
-
-bool JSHeapBroker::IsArrayOrObjectPrototype(Handle<JSObject> object) const {
-  if (mode() == kDisabled) {
-    return isolate()->IsInCreationContext(
-               *object, Context::INITIAL_ARRAY_PROTOTYPE_INDEX) ||
-           object->map(isolate_)->instance_type() == JS_OBJECT_PROTOTYPE_TYPE;
-  }
-  CHECK(!array_and_object_prototypes_.empty());
-  return array_and_object_prototypes_.find(object) !=
-         array_and_object_prototypes_.end();
-}
-
 ObjectData* JSHeapBroker::TryGetOrCreateData(Tagged<Object> object,
                                              GetOrCreateDataFlags flags) {
   return TryGetOrCreateData(CanonicalPersistentHandle(object), flags);
diff --git a/deps/v8/src/compiler/js-heap-broker.h b/deps/v8/src/compiler/js-heap-broker.h
index 52677f517f5e..6dcc7cb8675e 100644
--- a/deps/v8/src/compiler/js-heap-broker.h
+++ b/deps/v8/src/compiler/js-heap-broker.h
@@ -192,11 +192,6 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   ObjectData* TryGetOrCreateData(Tagged<Object> object,
                                  GetOrCreateDataFlags flags = {});
 
-  // Check if {object} is any native context's %ArrayPrototype% or
-  // %ObjectPrototype%.
-  bool IsArrayOrObjectPrototype(JSObjectRef object) const;
-  bool IsArrayOrObjectPrototype(Handle<JSObject> object) const;
-
   bool HasFeedback(FeedbackSource const& source) const;
   void SetFeedback(FeedbackSource const& source,
                    ProcessedFeedback const* feedback);
@@ -285,12 +280,11 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
     if (Tagged<HeapObject> heap_object;
         TryCast<HeapObject>(object, &heap_object)) {
       RootIndex root_index;
-      // CollectArrayAndObjectPrototypes calls this function often with T equal
-      // to JSObject. The root index map only contains immortal, immutable
-      // objects; it never contains any instances of type JSObject, since
-      // JSObjects must exist within a NativeContext, and NativeContexts can be
-      // created and destroyed. Thus, we can skip the lookup in the root index
-      // map for those values and save a little time.
+      // The root index map only contains immortal, immutable objects; it never
+      // contains any instances of type JSObject, since JSObjects must exist
+      // within a NativeContext, and NativeContexts can be created and
+      // destroyed. Thus, we can skip the lookup in the root index map for those
+      // values and save a little time.
       if constexpr (std::is_convertible_v<T, JSObject>) {
         DCHECK(!root_index_map_.Lookup(heap_object, &root_index));
       } else if (root_index_map_.Lookup(heap_object, &root_index)) {
@@ -428,8 +422,6 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   ProcessedFeedback const& ReadFeedbackForTemplateObject(
       FeedbackSource const& source);
 
-  void CollectArrayAndObjectPrototypes();
-
   void set_persistent_handles(
       std::unique_ptr<PersistentHandles> persistent_handles) {
     DCHECK_NULL(ph_);
@@ -457,9 +449,6 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   OptionalNativeContextRef target_native_context_;
   RefsMap* refs_;
   RootIndexMap root_index_map_;
-  ZoneUnorderedSet<IndirectHandle<JSObject>, IndirectHandle<JSObject>::hash,
-                   IndirectHandle<JSObject>::equal_to>
-      array_and_object_prototypes_;
   BrokerMode mode_ = kDisabled;
   bool const tracing_enabled_;
   CodeKind const code_kind_;
diff --git a/deps/v8/src/compiler/js-native-context-specialization.cc b/deps/v8/src/compiler/js-native-context-specialization.cc
index e7a2abed27da..17b5f722fc82 100644
--- a/deps/v8/src/compiler/js-native-context-specialization.cc
+++ b/deps/v8/src/compiler/js-native-context-specialization.cc
@@ -4245,7 +4245,7 @@ bool JSNativeContextSpecialization::CanTreatHoleAsUndefined(
   for (MapRef receiver_map : receiver_maps) {
     ObjectRef receiver_prototype = receiver_map.prototype(broker());
     if (!receiver_prototype.IsJSObject() ||
-        !broker()->IsArrayOrObjectPrototype(receiver_prototype.AsJSObject())) {
+        !receiver_prototype.AsJSObject().IsArrayOrObjectPrototype(broker())) {
       return false;
     }
   }
diff --git a/deps/v8/src/compiler/node-properties.cc b/deps/v8/src/compiler/node-properties.cc
index 6e2ef92fc0ea..89af7582c5e0 100644
--- a/deps/v8/src/compiler/node-properties.cc
+++ b/deps/v8/src/compiler/node-properties.cc
@@ -417,7 +417,7 @@ NodeProperties::InferMapsResult NodeProperties::InferMapsUnsafe(
     // TODO(bmeurer): This can be removed once the Array.prototype and
     // Object.prototype have NO_ELEMENTS elements kind.
     if (!ref.IsJSObject() ||
-        !broker->IsArrayOrObjectPrototype(ref.AsJSObject())) {
+        !ref.AsJSObject().IsArrayOrObjectPrototype(broker)) {
       if (ref.map(broker).is_stable()) {
         // The {receiver_map} is only reliable when we install a stability
         // code dependency.
diff --git a/deps/v8/src/maglev/maglev-graph-builder.cc b/deps/v8/src/maglev/maglev-graph-builder.cc
index db081bfde623..d1133abf2e28 100644
--- a/deps/v8/src/maglev/maglev-graph-builder.cc
+++ b/deps/v8/src/maglev/maglev-graph-builder.cc
@@ -5594,7 +5594,7 @@ bool MaglevGraphBuilder::CanTreatHoleAsUndefined(
   for (compiler::MapRef receiver_map : receiver_maps) {
     compiler::ObjectRef receiver_prototype = receiver_map.prototype(broker());
     if (!receiver_prototype.IsJSObject() ||
-        !broker()->IsArrayOrObjectPrototype(receiver_prototype.AsJSObject())) {
+        !receiver_prototype.AsJSObject().IsArrayOrObjectPrototype(broker())) {
       return false;
     }
   }
diff --git a/deps/zlib/BUILD.gn b/deps/zlib/BUILD.gn
index eff72b22a29b..c37b4252961e 100644
--- a/deps/zlib/BUILD.gn
+++ b/deps/zlib/BUILD.gn
@@ -98,10 +98,6 @@ source_set("zlib_adler32_simd") {
       "adler32_simd.c",
       "adler32_simd.h",
     ]
-
-    if (!is_win || is_clang) {
-      cflags = [ "-mssse3" ]
-    }
   }
 
   if (use_arm_neon_optimizations) {
@@ -168,6 +164,15 @@ if (use_arm_neon_optimizations) {
   }
 }
 
+# Enables 64-bit word-at-a-time compare256() in deflate's longest_match() on
+# 64-bit little-endian architectures (x64 and arm64). Follows the same pattern
+# as INFLATE_CHUNK_READ_64LE and DEFLATE_CHUNK_WRITE_64LE below.
+config("zlib_compare256_config") {
+  if (current_cpu == "x64" || current_cpu == "arm64") {
+    defines = [ "DEFLATE_COMPARE256_64LE" ]
+  }
+}
+
 config("zlib_data_chunk_simd_config") {
   if (use_x86_x64_optimizations) {
     defines = [ "INFLATE_CHUNK_SIMD_SSE2" ]
@@ -234,13 +239,6 @@ source_set("zlib_crc32_simd") {
       "crc32_simd.h",
       "crc_folding.c",
     ]
-
-    if (!is_win || is_clang) {
-      cflags = [
-        "-msse4.2",
-        "-mpclmul",
-      ]
-    }
   }
 
   configs += [ ":zlib_internal_config" ]
@@ -296,6 +294,7 @@ component("zlib") {
   sources = [
     "adler32.c",
     "chromeconf.h",
+    "compare256.h",
     "compress.c",
     "contrib/optimizations/insert_string.h",
     "cpu_features.c",
@@ -370,6 +369,7 @@ component("zlib") {
   public_configs = [ ":zlib_config" ]
 
   configs += [
+    ":zlib_compare256_config",
     ":zlib_internal_config",
 
     # Must be after no_chromium_code for warning flags to be ordered correctly.
diff --git a/deps/zlib/CMakeLists.txt b/deps/zlib/CMakeLists.txt
index b569804ace08..87d6613be3ff 100644
--- a/deps/zlib/CMakeLists.txt
+++ b/deps/zlib/CMakeLists.txt
@@ -94,6 +94,7 @@ if (ENABLE_SIMD_OPTIMIZATIONS)
   SET(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -pthread")
 
   if (CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64")
+    add_definitions(-DDEFLATE_COMPARE256_64LE)
     add_definitions(-DINFLATE_CHUNK_SIMD_SSE2)
     add_definitions(-DADLER32_SIMD_SSSE3)
     add_definitions(-DINFLATE_CHUNK_READ_64LE)
@@ -101,9 +102,6 @@ if (ENABLE_SIMD_OPTIMIZATIONS)
     add_definitions(-DCRC32_SIMD_SSE42_PCLMUL)
     if (ENABLE_SIMD_AVX512)
       add_definitions(-DCRC32_SIMD_AVX512_PCLMUL)
-      add_compile_options(-mvpclmulqdq -msse2 -mavx512f -mpclmul)
-    else()
-      add_compile_options(-msse4.2 -mpclmul)
     endif()
     add_definitions(-DDEFLATE_SLIDE_HASH_SSE2)
     # Required by CPU features detection code.
@@ -118,6 +116,7 @@ if (ENABLE_SIMD_OPTIMIZATIONS)
     add_definitions(-DDEFLATE_CHUNK_WRITE_64LE)
     add_definitions(-DCRC32_ARMV8_CRC32)
     add_definitions(-DDEFLATE_SLIDE_HASH_NEON)
+    add_definitions(-DDEFLATE_COMPARE256_64LE)
     # Required by CPU features detection code.
     if (APPLE)
       add_definitions(-DARMV8_OS_MACOS)
diff --git a/deps/zlib/adler32_simd.c b/deps/zlib/adler32_simd.c
index 08c21d3e953a..ce4ce7c5755a 100644
--- a/deps/zlib/adler32_simd.c
+++ b/deps/zlib/adler32_simd.c
@@ -53,7 +53,7 @@
 
 #include <tmmintrin.h>
 
-#if defined(__GNUC__)
+#if defined(__GNUC__) || defined(__clang__)
 __attribute__((__target__("ssse3")))
 #endif
 uint32_t ZLIB_INTERNAL adler32_simd_(  /* SSSE3 */
diff --git a/deps/zlib/compare256.h b/deps/zlib/compare256.h
new file mode 100644
index 000000000000..80061c3febbd
--- /dev/null
+++ b/deps/zlib/compare256.h
@@ -0,0 +1,56 @@
+/* compare256.h
+ *
+ * This does 256-byte match comparison for deflate's longest_match.
+ *
+ * Copyright 2026 The Chromium Authors
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the Chromium source repository LICENSE file.
+ */
+#ifndef COMPARE256_H
+#define COMPARE256_H
+
+#include <stdint.h>
+#include <string.h>
+#if defined(_MSC_VER) && !defined(__clang__)
+#include <intrin.h>
+#endif
+
+/* Safe unaligned 16-bit load. Compilers optimize this into a single load
+ * instruction. */
+static inline uint16_t read16(const void* p) {
+    uint16_t v;
+    memcpy(&v, p, sizeof(v));
+    return v;
+}
+
+/* Finds the byte offset (0..7) of the first difference in non-zero XOR mask
+ * `x`:
+ */
+static inline int compare256_diff(uint64_t x) {
+#if defined(_MSC_VER) && !defined(__clang__)
+    unsigned long i;
+    _BitScanForward64(&i, x);
+    return (int)i / 8;
+#else
+    return __builtin_ctzll(x) / 8;
+#endif
+}
+
+/* Returns the number of matching leading bytes (0 to 256) between src0 and
+ * src1. Compares 8 bytes per iteration with early exit. */
+static inline int compare256(const unsigned char* src0,
+                             const unsigned char* src1) {
+    int len = 0;
+    do {
+        uint64_t a, b, x;
+        memcpy(&a, src0 + len, sizeof(a));
+        memcpy(&b, src1 + len, sizeof(b));
+        x = a ^ b;
+        if (x)
+            return len + compare256_diff(x);
+        len += (int)sizeof(a);
+    } while (len < 256);
+    return 256;
+}
+
+#endif /* COMPARE256_H */
diff --git a/deps/zlib/contrib/tests/utils_unittest.cc b/deps/zlib/contrib/tests/utils_unittest.cc
index 6161e39f0262..51ace780d2e7 100644
--- a/deps/zlib/contrib/tests/utils_unittest.cc
+++ b/deps/zlib/contrib/tests/utils_unittest.cc
@@ -19,8 +19,17 @@
 #include "third_party/zlib/contrib/minizip/zip.h"
 #endif
 
+#include "compare256.h"
 #include "zlib.h"
 
+// Some tests are for little endian optimizations and should be skipped if
+// running on big endian.
+#if !defined(__BYTE_ORDER__) || __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+#define ZLIB_TEST_LITTLE_ENDIAN 1
+#else
+#define ZLIB_TEST_LITTLE_ENDIAN 0
+#endif
+
 void TestPayloads(size_t input_size, zlib_internal::WrapperType type,
                   const int compression_level = Z_DEFAULT_COMPRESSION) {
   std::vector<unsigned char> input;
@@ -1475,4 +1484,32 @@ TEST(ZlibTest, Crbug500521311) {
   EXPECT_EQ(unzClose(uzf), UNZ_OK);
 }
 
+// compare256() returns the number of equal leading bytes. The buffers are
+// exactly the 256 bytes it may read, so ASan traps any over-read.
+TEST(ZlibTest, Compare256) {
+  if (!ZLIB_TEST_LITTLE_ENDIAN) {
+    GTEST_SKIP() << "compare256() is little-endian only";
+  }
+  for (int equal = 0; equal <= 256; ++equal) {
+    std::vector<unsigned char> a(256, 'a'), b(256, 'a');
+    if (equal < 256)
+      b[equal] = 'b';
+    EXPECT_EQ(compare256(a.data(), b.data()), equal);
+  }
+}
+
+// longest_match() computes 2 + compare256(scan + 2, match + 2), the first two
+// bytes being known equal, so a match must still reach MAX_MATCH (258).
+TEST(ZlibTest, Compare256ReachesMaxMatch) {
+  if (!ZLIB_TEST_LITTLE_ENDIAN) {
+    GTEST_SKIP() << "compare256() is little-endian only";
+  }
+  for (int match_len = 250; match_len <= 258; ++match_len) {
+    std::vector<unsigned char> a(258, 'a'), b(258, 'a');
+    if (match_len < 258)
+      b[match_len] = 'b';
+    EXPECT_EQ(2 + compare256(a.data() + 2, b.data() + 2), match_len);
+  }
+}
+
 #endif
diff --git a/deps/zlib/cpu_features.c b/deps/zlib/cpu_features.c
index 34ae7b913af9..6613a65e335f 100644
--- a/deps/zlib/cpu_features.c
+++ b/deps/zlib/cpu_features.c
@@ -160,6 +160,11 @@ static void _cpu_check_features(void)
 #include <immintrin.h>
 #include <xsaveintrin.h>
 #endif
+/* _xgetbv() below needs the xsave ISA. Annotate it here so the build does not
+ * need -mxsave. */
+#if defined(CRC32_SIMD_AVX512_PCLMUL) && (defined(__GNUC__) || defined(__clang__))
+__attribute__((__target__("xsave")))
+#endif
 static void _cpu_check_features(void)
 {
     int x86_cpu_has_sse2;
diff --git a/deps/zlib/crc32_simd.c b/deps/zlib/crc32_simd.c
index 1c60ae9bd3c1..f9d52a6311e9 100644
--- a/deps/zlib/crc32_simd.c
+++ b/deps/zlib/crc32_simd.c
@@ -21,6 +21,9 @@
 #include <wmmintrin.h>
 #include <immintrin.h>
 
+#if defined(__GNUC__) || defined(__clang__)
+__attribute__((__target__("avx512f,pclmul,vpclmulqdq")))
+#endif
 uint32_t ZLIB_INTERNAL crc32_avx512_simd_(  /* AVX512+PCLMUL */
     const unsigned char *buf,
     z_size_t len,
@@ -212,6 +215,9 @@ uint32_t ZLIB_INTERNAL crc32_avx512_simd_(  /* AVX512+PCLMUL */
 #include <smmintrin.h>
 #include <wmmintrin.h>
 
+#if defined(__GNUC__) || defined(__clang__)
+__attribute__((__target__("sse4.2,pclmul")))
+#endif
 uint32_t ZLIB_INTERNAL crc32_sse42_simd_(  /* SSE4.2+PCLMUL */
     const unsigned char *buf,
     z_size_t len,
diff --git a/deps/zlib/crc_folding.c b/deps/zlib/crc_folding.c
index 1d54ee8d48cf..3e31ae4a7e44 100644
--- a/deps/zlib/crc_folding.c
+++ b/deps/zlib/crc_folding.c
@@ -25,6 +25,12 @@
 #include <immintrin.h>
 #include <wmmintrin.h>
 
+#if defined(__GNUC__) || defined(__clang__)
+#define TARGET_SSE42_PCLMUL __attribute__((__target__("sse4.2,pclmul")))
+#else
+#define TARGET_SSE42_PCLMUL
+#endif
+
 #define CRC_LOAD(s) \
     do { \
         __m128i xmm_crc0 = _mm_loadu_si128((__m128i *)s->crc0 + 0);\
@@ -41,6 +47,7 @@
         _mm_storeu_si128((__m128i *)s->crc0 + 4, xmm_crc_part);\
     } while (0);
 
+TARGET_SSE42_PCLMUL
 ZLIB_INTERNAL void crc_fold_init(deflate_state *const s)
 {
     CRC_LOAD(s)
@@ -55,6 +62,7 @@ ZLIB_INTERNAL void crc_fold_init(deflate_state *const s)
     s->strm->adler = 0;
 }
 
+TARGET_SSE42_PCLMUL
 local void fold_1(deflate_state *const s,
         __m128i *xmm_crc0, __m128i *xmm_crc1,
         __m128i *xmm_crc2, __m128i *xmm_crc3)
@@ -81,6 +89,7 @@ local void fold_1(deflate_state *const s,
     *xmm_crc3 = _mm_castps_si128(ps_res);
 }
 
+TARGET_SSE42_PCLMUL
 local void fold_2(deflate_state *const s,
         __m128i *xmm_crc0, __m128i *xmm_crc1,
         __m128i *xmm_crc2, __m128i *xmm_crc3)
@@ -115,6 +124,7 @@ local void fold_2(deflate_state *const s,
     *xmm_crc3 = _mm_castps_si128(ps_res31);
 }
 
+TARGET_SSE42_PCLMUL
 local void fold_3(deflate_state *const s,
         __m128i *xmm_crc0, __m128i *xmm_crc1,
         __m128i *xmm_crc2, __m128i *xmm_crc3)
@@ -155,6 +165,7 @@ local void fold_3(deflate_state *const s,
     *xmm_crc3 = _mm_castps_si128(ps_res32);
 }
 
+TARGET_SSE42_PCLMUL
 local void fold_4(deflate_state *const s,
         __m128i *xmm_crc0, __m128i *xmm_crc1,
         __m128i *xmm_crc2, __m128i *xmm_crc3)
@@ -221,6 +232,7 @@ local const unsigned zalign(32) pshufb_shf_table[60] = {
 	0x0201008f,0x06050403,0x0a090807,0x0e0d0c0b  /* shl  1 (16 -15)/shr15*/
 };
 
+TARGET_SSE42_PCLMUL
 local void partial_fold(deflate_state *const s, const size_t len,
         __m128i *xmm_crc0, __m128i *xmm_crc1,
         __m128i *xmm_crc2, __m128i *xmm_crc3,
@@ -271,6 +283,7 @@ local void partial_fold(deflate_state *const s, const size_t len,
     *xmm_crc3 = _mm_castps_si128(ps_res);
 }
 
+TARGET_SSE42_PCLMUL
 ZLIB_INTERNAL void crc_fold_copy(deflate_state *const s,
         unsigned char *dst, const unsigned char *src, long len)
 {
@@ -427,6 +440,7 @@ local const unsigned zalign(16) crc_mask2[4] = {
     0x00000000, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF
 };
 
+TARGET_SSE42_PCLMUL
 unsigned ZLIB_INTERNAL crc_fold_512to32(deflate_state *const s)
 {
     const __m128i xmm_mask  = _mm_load_si128((__m128i *)crc_mask);
diff --git a/deps/zlib/deflate.c b/deps/zlib/deflate.c
index d95787f286d8..b98a985e5cac 100644
--- a/deps/zlib/deflate.c
+++ b/deps/zlib/deflate.c
@@ -57,6 +57,8 @@
 #include "slide_hash_simd.h"
 #endif
 
+#include "compare256.h"
+
 #if defined(QAT_COMPRESSION_ENABLED)
 #include "contrib/qat/deflate_qat.h"
 #endif
@@ -1492,7 +1494,13 @@ local uInt longest_match(deflate_state *s, IPos cur_match) {
     Posf *prev = s->prev;
     uInt wmask = s->w_mask;
 
-#ifdef UNALIGNED_OK
+#if defined(DEFLATE_COMPARE256_64LE)
+    /* Quickly reject non-matches with the 2-byte prefilter
+     * (scan_start/scan_end); candidates that pass are extended 8 bytes at a
+     * time with compare256(). */
+    uInt scan_start = read16(scan);
+    uInt scan_end   = read16(scan + best_len - 1);
+#elif defined(UNALIGNED_OK)
     /* Compare two bytes at a time. Note: this is not always beneficial.
      * Try with and without -DUNALIGNED_OK to check.
      */
@@ -1534,7 +1542,13 @@ local uInt longest_match(deflate_state *s, IPos cur_match) {
          * However the length of the match is limited to the lookahead, so
          * the output of deflate is not affected by the uninitialized values.
          */
-#if (defined(UNALIGNED_OK) && MAX_MATCH == 258)
+#if defined(DEFLATE_COMPARE256_64LE)
+        if (read16(match + best_len - 1) != scan_end ||
+            read16(match) != scan_start) continue;
+        /* scan_start matched, so bytes 0..1 are equal; compare the remaining
+         * up to 256 bytes so the length can still reach MAX_MATCH (258). */
+        len = 2 + compare256(scan + 2, match + 2);
+#elif (defined(UNALIGNED_OK) && MAX_MATCH == 258)
         /* This code assumes sizeof(unsigned short) == 2. Do not use
          * UNALIGNED_OK if your compiler uses a different size.
          */
@@ -1624,7 +1638,9 @@ local uInt longest_match(deflate_state *s, IPos cur_match) {
             s->match_start = cur_match;
             best_len = len;
             if (len >= nice_match) break;
-#ifdef UNALIGNED_OK
+#if defined(DEFLATE_COMPARE256_64LE)
+            scan_end = read16(scan + best_len - 1);
+#elif defined(UNALIGNED_OK)
             scan_end = *(ushf*)(scan + best_len - 1);
 #else
             scan_end1  = scan[best_len - 1];
diff --git a/deps/zstd/unofficial.gni b/deps/zstd/unofficial.gni
index fe6c2b425eac..733ddb965684 100644
--- a/deps/zstd/unofficial.gni
+++ b/deps/zstd/unofficial.gni
@@ -4,25 +4,38 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("zstd_gn_build") {
-  config("zstd_config") {
-    include_dirs = [ "./lib" ]
-  }
+  if (node_shared_zstd) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("zstd_config") {
+      packages = [ "libzstd" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":zstd_config" ]
+    }
+  } else {
+    config("zstd_config") {
+      include_dirs = [ "./lib" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("zstd.gyp") ],
-                            "scope",
-                            [ "zstd.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("zstd.gyp") ],
+                              "scope",
+                              [ "zstd.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":zstd_config" ]
-    sources = gypi_values.zstd_sources
-    defines = [ "XXH_NAMESPACE=ZSTD_", "ZSTD_MULTITHREAD", "ZSTD_DISABLE_ASM" ]
-    cflags_c = [ "-Wno-unused-function" ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":zstd_config" ]
+      sources = gypi_values.zstd_sources
+      defines = [ "XXH_NAMESPACE=ZSTD_", "ZSTD_MULTITHREAD", "ZSTD_DISABLE_ASM" ]
+      cflags_c = [ "-Wno-unused-function" ]
 
-    if (is_posix) {
-      ldflags = [ "-pthread" ]
+      if (is_posix) {
+        ldflags = [ "-pthread" ]
+      }
     }
   }
 }
diff --git a/doc/api/async_hooks.md b/doc/api/async_hooks.md
index a863350fc2d2..ad566239cf19 100644
--- a/doc/api/async_hooks.md
+++ b/doc/api/async_hooks.md
@@ -814,9 +814,9 @@ See the section on [promise execution tracking][].
 
 ```js
 const server = net.createServer((conn) => {
-  // The resource that caused (or triggered) this callback to be called
-  // was that of the new connection. Thus the return value of triggerAsyncId()
-  // is the asyncId of "conn".
+  // Returns the triggerAsyncId of the server, not of the new connection,
+  // because the callback runs in the execution scope of the server's
+  // MakeCallback().
   async_hooks.triggerAsyncId();
 
 }).listen(port, () => {
diff --git a/doc/api/child_process.md b/doc/api/child_process.md
index 77db426c668b..453046205b7e 100644
--- a/doc/api/child_process.md
+++ b/doc/api/child_process.md
@@ -242,6 +242,11 @@ can be used to specify the character encoding used to decode the stdout and
 stderr output. If `encoding` is `'buffer'`, or an unrecognized character
 encoding, `Buffer` objects will be passed to the callback instead.
 
+> Using the `signal` option to destroy a long-lived child process as a resource
+> cleanup mechanism is deprecated. The `signal` option remains appropriate for
+> cancellation, externally propagated aborts, and timeouts. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 ```cjs
 const { exec } = require('node:child_process');
 exec('cat *.js missing_file | wc -l', (error, stdout, stderr) => {
@@ -390,6 +395,11 @@ except that it does not spawn a shell by default. Rather, the specified
 executable `file` is spawned directly as a new process making it slightly more
 efficient than [`child_process.exec()`][].
 
+> Using the `signal` option to destroy a long-lived child process as a resource
+> cleanup mechanism is deprecated. The `signal` option remains appropriate for
+> cancellation, externally propagated aborts, and timeouts. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 The same options as [`child_process.exec()`][] are supported. Since a shell is
 not spawned, behaviors such as I/O redirection and file globbing are not
 supported.
@@ -551,6 +561,8 @@ changes:
     is used, it must contain exactly one item with value `'ipc'` or an error
     will be thrown. For instance `[0, 1, 2, 'ipc']`.
   * `uid` {number} Sets the user identity of the process (see setuid(2)).
+  * `windowsHide` {boolean} Hide the subprocess console window that would
+    normally be created on Windows systems. **Default:** `false`.
   * `windowsVerbatimArguments` {boolean} No quoting or escaping of arguments is
     done on Windows. Ignored on Unix. **Default:** `false`.
   * `timeout` {number} In milliseconds the maximum amount of time the process
@@ -585,6 +597,11 @@ current process.
 The `shell` option available in [`child_process.spawn()`][] is not supported by
 `child_process.fork()` and will be ignored if set.
 
+> Using the `signal` option to destroy a long-lived child process as a resource
+> cleanup mechanism is deprecated. The `signal` option remains appropriate for
+> cancellation, externally propagated aborts, and timeouts. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 If the `signal` option is enabled, calling `.abort()` on the corresponding
 `AbortController` is similar to calling `.kill()` on the child process except
 the error passed to the callback will be an `AbortError`:
@@ -735,6 +752,11 @@ process, the default is [`process.env`][].
 
 `undefined` values in `env` will be ignored.
 
+> Using the `signal` option to destroy a long-lived child process as a resource
+> cleanup mechanism is deprecated. The `signal` option remains appropriate for
+> cancellation, externally propagated aborts, and timeouts. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 Example of running `ls -lh /usr`, capturing `stdout`, `stderr`, and the
 exit code:
 
@@ -1064,7 +1086,12 @@ pipes between the parent and child. The value is one of the following:
    as it may result in undefined behavior or dropped callbacks if the stream
    encounters errors. Always ensure that `stdin` is used as readable and
    `stdout`/`stderr` as writable to maintain the intended flow of data between
-   the parent and child processes.
+   the parent and child processes. The stream passed in the `stdin` position
+   is the source from which the child process reads its input, and the
+   streams in the `stdout`/`stderr` positions receive the output the child
+   writes. This is the opposite of [`subprocess.stdin`][] (writable) and
+   [`subprocess.stdout`][] (readable), which are the parent's ends of the
+   pipes created by `'pipe'`.
 7. Positive integer: The integer value is interpreted as a file descriptor
    that is open in the parent process. It is shared with the child
    process, similar to how {Stream} objects can be shared. Passing sockets
@@ -1179,7 +1206,8 @@ changes:
     `'/bin/sh'` on Unix, and `process.env.ComSpec` on Windows. A different
     shell can be specified as a string. See [Shell requirements][] and
     [Default Windows shell][]. **Default:** `false` (no shell).
-* Returns: {Buffer|string} The stdout from the command.
+* Returns: {Buffer|string|null} If `stdio` is `'pipe'`, the stdout from the
+  command, otherwise null.
 
 The `child_process.execFileSync()` method is generally identical to
 [`child_process.execFile()`][] with the exception that the method will not
@@ -1306,7 +1334,8 @@ changes:
     **Default:** `'buffer'`.
   * `windowsHide` {boolean} Hide the subprocess console window that would
     normally be created on Windows systems. **Default:** `false`.
-* Returns: {Buffer|string} The stdout from the command.
+* Returns: {Buffer|string|null} If `stdio` is `'pipe'`, the stdout from the
+  command, otherwise null.
 
 The `child_process.execSync()` method is generally identical to
 [`child_process.exec()`][] with the exception that the method will not return
@@ -1390,8 +1419,10 @@ changes:
 * Returns: {Object}
   * `pid` {number} Pid of the child process.
   * `output` {Array} Array of results from stdio output.
-  * `stdout` {Buffer|string} The contents of `output[1]`.
-  * `stderr` {Buffer|string} The contents of `output[2]`.
+  * `stdout` {Buffer|string|null} If `stdio` is `'pipe'`, the contents of
+    `output[1]`, otherwise null.
+  * `stderr` {Buffer|string|null} If `stdio` is `'pipe'`, the contents of
+    `output[2]`, otherwise null.
   * `status` {number|null} The exit code of the subprocess, or `null` if the
     subprocess terminated due to a signal.
   * `signal` {string|null} The signal used to kill the subprocess, or `null` if
@@ -1552,7 +1583,7 @@ added: v0.5.9
 
 * `message` {Object} A parsed JSON object or primitive value.
 * `sendHandle` {Handle|undefined} `undefined` or a [`net.Socket`][],
-  [`net.Server`][], or [`dgram.Socket`][] object.
+  [`net.Server`][], [`net.BoundSocket`][], or [`dgram.Socket`][] object.
 
 The `'message'` event is triggered when a child process uses
 [`process.send()`][] to send messages.
@@ -1862,6 +1893,9 @@ subprocess.ref();
 <!-- YAML
 added: v0.5.9
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/64725
+    description: '`net.BoundSocket` instances can now be sent.'
   - version: v5.8.0
     pr-url: https://github.com/nodejs/node/pull/5283
     description: The `options` parameter, and the `keepOpen` option
@@ -1876,7 +1910,7 @@ changes:
 
 * `message` {Object}
 * `sendHandle` {Handle|undefined} `undefined`, or a [`net.Socket`][],
-  [`net.Server`][], or [`dgram.Socket`][] object.
+  [`net.Server`][], [`net.BoundSocket`][], or [`dgram.Socket`][] object.
 * `options` {Object} The `options` argument, if present, is an object used to
   parameterize the sending of certain types of handles. `options` supports
   the following properties:
@@ -1943,12 +1977,18 @@ Applications should avoid using such messages or listening for
 `'internalMessage'` events as it is subject to change without notice.
 
 The optional `sendHandle` argument that may be passed to `subprocess.send()` is
-for passing a TCP server or socket object to the child process. The child process will
+for passing a TCP server, socket or [`net.BoundSocket`][] object to the child
+process. The child process will
 receive the object as the second argument passed to the callback function
 registered on the [`'message'`][] event. Any data that is received
 and buffered in the socket will not be sent to the child. Sending IPC sockets is
 not supported on Windows.
 
+Sending a `net.BoundSocket` moves its underlying TCP handle to the child
+process, leaving the source instance in the adopted state as if it had been
+adopted by a server or socket. The bound socket must not have been adopted or
+closed, and pipe (`path`) binds cannot be sent.
+
 The optional `callback` is a function that is invoked after the message is
 sent but before the child process may have received it. The function is called with a
 single argument: `null` on success, or an [`Error`][] object on failure.
@@ -2376,6 +2416,7 @@ or [`child_process.fork()`][].
 [`child_process.spawnSync()`]: #child_processspawnsynccommand-args-options
 [`dgram.Socket`]: dgram.md#class-dgramsocket
 [`maxBuffer` and Unicode]: #maxbuffer-and-unicode
+[`net.BoundSocket`]: net.md#class-netboundsocket
 [`net.Server`]: net.md#class-netserver
 [`net.Socket`]: net.md#class-netsocket
 [`options.detached`]: #optionsdetached
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 801b017bc5a9..b4f389241f66 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -794,6 +794,17 @@ Enable [FIPS mode][] at startup. With OpenSSL 3, a configured provider named
 `fips` must be available and initialize successfully. With OpenSSL 1.1.1,
 Node.js must be built against a FIPS-capable OpenSSL.
 
+### `--enable-fips-indicator-events`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+Publish OpenSSL FIPS indicator results to the
+[`'crypto.fips.indicator'`][] diagnostics channel. This option requires OpenSSL
+3.4 or later. It does not enable [FIPS mode][] or change whether an operation
+is permitted.
+
 ### `--enable-network-family-autoselection`
 
 <!-- YAML
@@ -1386,15 +1397,34 @@ added: v12.12.0
 
 Disable loading native addons that are not [context-aware][].
 
-### `--force-fips`
+<a id="--force-fips"></a>
+
+### `--force-fips[=mode]`
 
 <!-- YAML
 added: v6.0.0
+changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65645
+    description: Added the optional `provider` and `strict` modes.
 -->
 
 Enable [FIPS mode][] at startup and prevent it from being disabled from script
 code. The same OpenSSL requirements as [`--enable-fips`][] apply.
 
+An optional mode can be specified using `--force-fips=mode`:
+
+* `provider`: Preserve the OpenSSL FIPS provider's configured handling of
+  non-approved operations. This is the current default when the mode is
+  omitted.
+* `strict`: Reject non-approved operations reported through the OpenSSL FIPS
+  indicator callback. This mode requires OpenSSL 3.4 or later.
+
+The `strict` mode only covers operations reported through the callback for
+OpenSSL's default library context. It does not cover native addons that use
+another `OSSL_LIB_CTX` or another copy of `libcrypto`, nor operation-specific
+indicators that do not invoke the callback.
+
 ### `--force-node-api-uncaught-exceptions-policy`
 
 <!-- YAML
@@ -2463,6 +2493,9 @@ forked processes, or clustered processes.
 <!-- YAML
 added: v22.0.0
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/64606
+    description: Passing `--run` without a command lists the available scripts.
   - version: v22.3.0
     pr-url: https://github.com/nodejs/node/pull/53032
     description: NODE_RUN_SCRIPT_NAME environment variable is added.
@@ -2479,6 +2512,15 @@ changes:
 This runs a specified command from a package.json's `"scripts"` object.
 If a missing `"command"` is provided, it will list the available scripts.
 
+Passing `--run` without a command lists the available scripts and exits
+with a non-zero exit code:
+
+```console
+$ node --run
+Available scripts are:
+  test: node --test
+```
+
 `--run` will traverse up to the root directory and finds a `package.json`
 file to run the command from.
 
@@ -3623,6 +3665,7 @@ one is included in the list below.
 * `--disable-warning`
 * `--disable-wasm-trap-handler`
 * `--dns-result-order`
+* `--enable-fips-indicator-events`
 * `--enable-fips`
 * `--enable-network-family-autoselection`
 * `--enable-source-maps`
@@ -4252,6 +4295,7 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [V8 Inspector integration for Node.js]: debugger.md#v8-inspector-integration-for-nodejs
 [V8 JavaScript code coverage]: https://v8project.blogspot.com/2017/12/javascript-code-coverage.html
 [`"type"`]: packages.md#type
+[`'crypto.fips.indicator'`]: diagnostics_channel.md#event-cryptofipsindicator
 [`--allow-addons`]: #--allow-addons
 [`--allow-child-process`]: #--allow-child-process
 [`--allow-fs-read`]: #--allow-fs-read
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 24de83cfb25f..5f3ef08a6c28 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -7,8 +7,8 @@
 <!-- source_link=lib/crypto.js -->
 
 The `node:crypto` module provides cryptographic functionality that includes a
-set of wrappers for OpenSSL's hash, HMAC, cipher, decipher, sign, and verify
-functions.
+set of wrappers for OpenSSL's hash, message authentication code (MAC), cipher,
+decipher, sign, verify, and key encapsulation mechanism (KEM) functions.
 
 ```mjs
 const { createHmac } = await import('node:crypto');
@@ -633,6 +633,10 @@ The [`crypto.createCipheriv()`][] method is
 used to create `Cipheriv` instances. `Cipheriv` objects are not to be created
 directly using the `new` keyword.
 
+The selected algorithm may impose additional restrictions on streaming and
+calls to [`cipher.update()`][]. See [CCM mode][], [CBC-CTS mode][], [XTS mode][],
+[AES key wrap modes][], and [SIV and GCM-SIV modes][].
+
 Example: Using `Cipheriv` objects as streams:
 
 ```mjs
@@ -862,8 +866,8 @@ added: v1.0.0
 -->
 
 * Returns: {Buffer} When using an authenticated encryption mode (`GCM`, `CCM`,
-  `OCB`, and `chacha20-poly1305` are currently supported), the
-  `cipher.getAuthTag()` method returns a
+  `OCB`, `SIV`, `GCM-SIV`, and `chacha20-poly1305` are currently
+  supported), the `cipher.getAuthTag()` method returns a
   [`Buffer`][] containing the _authentication tag_ that has been computed from
   the given data.
 
@@ -885,14 +889,14 @@ added: v1.0.0
   * `encoding` {string} The string encoding to use when `buffer` is a string.
 * Returns: {Cipheriv} The same `Cipheriv` instance for method chaining.
 
-When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, and
-`chacha20-poly1305` are
-currently supported), the `cipher.setAAD()` method sets the value used for the
-_additional authenticated data_ (AAD) input parameter.
+When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, `SIV`,
+`GCM-SIV`, and `chacha20-poly1305` are currently supported), the
+`cipher.setAAD()` method sets the value used for the _additional authenticated
+data_ (AAD) input parameter.
 
-The `plaintextLength` option is optional for `GCM` and `OCB`. When using `CCM`,
-the `plaintextLength` option must be specified and its value must match the
-length of the plaintext in bytes. See [CCM mode][].
+The `plaintextLength` option is optional for `GCM`, `OCB`, `SIV`, and
+`GCM-SIV`. When using `CCM`, the `plaintextLength` option must be specified and
+its value must match the length of the plaintext in bytes. See [CCM mode][].
 
 The `cipher.setAAD()` method must be called before [`cipher.update()`][].
 
@@ -905,14 +909,15 @@ added: v0.7.1
 * `autoPadding` {boolean} **Default:** `true`
 * Returns: {Cipheriv} The same `Cipheriv` instance for method chaining.
 
-When using block encryption algorithms, the `Cipheriv` class will automatically
-add padding to the input data to the appropriate block size. To disable the
-default padding call `cipher.setAutoPadding(false)`.
+When using block ciphers that use standard block padding, the `Cipheriv` class
+will automatically add padding to the input data to the appropriate block size.
+To disable the default padding call `cipher.setAutoPadding(false)`.
 
-When `autoPadding` is `false`, the length of the entire input data must be a
-multiple of the cipher's block size or [`cipher.final()`][] will throw an error.
-Disabling automatic padding is useful for non-standard padding, for instance
-using `0x0` instead of PKCS padding.
+For block ciphers that use standard block padding, when `autoPadding` is
+`false`, the length of the entire input data must be a multiple of the cipher's
+block size or [`cipher.final()`][] will throw an error. Disabling automatic
+padding is useful for non-standard padding, for instance using `0x0` instead of
+PKCS padding.
 
 The `cipher.setAutoPadding()` method must be called before
 [`cipher.final()`][].
@@ -946,9 +951,12 @@ is specified, a string using the specified encoding is returned. If no
 When `outputEncoding` is specified, it must use the same encoding as previous
 calls to `cipher.update()`.
 
-The `cipher.update()` method can be called multiple times with new data until
-[`cipher.final()`][] is called. Calling `cipher.update()` after
-[`cipher.final()`][] will result in an error being thrown.
+For most algorithms, `cipher.update()` can be called multiple times with new
+data until [`cipher.final()`][] is called. Some algorithms restrict calls to
+`cipher.update()`. For example, [CCM mode][], [CBC-CTS mode][], [XTS mode][],
+[AES key wrap modes][], and [SIV and GCM-SIV modes][] require the whole message
+in a single call. Calling `cipher.update()` after [`cipher.final()`][] will
+result in an error being thrown.
 
 ## Class: `Decipheriv`
 
@@ -970,6 +978,10 @@ The [`crypto.createDecipheriv()`][] method is
 used to create `Decipheriv` instances. `Decipheriv` objects are not to be created
 directly using the `new` keyword.
 
+The selected algorithm may impose additional restrictions on streaming and
+calls to [`decipher.update()`][]. See [CCM mode][], [CBC-CTS mode][],
+[XTS mode][], [AES key wrap modes][], and [SIV and GCM-SIV modes][].
+
 Example: Using `Decipheriv` objects as streams:
 
 ```mjs
@@ -1190,14 +1202,14 @@ changes:
   * `encoding` {string} String encoding to use when `buffer` is a string.
 * Returns: {Decipheriv} The same `Decipheriv` instance for method chaining.
 
-When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, and
-`chacha20-poly1305` are
-currently supported), the `decipher.setAAD()` method sets the value used for the
-_additional authenticated data_ (AAD) input parameter.
+When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, `SIV`,
+`GCM-SIV`, and `chacha20-poly1305` are currently supported), the
+`decipher.setAAD()` method sets the value used for the _additional
+authenticated data_ (AAD) input parameter.
 
-The `options` argument is optional for `GCM`. When using `CCM`, the
-`plaintextLength` option must be specified and its value must match the length
-of the ciphertext in bytes. See [CCM mode][].
+The `options` argument is optional for `GCM`, `OCB`, `SIV`, and `GCM-SIV`.
+When using `CCM`, the `plaintextLength` option must be specified and its value
+must match the length of the ciphertext in bytes. See [CCM mode][].
 
 The `decipher.setAAD()` method must be called before [`decipher.update()`][].
 
@@ -1232,18 +1244,18 @@ changes:
 * `encoding` {string} String encoding to use when `buffer` is a string.
 * Returns: {Decipheriv} The same `Decipheriv` instance for method chaining.
 
-When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, and
-`chacha20-poly1305` are
-currently supported), the `decipher.setAuthTag()` method is used to pass in the
-received _authentication tag_. If no tag is provided, or if the cipher text
-has been tampered with, [`decipher.final()`][] will throw, indicating that the
-cipher text should be discarded due to failed authentication. If the tag length
-is invalid according to [NIST SP 800-38D][] or does not match the value of the
+When using an authenticated encryption mode (`GCM`, `CCM`, `OCB`, `SIV`,
+`GCM-SIV`, and `chacha20-poly1305` are currently supported), the
+`decipher.setAuthTag()` method is used to pass in the received
+_authentication tag_. If no tag is provided, or if the cipher text has been
+tampered with, [`decipher.final()`][] will throw, indicating that the cipher
+text should be discarded due to failed authentication. If the tag length is
+invalid according to [NIST SP 800-38D][] or does not match the value of the
 `authTagLength` option, `decipher.setAuthTag()` will throw an error.
 
 The `decipher.setAuthTag()` method must be called before [`decipher.update()`][]
-for `CCM` mode or before [`decipher.final()`][] for `GCM` and `OCB` modes and
-`chacha20-poly1305`.
+for `CCM`, `SIV`, and `GCM-SIV` modes or before [`decipher.final()`][] for
+`GCM` and `OCB` modes and `chacha20-poly1305`.
 `decipher.setAuthTag()` can only be called once.
 
 Because the `node:crypto` module was originally designed to closely mirror
@@ -1271,8 +1283,8 @@ When data has been encrypted without standard block padding, calling
 `decipher.setAutoPadding(false)` will disable automatic padding to prevent
 [`decipher.final()`][] from checking for and removing padding.
 
-Turning auto padding off will only work if the input data's length is a
-multiple of the ciphers block size.
+For block ciphers that use standard block padding, disabling it requires the
+input data's length to be a multiple of the cipher's block size.
 
 The `decipher.setAutoPadding()` method must be called before
 [`decipher.final()`][].
@@ -1295,19 +1307,23 @@ changes:
 Updates the decipher with `data`. If the `inputEncoding` argument is given,
 the `data`
 argument is a string using the specified encoding. If the `inputEncoding`
-argument is not given, `data` must be a [`Buffer`][]. If `data` is a
-[`Buffer`][] then `inputEncoding` is ignored.
+argument is not given, `data` must be a [`Buffer`][], `TypedArray`, or
+`DataView`. If `data` is a [`Buffer`][], `TypedArray`, or `DataView`, then
+`inputEncoding` is ignored.
 
-The `outputEncoding` specifies the output format of the enciphered
+The `outputEncoding` specifies the output format of the deciphered
 data. If the `outputEncoding`
 is specified, a string using the specified encoding is returned. If no
 `outputEncoding` is provided, a [`Buffer`][] is returned.
 When `outputEncoding` is specified, it must use the same encoding as previous
 calls to `decipher.update()`.
 
-The `decipher.update()` method can be called multiple times with new data until
-[`decipher.final()`][] is called. Calling `decipher.update()` after
-[`decipher.final()`][] will result in an error being thrown.
+For most algorithms, `decipher.update()` can be called multiple times with new
+data until [`decipher.final()`][] is called. Some algorithms restrict calls to
+`decipher.update()`. For example, [CCM mode][], [CBC-CTS mode][], [XTS mode][],
+[AES key wrap modes][], and [SIV and GCM-SIV modes][] require the whole message
+in a single call. Calling `decipher.update()` after [`decipher.final()`][] will
+result in an error being thrown.
 
 Even if the underlying cipher implements authentication, the authenticity and
 integrity of the plaintext returned from this function may be uncertain at this
@@ -2512,6 +2528,91 @@ Depending on the type of this `KeyObject`, this property is either
 `'secret'` for secret (symmetric) keys, `'public'` for public (asymmetric) keys
 or `'private'` for private (asymmetric) keys.
 
+## Class: `Mac`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* Extends: {stream.Transform}
+
+The `Mac` class computes message authentication codes using MAC
+implementations supplied by OpenSSL providers. It can be used in one of two
+ways:
+
+* As a [stream][] that is both readable and writable, where data is written and
+  one authentication tag is produced on the readable side when the writable
+  side ends; or
+* By calling [`mac.update()`][] one or more times followed by [`mac.final()`][].
+
+Instances of `Mac` are created using [`crypto.createMac()`][]. The `Mac` class
+is not exported directly by the `node:crypto` module.
+
+Calling `mac.end()` without first writing data computes the authentication tag
+for an empty message. If the selected MAC produces a zero-byte tag, such as
+when a provider accepts `outputLength: 0`, the readable side ends without
+emitting a data chunk because Node.js streams do not emit zero-length chunks.
+When using `mac.final()` instead, it returns a zero-length [`Buffer`][] or an
+empty encoded string.
+
+`mac.end()` and `mac.final()` are alternative terminal operations and must not
+both be called on the same object. A `Mac` object cannot be used again after
+either operation attempts finalization or after an underlying MAC update fails.
+
+Example: Using [`mac.update()`][] and [`mac.final()`][]:
+
+```mjs
+const { createMac, randomBytes } = await import('node:crypto');
+
+const key = randomBytes(16);
+const mac = createMac('CMAC', key, {
+  cipher: 'AES-128-CBC',
+});
+
+mac.update('some data to authenticate');
+console.log(mac.final('hex'));
+```
+
+### `mac.final([outputEncoding])`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `outputEncoding` {string} The [encoding][] of the return value.
+* Returns: {Buffer | string}
+
+Completes the MAC computation and returns the authentication tag. If
+`outputEncoding` is omitted or is `'buffer'`, a [`Buffer`][] is returned.
+Otherwise, a string is returned.
+
+To verify an authentication tag, compare equal-length [`Buffer`][] values using
+[`crypto.timingSafeEqual()`][].
+
+The `Mac` object cannot be used again after finalization is attempted,
+including when finalization fails. Later calls to `mac.update()` or
+`mac.final()` throw `ERR_CRYPTO_MAC_FINALIZED`.
+
+### `mac.update(data[, inputEncoding])`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `data` {string|Buffer|TypedArray|DataView}
+* `inputEncoding` {string} The [encoding][] of the `data` string.
+* Returns: {Mac}
+
+Updates the MAC with `data` and returns the `Mac` object so that calls can be
+chained. When `data` is a string, `inputEncoding` defaults to `'utf8'`. When
+`data` is a [`Buffer`][], `TypedArray`, or `DataView`, `inputEncoding` is
+ignored.
+
+This method can be called multiple times before finalization. If an underlying
+MAC update fails, the `Mac` object cannot be used again. Calling this method
+after a previous underlying MAC update failure or after finalization throws
+`ERR_CRYPTO_MAC_FINALIZED`.
+
 ## Class: `Sign`
 
 <!-- YAML
@@ -2912,8 +3013,7 @@ changes:
 Checks whether the certificate matches the given email address.
 
 If the `'subject'` option is undefined or set to `'default'`, the certificate
-subject is only considered if the subject alternative name extension either does
-not exist or does not contain any email addresses.
+subject is considered according to OpenSSL's default behavior.
 
 If the `'subject'` option is set to `'always'` and if the subject alternative
 name extension either does not exist or does not contain a matching email
@@ -2957,9 +3057,7 @@ comparisons are case-insensitive, the returned subject name might also differ
 from the given `name` in capitalization.
 
 If the `'subject'` option is undefined or set to `'default'`, the certificate
-subject is only considered if the subject alternative name extension either does
-not exist or does not contain any DNS names. This behavior is consistent with
-[RFC 2818][] ("HTTP Over TLS").
+subject is considered according to OpenSSL's default behavior.
 
 If the `'subject'` option is set to `'always'` and if the subject alternative
 name extension either does not exist or does not contain a matching DNS name,
@@ -3545,6 +3643,15 @@ operations. The specific constants currently defined are described in
 <!-- YAML
 added: v0.1.94
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Additional ciphers available through OpenSSL providers (e.g.
+                 SM4-GCM, SM4-CCM, SM4-XTS, CBC-CTS, and AES key-wrap variants)
+                 are now supported. The `ctsMode` and `xtsStandard` options
+                 were added.
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/63411
+    description: Ciphers in SIV and GCM-SIV modes are now supported.
   - version:
     - v17.9.0
     - v16.17.0
@@ -3580,45 +3687,77 @@ changes:
 * `algorithm` {string}
 * `key` {string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey}
 * `iv` {string|ArrayBuffer|Buffer|TypedArray|DataView|null}
-* `options` {Object} [`stream.transform` options][]
+* `options` {Object} [`stream.transform` options][] with these additional
+  properties:
+  * `authTagLength` {number} The authentication tag length in bytes. Its
+    requirements and default depend on the authenticated cipher, as described
+    below.
+  * `ctsMode` {string} The [CBC-CTS mode][] variant. One of `'CS1'`, `'CS2'`,
+    or `'CS3'`. The values are case-sensitive. **Default:** `'CS1'`.
+  * `encoding` {string} The [encoding][] to use when `key` is a string. This
+    option does not affect a string `iv`, which is always interpreted as UTF-8.
+    **Default:** `'utf8'`.
+  * `xtsStandard` {string} The standard used by `sm4-xts`. One of `'GB'` or
+    `'IEEE'`. The values are case-sensitive. **Default:** `'GB'`.
 * Returns: {Cipheriv}
 
 Creates and returns a `Cipheriv` object, with the given `algorithm`, `key` and
 initialization vector (`iv`).
 
-The `options` argument controls stream behavior and is optional except when a
-cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
-`authTagLength` option is required and specifies the length of the
-authentication tag in bytes, see [CCM mode][]. In GCM mode, the `authTagLength`
-option is not required but can be used to set the length of the authentication
-tag that will be returned by `getAuthTag()` and defaults to 16 bytes.
-For `chacha20-poly1305`, the `authTagLength` option defaults to 16 bytes.
-
-The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
-recent OpenSSL releases, `openssl list -cipher-algorithms` will
-display the available cipher algorithms.
+The `options` argument controls cipher-specific settings and stream behavior.
+It is optional except when a cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`)
+is used. In that case, the `authTagLength` option is required and specifies the
+length of the authentication tag in bytes, see [CCM mode][]. In GCM mode, the
+`authTagLength` option is not required but can be used to set the length of the
+authentication tag that will be returned by `getAuthTag()` and defaults to 16
+bytes.
+For `SIV`, `GCM-SIV`, and `chacha20-poly1305`, the `authTagLength` option
+defaults to 16 bytes. `SIV` and `GCM-SIV` only support 16-byte authentication
+tags.
+
+The `ctsMode` and `xtsStandard` options configure parameters exposed by OpenSSL
+providers. They are available only with OpenSSL 3.0 or later and a provider
+that supports the corresponding parameter. `ctsMode` applies only to CBC-CTS
+ciphers, and `xtsStandard` applies only to `sm4-xts`. Supplying either option
+for an available cipher implementation that does not support it throws an
+`ERR_CRYPTO_UNSUPPORTED_OPERATION` error. See [CBC-CTS mode][] and [XTS mode][]
+for details.
+
+The available algorithms depend on OpenSSL. [`crypto.getCiphers()`][] lists the
+algorithms exposed by Node.js. On recent OpenSSL releases,
+`openssl list -cipher-algorithms` displays the algorithms available to OpenSSL,
+which can include algorithms that Node.js does not expose.
 
 The `key` is the raw key used by the `algorithm` and `iv` is an
-[initialization vector][]. Both arguments must be `'utf8'` encoded strings,
-[Buffers][`Buffer`], `TypedArray`, or `DataView`s. The `key` may optionally be
-a [`KeyObject`][] of type `secret`. If the cipher does not need
-an initialization vector, `iv` may be `null`.
+[initialization vector][]. Each may be a string, `ArrayBuffer`, [`Buffer`][],
+`TypedArray`, or `DataView`. A string `key` is decoded using `options.encoding`,
+which defaults to `'utf8'`; a string `iv` is always decoded as UTF-8. The `key`
+may optionally be a [`KeyObject`][] of type `secret`. If the cipher does not
+need an initialization vector, `iv` may be `null`.
 
 When passing strings for `key` or `iv`, please consider
 [caveats when using strings as inputs to cryptographic APIs][].
 
-Initialization vectors should be unpredictable and unique; ideally, they will be
-cryptographically random. They do not have to be secret: IVs are typically just
-added to ciphertext messages unencrypted. It may sound contradictory that
-something has to be unpredictable and unique, but does not have to be secret;
-remember that an attacker must not be able to predict ahead of time what a
-given IV will be.
+Initialization vector requirements depend on the algorithm. For some
+algorithms, an IV must be unpredictable and unique; for others, uniqueness
+alone is sufficient, a fixed value is required, or no IV is used. Follow the
+requirements for the selected algorithm. IVs typically do not have to be secret
+and can be transmitted with the ciphertext.
 
 ### `crypto.createDecipheriv(algorithm, key, iv[, options])`
 
 <!-- YAML
 added: v0.1.94
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Additional ciphers available through OpenSSL providers (e.g.
+                 SM4-GCM, SM4-CCM, SM4-XTS, CBC-CTS, and AES key-wrap variants)
+                 are now supported. The `ctsMode` and `xtsStandard` options
+                 were added.
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/63411
+    description: Ciphers in SIV and GCM-SIV modes are now supported.
   - version:
     - v17.9.0
     - v16.17.0
@@ -3650,16 +3789,27 @@ changes:
 * `algorithm` {string}
 * `key` {string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey}
 * `iv` {string|ArrayBuffer|Buffer|TypedArray|DataView|null}
-* `options` {Object} [`stream.transform` options][]
+* `options` {Object} [`stream.transform` options][] with these additional
+  properties:
+  * `authTagLength` {number} The authentication tag length in bytes. Its
+    requirements and default depend on the authenticated cipher, as described
+    below.
+  * `ctsMode` {string} The [CBC-CTS mode][] variant. One of `'CS1'`, `'CS2'`,
+    or `'CS3'`. The values are case-sensitive. **Default:** `'CS1'`.
+  * `encoding` {string} The [encoding][] to use when `key` is a string. This
+    option does not affect a string `iv`, which is always interpreted as UTF-8.
+    **Default:** `'utf8'`.
+  * `xtsStandard` {string} The standard used by `sm4-xts`. One of `'GB'` or
+    `'IEEE'`. The values are case-sensitive. **Default:** `'GB'`.
 * Returns: {Decipheriv}
 
 Creates and returns a `Decipheriv` object that uses the given `algorithm`, `key`
 and initialization vector (`iv`).
 
-The `options` argument controls stream behavior and is optional except when a
-cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`) is used. In that case, the
-`authTagLength` option is required and specifies the length of the
-authentication tag in bytes, see [CCM mode][].
+The `options` argument controls cipher-specific settings and stream behavior.
+It is optional except when a cipher in CCM or OCB mode (e.g. `'aes-128-ccm'`)
+is used. In that case, the `authTagLength` option is required and specifies the
+length of the authentication tag in bytes, see [CCM mode][].
 For `chacha20-poly1305`, the `authTagLength` option defaults to 16
 bytes and must be set to a different value if a different length is used.
 For AES-GCM, the `authTagLength` option has no default value when decrypting,
@@ -3667,26 +3817,37 @@ and `setAuthTag()` will accept arbitrarily short authentication tags. This
 behavior is deprecated and subject to change (see [DEP0182][]). <strong class="critical">
 In the meantime, applications should either set the `authTagLength` option or
 check the actual authentication tag length before passing it to `setAuthTag()`.</strong>
-
-The `algorithm` is dependent on OpenSSL, examples are `'aes192'`, etc. On
-recent OpenSSL releases, `openssl list -cipher-algorithms` will
-display the available cipher algorithms.
+For `SIV` and `GCM-SIV`, the `authTagLength` option defaults to 16 bytes and only
+16-byte authentication tags are supported.
+
+The `ctsMode` and `xtsStandard` options configure parameters exposed by OpenSSL
+providers. They are available only with OpenSSL 3.0 or later and a provider
+that supports the corresponding parameter. `ctsMode` applies only to CBC-CTS
+ciphers, and `xtsStandard` applies only to `sm4-xts`. Supplying either option
+for an available cipher implementation that does not support it throws an
+`ERR_CRYPTO_UNSUPPORTED_OPERATION` error. See [CBC-CTS mode][] and [XTS mode][]
+for details.
+
+The available algorithms depend on OpenSSL. [`crypto.getCiphers()`][] lists the
+algorithms exposed by Node.js. On recent OpenSSL releases,
+`openssl list -cipher-algorithms` displays the algorithms available to OpenSSL,
+which can include algorithms that Node.js does not expose.
 
 The `key` is the raw key used by the `algorithm` and `iv` is an
-[initialization vector][]. Both arguments must be `'utf8'` encoded strings,
-[Buffers][`Buffer`], `TypedArray`, or `DataView`s. The `key` may optionally be
-a [`KeyObject`][] of type `secret`. If the cipher does not need
-an initialization vector, `iv` may be `null`.
+[initialization vector][]. Each may be a string, `ArrayBuffer`, [`Buffer`][],
+`TypedArray`, or `DataView`. A string `key` is decoded using `options.encoding`,
+which defaults to `'utf8'`; a string `iv` is always decoded as UTF-8. The `key`
+may optionally be a [`KeyObject`][] of type `secret`. If the cipher does not
+need an initialization vector, `iv` may be `null`.
 
 When passing strings for `key` or `iv`, please consider
 [caveats when using strings as inputs to cryptographic APIs][].
 
-Initialization vectors should be unpredictable and unique; ideally, they will be
-cryptographically random. They do not have to be secret: IVs are typically just
-added to ciphertext messages unencrypted. It may sound contradictory that
-something has to be unpredictable and unique, but does not have to be secret;
-remember that an attacker must not be able to predict ahead of time what a given
-IV will be.
+Initialization vector requirements depend on the algorithm. For some
+algorithms, an IV must be unpredictable and unique; for others, uniqueness
+alone is sufficient, a fixed value is required, or no IV is used. Follow the
+requirements for the selected algorithm. IVs typically do not have to be secret
+and can be transmitted with the ciphertext.
 
 ### `crypto.createDiffieHellman(prime[, primeEncoding][, generator][, generatorEncoding])`
 
@@ -3769,6 +3930,11 @@ and description of each available elliptic curve.
 <!-- YAML
 added: v0.1.92
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Hash algorithms exposed by OpenSSL providers are now
+                 supported. The `functionName` and `customization` options
+                 were added for cSHAKE hash functions.
   - version: v12.8.0
     pr-url: https://github.com/nodejs/node/pull/28805
     description: The `outputLength` option was added for XOF hash functions.
@@ -3776,6 +3942,14 @@ changes:
 
 * `algorithm` {string}
 * `options` {Object} [`stream.transform` options][]
+  * `customization` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the customization byte string. **Default:** an
+    empty byte string.
+  * `functionName` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the NIST function-name byte string. **Default:**
+    an empty byte string.
+  * `outputLength` {number} For XOF hash functions, specifies the desired
+    output length in bytes.
 * Returns: {Hash}
 
 Creates and returns a `Hash` object that can be used to generate hash digests
@@ -3783,12 +3957,23 @@ using the given `algorithm`. Optional `options` argument controls stream
 behavior. For XOF hash functions such as `'shake256'`, the `outputLength` option
 can be used to specify the desired output length in bytes.
 
+The `functionName` and `customization` options apply only to cSHAKE-128 and
+cSHAKE-256. They are supported only when Node.js is built with OpenSSL 4.0 or
+later and the selected provider supports the corresponding digest parameters.
+Strings are encoded as UTF-8, and neither strings nor byte values may contain
+NUL bytes. Both options default to an empty byte string. For OpenSSL's built-in
+providers, `functionName` is case-sensitive and must be `''`, `'TupleHash'`,
+`'ParallelHash'`, or `'KMAC'`. Other providers can impose different
+restrictions. With both options empty, cSHAKE produces the same output as the
+corresponding SHAKE function for the same output length. `cshake-128` and
+`cshake-256` default to output lengths of 32 and 64 bytes, respectively.
+
 When the data is small (< 5MB) and readily available, [`crypto.hash()`][] is usually faster.
 
-The `algorithm` is dependent on the available algorithms supported by the
-version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
-On recent releases of OpenSSL, `openssl list -digest-algorithms` will
-display the available digest algorithms.
+The available algorithms depend on the version and configuration of OpenSSL on
+the platform. Examples are `'sha256'` and `'sha512'`. Use
+[`crypto.getHashes()`][] to obtain the list of hash algorithms available to the
+Node.js process.
 
 Example: generating the sha256 sum of a file
 
@@ -3868,10 +4053,11 @@ changes:
 Creates and returns an `Hmac` object that uses the given `algorithm` and `key`.
 Optional `options` argument controls stream behavior.
 
-The `algorithm` is dependent on the available algorithms supported by the
-version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
-On recent releases of OpenSSL, `openssl list -digest-algorithms` will
-display the available digest algorithms.
+The available algorithms depend on the version and configuration of OpenSSL on
+the platform. Examples are `'sha256'` and `'sha512'`.
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+HMAC imposes additional restrictions, so not every listed algorithm is
+suitable.
 
 The `key` is the HMAC key used to generate the cryptographic HMAC hash. If it is
 a [`KeyObject`][], its type must be `secret`. If it is a string, please consider
@@ -3934,6 +4120,65 @@ input.on('readable', () => {
 });
 ```
 
+### `crypto.createMac(algorithm, key[, options])`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+> Stability: 1.2 - Release candidate
+
+* `algorithm` {string} The name of the MAC algorithm.
+* `key` {ArrayBuffer|Buffer|TypedArray|DataView|KeyObject}
+* `options` {Object} [`stream.transform` options][]
+  * `digest` {string} The digest used by a MAC such as HMAC.
+  * `cipher` {string} The cipher used by a MAC such as CMAC or GMAC.
+  * `iv` {ArrayBuffer|Buffer|TypedArray|DataView} The initialization vector for
+    a MAC such as GMAC.
+  * `customization` {ArrayBuffer|Buffer|TypedArray|DataView} A customization
+    byte string for MACs that support it, such as KMAC.
+  * `salt` {ArrayBuffer|Buffer|TypedArray|DataView} A salt byte string for MACs
+    that support it, such as BLAKE2 MACs.
+  * `outputLength` {number} The requested provider output size in bytes. Must be
+    an unsigned 32-bit integer. Provider-specific restrictions also apply.
+* Returns: {Mac}
+
+`algorithm` must be a non-empty provider MAC name. The MAC-specific properties
+listed above are extensions to the standard [`stream.transform` options][] and
+are passed only when the selected provider implementation advertises the
+corresponding parameter with the expected type. A supplied MAC-specific option
+that the selected implementation does not support causes an error.
+
+The following table summarizes the MAC-specific options accepted by MAC
+implementations in OpenSSL's built-in providers. The `key` argument is required
+for every MAC. The table lists only MAC-specific options; standard
+[`stream.transform` options][] remain available for every family.
+
+| MAC family | Required options                        | Optional options                        | Notes                                                                  |
+| ---------- | --------------------------------------- | --------------------------------------- | ---------------------------------------------------------------------- |
+| HMAC       | `digest`                                | None                                    |                                                                        |
+| CMAC       | `cipher` using CBC mode                 | None                                    |                                                                        |
+| GMAC       | `cipher` using GCM mode, non-empty `iv` | None                                    | Requires a unique IV for every message authenticated with a given key. |
+| KMAC       | None                                    | `customization`, `outputLength`         |                                                                        |
+| BLAKE2 MAC | None                                    | `customization`, `salt`, `outputLength` |                                                                        |
+| Poly1305   | None                                    | None                                    | Each key must be used for only one message.                            |
+| SipHash    | None                                    | `outputLength`                          |                                                                        |
+
+`outputLength` configures the output size of the provider MAC. It is never
+implemented by computing a longer tag and truncating it. A value of `0` is
+passed to the provider and is accepted only when that provider can initialize
+and finalize the MAC with a zero-byte output. When `outputLength` is omitted,
+the provider's default output size is used and must be nonzero.
+
+The `key` must contain bytes or be a [`KeyObject`][] of type `secret`. Key
+length and other key requirements are determined by the selected provider
+implementation.
+
+Available algorithms and their accepted parameters depend on the OpenSSL
+version, loaded providers, and active default property query. Use
+[`crypto.getMacs()`][] to list fetchable MAC names. A listed name can still
+require options or a key with provider-specific properties.
+
 ### `crypto.createPrivateKey(key)`
 
 <!-- YAML
@@ -4139,8 +4384,10 @@ added: v0.1.92
 * Returns: {Sign}
 
 Creates and returns a `Sign` object that uses the given `algorithm`. Use
-[`crypto.getHashes()`][] to obtain the names of the available digest algorithms.
-Optional `options` argument controls the `stream.Writable` behavior.
+[`crypto.getHashes()`][] to obtain the names available to the hashing APIs. The
+key type and signature scheme can impose additional restrictions on which
+digests can be used. Optional `options` argument controls the
+`stream.Writable` behavior.
 
 In some cases, a `Sign` instance can be created using the name of a signature
 algorithm, such as `'RSA-SHA256'`, instead of a digest algorithm. This will use
@@ -4159,8 +4406,9 @@ added: v0.1.92
 * Returns: {Verify}
 
 Creates and returns a `Verify` object that uses the given algorithm.
-Use [`crypto.getHashes()`][] to obtain an array of names of the available
-signing algorithms. Optional `options` argument controls the
+Use [`crypto.getHashes()`][] to obtain the names available to the hashing APIs.
+The key type and signature scheme can impose additional restrictions on which
+digests can be used. Optional `options` argument controls the
 `stream.Writable` behavior.
 
 In some cases, a `Verify` instance can be created using the name of a signature
@@ -4407,6 +4655,10 @@ changes:
 Generates a new asymmetric key pair of the given `type`. See the
 supported [asymmetric key types][].
 
+For RSA-PSS keys, [`crypto.getHashes()`][] lists algorithms available to the
+hashing APIs, but not every listed digest can be encoded in RSA-PSS parameters
+or is supported by the active RSA implementation.
+
 If a `publicKeyEncoding` or `privateKeyEncoding` was specified, this function
 behaves as if [`keyObject.export()`][] had been called on its result. Otherwise,
 the respective part of the key is returned as a [`KeyObject`][].
@@ -4529,6 +4781,10 @@ changes:
 Generates a new asymmetric key pair of the given `type`. See the
 supported [asymmetric key types][].
 
+For RSA-PSS keys, [`crypto.getHashes()`][] lists algorithms available to the
+hashing APIs, but not every listed digest can be encoded in RSA-PSS parameters
+or is supported by the active RSA implementation.
+
 If a `publicKeyEncoding` or `privateKeyEncoding` was specified, this function
 behaves as if [`keyObject.export()`][] had been called on its result. Otherwise,
 the respective part of the key is returned as a [`KeyObject`][].
@@ -4743,15 +4999,17 @@ added: v15.0.0
   * `ivLength` {number} A test IV length.
 * Returns: {Object}
   * `name` {string} The name of the cipher
-  * `nid` {number} The nid of the cipher
-  * `blockSize` {number} The block size of the cipher in bytes. This property
-    is omitted when `mode` is `'stream'`.
-  * `ivLength` {number} The expected or default initialization vector length in
-    bytes. This property is omitted if the cipher does not use an initialization
+  * `nid` {number|undefined} The nid of the cipher. This property is `undefined` if the
+    cipher has no OpenSSL nid.
+  * `blockSize` {number|undefined} The block size of the cipher in bytes. This property
+    is `undefined` when `mode` is `'stream'`.
+  * `ivLength` {number|undefined} The expected or default initialization vector length in
+    bytes. This property is `undefined` if the cipher does not use an initialization
     vector.
   * `keyLength` {number} The expected or default key length in bytes.
   * `mode` {string} The cipher mode. One of `'cbc'`, `'ccm'`, `'cfb'`, `'ctr'`,
-    `'ecb'`, `'gcm'`, `'ocb'`, `'ofb'`, `'stream'`, `'wrap'`, `'xts'`.
+    `'ecb'`, `'gcm'`, `'gcm-siv'`, `'ocb'`, `'ofb'`, `'siv'`, `'stream'`,
+    `'wrap'`, `'xts'`.
 
 Returns information about a given cipher.
 
@@ -4885,11 +5143,27 @@ mode][].
 
 <!-- YAML
 added: v0.9.3
+changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Names and aliases exposed by loaded OpenSSL providers that
+                 match the default property query are now included.
 -->
 
 * Returns: {string\[]} An array of the names of the supported hash algorithms,
   such as `'RSA-SHA256'`. Hash algorithms are also called "digest" algorithms.
 
+This is the authoritative Node.js list of hash algorithms available to
+[`crypto.createHash()`][] and [`crypto.hash()`][] in the current process. With
+OpenSSL 3 or later, the list depends on the loaded providers and the default
+property query in effect when the list is first generated. Some listed
+algorithms can require API-specific options, such as `outputLength` for XOF
+hash functions.
+
+A listed hash algorithm is not necessarily supported by APIs that combine a
+digest with another cryptographic operation, such as HMAC, key derivation, or
+signing. Those operations can apply additional restrictions.
+
 ```mjs
 const {
   getHashes,
@@ -4906,6 +5180,40 @@ const {
 console.log(getHashes()); // ['DSA', 'DSA-SHA', 'DSA-SHA1', ...]
 ```
 
+### `crypto.getMacs()`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+> Stability: 1.2 - Release candidate
+
+* Returns: {string\[]} A fresh array containing the sorted, lowercase names
+  and aliases of fetchable MAC implementations.
+
+Returns MAC names exposed by loaded OpenSSL providers that match the active
+default property query. Duplicate names and numeric OID aliases are omitted.
+On builds without OpenSSL `EVP_MAC` support, this function returns an empty
+array.
+
+The returned names describe implementations that OpenSSL can fetch. They do not
+guarantee that [`crypto.createMac()`][] can initialize the MAC without
+additional options. A provider can require additional parameters or a key with
+algorithm-specific properties, and it can expose parameters that this API does
+not support.
+
+After a successful FIPS mode change made with [`crypto.setFips()`][], subsequent
+calls reflect the new mode, and newly created `Mac` objects use it. Existing
+`Mac` objects continue using the provider implementation selected when they
+were created.
+
+```mjs
+const { getMacs } = await import('node:crypto');
+
+console.log(getMacs());
+// ['blake2bmac', 'blake2smac', 'cmac', 'gmac', 'hmac', ...]
+```
+
 ### `crypto.getRandomValues(typedArray)`
 
 <!-- YAML
@@ -4926,6 +5234,11 @@ added:
  - v21.7.0
  - v20.12.0
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65484
+    description: Hash algorithms exposed by OpenSSL providers are now
+                 supported. The `functionName` and `customization` options
+                 were added for cSHAKE hash functions.
   - version: v24.13.1
     pr-url: https://github.com/nodejs/node/pull/60994
     description: This API is no longer experimental.
@@ -4941,6 +5254,12 @@ changes:
   into a `TypedArray` using either `TextEncoder` or `Buffer.from()` and passing
   the encoded `TypedArray` into this API instead.
 * `options` {Object|string}
+  * `customization` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the customization byte string. **Default:** an
+    empty byte string.
+  * `functionName` {string|ArrayBuffer|Buffer|TypedArray|DataView} For cSHAKE
+    hash functions, specifies the NIST function-name byte string. **Default:**
+    an empty byte string.
   * `outputEncoding` {string} [Encoding][encoding] used to encode the
     returned digest. **Default:** `'hex'`.
   * `outputLength` {number} For XOF hash functions such as 'shake256',
@@ -4952,10 +5271,21 @@ the object-based `crypto.createHash()` when hashing a smaller amount of data
 (<= 5MB) that's readily available. If the data can be big or if it is streamed,
 it's still recommended to use `crypto.createHash()` instead.
 
-The `algorithm` is dependent on the available algorithms supported by the
-version of OpenSSL on the platform. Examples are `'sha256'`, `'sha512'`, etc.
-On recent releases of OpenSSL, `openssl list -digest-algorithms` will
-display the available digest algorithms.
+The available algorithms depend on the version and configuration of OpenSSL on
+the platform. Examples are `'sha256'` and `'sha512'`. Use
+[`crypto.getHashes()`][] to obtain the list of hash algorithms available to the
+Node.js process.
+
+The `functionName` and `customization` options apply only to cSHAKE-128 and
+cSHAKE-256. They are supported only when Node.js is built with OpenSSL 4.0 or
+later and the selected provider supports the corresponding digest parameters.
+Strings are encoded as UTF-8, and neither strings nor byte values may contain
+NUL bytes. Both options default to an empty byte string. For OpenSSL's built-in
+providers, `functionName` is case-sensitive and must be `''`, `'TupleHash'`,
+`'ParallelHash'`, or `'KMAC'`. Other providers can impose different
+restrictions. With both options empty, cSHAKE produces the same output as the
+corresponding SHAKE function for the same output length. `cshake-128` and
+`cshake-256` default to output lengths of 32 and 64 bytes, respectively.
 
 If `options` is a string, then it specifies the `outputEncoding`.
 
@@ -5027,6 +5357,10 @@ changes:
 
 HKDF is a simple key derivation function defined in RFC 5869. The given `ikm`,
 `salt` and `info` are used with the `digest` to derive a key of `keylen` bytes.
+The available digest algorithms depend on the version and configuration of
+OpenSSL. HKDF uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or HKDF.
 
 The supplied `callback` function is called with two arguments: `err` and
 `derivedKey`. If an error occurs while deriving the key, `err` will be set;
@@ -5086,6 +5420,10 @@ changes:
 Provides a synchronous HKDF key derivation function as defined in RFC 5869. The
 given `ikm`, `salt` and `info` are used with the `digest` to derive a key of
 `keylen` bytes.
+The available digest algorithms depend on the version and configuration of
+OpenSSL. HKDF uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or HKDF.
 
 The successfully generated `derivedKey` will be returned as an {ArrayBuffer}.
 
@@ -5112,6 +5450,39 @@ const derivedKey = hkdfSync('sha512', 'key', 'salt', 'info', 64);
 console.log(Buffer.from(derivedKey).toString('hex'));  // '24156e2...5391653'
 ```
 
+### `crypto.parsePKCS12(bundle[, options])`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `bundle` {ArrayBuffer|Buffer|TypedArray|DataView} A DER-encoded PKCS#12
+  (`.p12` or `.pfx`) bundle.
+* `options` {Object}
+  * `passphrase` {string|ArrayBuffer|Buffer|TypedArray|DataView} The passphrase
+    protecting the bundle. Omitting this option is equivalent to passing `''`.
+* Returns: {Object}
+  * `privateKey` {KeyObject|null} The first private key in the bundle, or
+    `null` if none is present.
+  * `certificate` {X509Certificate|null} The certificate matching `privateKey`,
+    or `null` if no matching certificate is present.
+  * `additionalCertificates` {X509Certificate\[]} All other certificates in
+    the bundle. If there is no private key, this contains all certificates.
+    May be empty.
+
+Parses a PKCS#12 bundle, commonly stored with a `.p12` or `.pfx` extension,
+and returns its private key and certificates.
+
+```mjs
+import { parsePKCS12 } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+
+const { privateKey, certificate, additionalCertificates } = parsePKCS12(
+  readFileSync('bundle.p12'),
+  { passphrase: 'secret' },
+);
+```
+
 ### `crypto.pbkdf2(password, salt, iterations, keylen, digest, callback)`
 
 <!-- YAML
@@ -5195,8 +5566,10 @@ pbkdf2('secret', 'salt', 100000, 64, 'sha512', (err, derivedKey) => {
 });
 ```
 
-An array of supported digest functions can be retrieved using
-[`crypto.getHashes()`][].
+The available digest algorithms depend on the version and configuration of
+OpenSSL. PBKDF2 uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or PBKDF2.
 
 This API uses libuv's threadpool, which can have surprising and
 negative performance implications for some applications; see the
@@ -5268,14 +5641,19 @@ const key = pbkdf2Sync('secret', 'salt', 100000, 64, 'sha512');
 console.log(key.toString('hex'));  // '3745e48...08d59ae'
 ```
 
-An array of supported digest functions can be retrieved using
-[`crypto.getHashes()`][].
+The available digest algorithms depend on the version and configuration of
+OpenSSL. PBKDF2 uses HMAC internally. [`crypto.getHashes()`][] lists algorithms
+available to the hashing APIs, but not every listed algorithm is necessarily
+suitable for HMAC or PBKDF2.
 
 ### `crypto.privateDecrypt(privateKey, buffer)`
 
 <!-- YAML
 added: v0.11.14
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65073
+    description: The `mgf1Hash` option was added.
   - version:
       - v21.6.2
       - v20.11.1
@@ -5303,8 +5681,11 @@ changes:
 <!--lint disable maximum-line-length remark-lint-->
 
 * `privateKey` {Object|string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey|URL}
-  * `oaepHash` {string} The hash function to use for OAEP padding and MGF1.
-    **Default:** `'sha1'`
+  * `oaepHash` {string} The hash function to use for OAEP padding and, unless
+    `mgf1Hash` is set, MGF1. **Default:** `'sha1'`
+  * `mgf1Hash` {string} The hash function to use for the MGF1 mask generation
+    function of OAEP padding. If not specified, the value of `oaepHash` is used.
+    This allows the OAEP digest and the MGF1 digest to differ.
   * `oaepLabel` {string|ArrayBuffer|Buffer|TypedArray|DataView} The label to
     use for OAEP padding. If not specified, no label is used.
   * `padding` {crypto.constants} An optional padding value defined in
@@ -5319,6 +5700,10 @@ changes:
 Decrypts `buffer` with `privateKey`. `buffer` was previously encrypted using
 the corresponding public key, for example using [`crypto.publicEncrypt()`][].
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the active RSA implementation can impose additional restrictions on digests
+used for OAEP or MGF1.
+
 If `privateKey` is not a [`KeyObject`][], this function behaves as if
 `privateKey` had been passed to [`crypto.createPrivateKey()`][]. If it is an
 object, the `padding` property can be passed. Otherwise, this function uses
@@ -5418,6 +5803,9 @@ be passed instead of a public key.
 <!-- YAML
 added: v0.11.14
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65073
+    description: The `mgf1Hash` option was added.
   - version: v15.0.0
     pr-url: https://github.com/nodejs/node/pull/35093
     description: Added string, ArrayBuffer, and CryptoKey as allowable key
@@ -5440,8 +5828,11 @@ changes:
 * `key` {Object|string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey}
   * `key` {string|ArrayBuffer|Buffer|TypedArray|DataView|KeyObject|CryptoKey}
     A PEM encoded public or private key, {KeyObject}, or {CryptoKey}.
-  * `oaepHash` {string} The hash function to use for OAEP padding and MGF1.
-    **Default:** `'sha1'`
+  * `oaepHash` {string} The hash function to use for OAEP padding and, unless
+    `mgf1Hash` is set, MGF1. **Default:** `'sha1'`
+  * `mgf1Hash` {string} The hash function to use for the MGF1 mask generation
+    function of OAEP padding. If not specified, the value of `oaepHash` is used.
+    This allows the OAEP digest and the MGF1 digest to differ.
   * `oaepLabel` {string|ArrayBuffer|Buffer|TypedArray|DataView} The label to
     use for OAEP padding. If not specified, no label is used.
   * `passphrase` {string|ArrayBuffer|Buffer|TypedArray|DataView} An optional
@@ -5461,6 +5852,10 @@ Encrypts the content of `buffer` with `key` and returns a new
 [`Buffer`][] with encrypted content. The returned data can be decrypted using
 the corresponding private key, for example using [`crypto.privateDecrypt()`][].
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the active RSA implementation can impose additional restrictions on digests
+used for OAEP or MGF1.
+
 If `key` is not a [`KeyObject`][], this function behaves as if
 `key` had been passed to [`crypto.createPublicKey()`][]. If it is an
 object, the `padding` property can be passed. Otherwise, this function uses
@@ -6125,11 +6520,14 @@ changes:
     description: Custom engine support in OpenSSL 3 is deprecated.
 -->
 
+> Stability: 0 - Deprecated
+
 * `engine` {string}
 * `flags` {crypto.constants} **Default:** `crypto.constants.ENGINE_METHOD_ALL`
 
 Load and set the `engine` for some or all OpenSSL functions (selected by flags).
-Support for custom engines in OpenSSL is deprecated from OpenSSL 3.
+Use of this API is deprecated because custom engine support has been deprecated
+since OpenSSL 3.
 
 `engine` could be either an id or a path to the engine's shared library.
 
@@ -6234,6 +6632,10 @@ dependent upon the key type.
 `algorithm` is required to be `null` or `undefined` for Ed25519, Ed448, and
 ML-DSA.
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the key type and signature scheme determine whether a listed digest can be
+used for signing.
+
 If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
 passed to [`crypto.createPrivateKey()`][]. When `key` is a string, `ArrayBuffer`,
 [`Buffer`][], `TypedArray`, or `DataView`, it must contain PEM-encoded key
@@ -6371,6 +6773,10 @@ key type.
 `algorithm` is required to be `null` or `undefined` for Ed25519, Ed448, and
 ML-DSA.
 
+[`crypto.getHashes()`][] lists algorithms available to the hashing APIs, but
+the key type and signature scheme determine whether a listed digest can be
+used for verification.
+
 If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
 passed to [`crypto.createPublicKey()`][]. When `key` is a string, `ArrayBuffer`,
 [`Buffer`][], `TypedArray`, or `DataView`, it must contain PEM-encoded key
@@ -6614,6 +7020,110 @@ try {
 console.log(receivedPlaintext);
 ```
 
+### CBC-CTS mode
+
+For CBC ciphertext stealing (CBC-CTS) ciphers, the `ctsMode` option to
+[`crypto.createCipheriv()`][] or [`crypto.createDecipheriv()`][] selects the
+variant:
+
+* `'CS1'` is the default. For block-aligned input, its output is the same as CBC
+  mode.
+* `'CS2'` is also the same as CBC for block-aligned input. For input with a
+  partial final block, it swaps the final full and partial ciphertext blocks
+  relative to CS1.
+* `'CS3'` is the Kerberos 5 variant. It uses the CS2 ordering for a partial
+  final block and swaps the final two ciphertext blocks even for block-aligned
+  input.
+
+Encryption and decryption must use the same variant. The option is available
+only with CBC-CTS provider ciphers on OpenSSL 3.0 or later.
+
+Applications which use this mode must adhere to these restrictions:
+
+* The plaintext or ciphertext must be at least one block long.
+* The ciphertext has the same length as the plaintext.
+* `cipher.update()` or `decipher.update()` must be called exactly once with all
+  input data. Stream methods such as `write(data)`, `end(data)`, or `pipe()` may
+  fail because CBC-CTS does not accept multiple data updates.
+* `cipher.final()` or `decipher.final()` must still be called to complete the
+  operation.
+* `crypto.getCipherInfo()` reports the base mode as `'cbc'`.
+
+### XTS mode
+
+XTS ciphers operate on independently tweakable data units. A `Cipheriv` or
+`Decipheriv` instance represents one complete data unit, and its `iv` argument
+provides the 16-byte tweak. Use a new instance with the appropriate positional
+tweak for each different logical data unit.
+
+Applications which use XTS mode must adhere to these restrictions:
+
+* The plaintext or ciphertext must be at least one 16-byte block. Its length
+  does not have to be a multiple of 16 bytes because XTS uses ciphertext
+  stealing for a final partial block.
+* The ciphertext has the same length as the plaintext.
+* `cipher.update()` or `decipher.update()` must be called exactly once with all
+  input data. Stream methods such as `write(data)`, `end(data)`, or `pipe()` may
+  fail because XTS does not accept multiple data updates.
+* `cipher.final()` or `decipher.final()` must still be called to complete the
+  operation.
+
+For `sm4-xts`, the `xtsStandard` option to [`crypto.createCipheriv()`][] or
+[`crypto.createDecipheriv()`][] selects either the default `'GB'` variant from
+GB/T 17964-2021 or the `'IEEE'` variant from IEEE Std 1619-2007. Encryption and
+decryption must use the same variant. The option is available only for
+`sm4-xts`; it does not apply to AES-XTS ciphers. OpenSSL's default provider
+supports `sm4-xts` in OpenSSL 3.2 or later.
+
+### AES key wrap modes
+
+AES key wrap (`AES-WRAP`) and AES key wrap with padding (`AES-WRAP-PAD`)
+ciphers operate on a complete key-data value rather than on an incremental byte
+stream. The inverse-transform variants have the same processing restrictions.
+
+Applications which use an AES key wrap cipher must adhere to these
+restrictions:
+
+* `cipher.update()` or `decipher.update()` must be called exactly once with the
+  complete, non-empty input value.
+* Do not use AES key wrap ciphers as generic [`stream.Transform`][] streams.
+  Methods such as `write(data)`, `end(data)`, and `pipe()` can split one value
+  across multiple updates, with each update being treated as a separate wrap or
+  unwrap operation.
+* `cipher.final()` or `decipher.final()` must still be called to complete the
+  operation.
+
+### SIV and GCM-SIV modes
+
+`SIV`[^openssl30] and `GCM-SIV`[^openssl32] are supported [AEAD algorithms][]
+when supported by OpenSSL. Applications which use these modes must adhere to
+certain restrictions when using the cipher API:
+
+* The authentication tag length is fixed at 16 bytes.
+* `AES-SIV` keys are twice the named AES key size: `aes-128-siv` requires a
+  32-byte key, `aes-192-siv` requires a 48-byte key, and `aes-256-siv`
+  requires a 64-byte key.
+* `AES-SIV` ciphers do not use an initialization vector. Pass `null` or a
+  zero-length `iv` to [`crypto.createCipheriv()`][] or
+  [`crypto.createDecipheriv()`][].
+* `AES-SIV` and `AES-GCM-SIV` support zero-length plaintext only with OpenSSL
+  3.5 or later.
+* `AES-SIV` does not have a separate nonce or IV parameter. RFC 5297 defines
+  `AES-SIV` over an ordered list of associated-data inputs. Each `setAAD()`
+  call supplies one input in that list. If a protocol uses a nonce with
+  `AES-SIV`, call `setAAD(nonce)` after the other associated-data inputs and
+  before `update()`. At most 126 associated-data inputs may be supplied.
+* `AES-GCM-SIV` ciphers require a 12-byte initialization vector.
+* When decrypting, the authentication tag must be set via `setAuthTag()` before
+  calling `update()`.
+* Using stream methods such as `write(data)`, `end(data)` or `pipe()` might
+  fail as these modes cannot handle more than one chunk of data per instance.
+* As these modes process the whole message at once, `update()` must be called
+  exactly once.
+* Even though calling `update()` is sufficient to encrypt/decrypt the message,
+  applications _must_ call `final()` to compute or verify the authentication
+  tag.
+
 ### FIPS mode
 
 Node.js exposes the FIPS support provided by the linked OpenSSL library. Node.js
@@ -6708,12 +7218,18 @@ startup. The following controls are also available:
 * [`--enable-fips`][] and [`--force-fips`][] enable the property query and
   additionally require the configured provider named `fips` to initialize and
   pass its self-test. Node.js exits if that check fails. `--force-fips` also
-  prevents FIPS mode from being disabled from script code.
+  prevents FIPS mode from being disabled from script code. With
+  `--force-fips=strict`, Node.js also rejects non-approved operations reported
+  through the OpenSSL FIPS indicator callback.
 * [`crypto.setFips()`][] changes the FIPS/property-query state. On OpenSSL 3, it
   does not install, load, initialize, or validate a provider. Implementations
   fetched before the call are not changed.
 * [`crypto.getFips()`][] reports the FIPS/property-query state. On OpenSSL 3, a
   return value of `1` does not prove that a FIPS provider is loaded or validated.
+* With [`--enable-fips-indicator-events`][], the
+  [`'crypto.fips.indicator'`][] diagnostics channel reports non-approved
+  operations permitted by an OpenSSL 3.4 or later FIPS provider configured for
+  backwards compatibility.
 
 With OpenSSL 1.1.1, these controls use the library's FIPS mode support and
 require a FIPS-capable OpenSSL build.
@@ -7008,6 +7524,8 @@ See the [list of SSL OP Flags][] for details.
 [^openssl35]: Requires OpenSSL >= 3.5
 
 [AEAD algorithms]: https://en.wikipedia.org/wiki/Authenticated_encryption
+[AES key wrap modes]: #aes-key-wrap-modes
+[CBC-CTS mode]: #cbc-cts-mode
 [CCM mode]: #ccm-mode
 [CVE-2021-44532]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532
 [Caveats]: #support-for-weak-or-compromised-algorithms
@@ -7028,7 +7546,6 @@ See the [list of SSL OP Flags][] for details.
 [Permission Model]: permissions.md#permission-model
 [RFC 1421]: https://www.rfc-editor.org/rfc/rfc1421.txt
 [RFC 2409]: https://www.rfc-editor.org/rfc/rfc2409.txt
-[RFC 2818]: https://www.rfc-editor.org/rfc/rfc2818.txt
 [RFC 3526]: https://www.rfc-editor.org/rfc/rfc3526.txt
 [RFC 3610]: https://www.rfc-editor.org/rfc/rfc3610.txt
 [RFC 4055]: https://www.rfc-editor.org/rfc/rfc4055.txt
@@ -7038,10 +7555,14 @@ See the [list of SSL OP Flags][] for details.
 [RFC 7517]: https://www.rfc-editor.org/rfc/rfc7517.txt
 [RFC 8032]: https://www.rfc-editor.org/rfc/rfc8032.txt
 [RFC 9562]: https://www.rfc-editor.org/rfc/rfc9562.txt
+[SIV and GCM-SIV modes]: #siv-and-gcm-siv-modes
 [Web Crypto API documentation]: webcrypto.md
+[XTS mode]: #xts-mode
+[`'crypto.fips.indicator'`]: diagnostics_channel.md#event-cryptofipsindicator
 [`--allow-openssl-store`]: cli.md#--allow-openssl-store
+[`--enable-fips-indicator-events`]: cli.md#--enable-fips-indicator-events
 [`--enable-fips`]: cli.md#--enable-fips
-[`--force-fips`]: cli.md#--force-fips
+[`--force-fips`]: cli.md#--force-fipsmode
 [`--openssl-config`]: cli.md#--openssl-configfile
 [`--openssl-shared-config`]: cli.md#--openssl-shared-config
 [`BN_is_prime_ex`]: https://www.openssl.org/docs/man1.1.1/man3/BN_is_prime_ex.html
@@ -7061,6 +7582,7 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.createECDH()`]: #cryptocreateecdhcurvename
 [`crypto.createHash()`]: #cryptocreatehashalgorithm-options
 [`crypto.createHmac()`]: #cryptocreatehmacalgorithm-key-options
+[`crypto.createMac()`]: #cryptocreatemacalgorithm-key-options
 [`crypto.createPrivateKey()`]: #cryptocreateprivatekeykey
 [`crypto.createPublicKey()`]: #cryptocreatepublickeykey
 [`crypto.createSecretKey()`]: #cryptocreatesecretkeykey-encoding
@@ -7068,10 +7590,12 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.createVerify()`]: #cryptocreateverifyalgorithm-options
 [`crypto.generateKey()`]: #cryptogeneratekeytype-options-callback
 [`crypto.generateKeyPair()`]: #cryptogeneratekeypairtype-options-callback
+[`crypto.getCiphers()`]: #cryptogetciphers
 [`crypto.getCurves()`]: #cryptogetcurves
 [`crypto.getDiffieHellman()`]: #cryptogetdiffiehellmangroupname
 [`crypto.getFips()`]: #cryptogetfips
 [`crypto.getHashes()`]: #cryptogethashes
+[`crypto.getMacs()`]: #cryptogetmacs
 [`crypto.hash()`]: #cryptohashalgorithm-data-options
 [`crypto.privateDecrypt()`]: #cryptoprivatedecryptprivatekey-buffer
 [`crypto.privateEncrypt()`]: #cryptoprivateencryptprivatekey-buffer
@@ -7081,6 +7605,7 @@ See the [list of SSL OP Flags][] for details.
 [`crypto.randomFill()`]: #cryptorandomfillbuffer-offset-size-callback
 [`crypto.setFips()`]: #cryptosetfipsbool
 [`crypto.sign()`]: #cryptosignalgorithm-data-key-callback
+[`crypto.timingSafeEqual()`]: #cryptotimingsafeequala-b
 [`crypto.verify()`]: #cryptoverifyalgorithm-data-key-signature-callback
 [`crypto.webcrypto.getRandomValues()`]: webcrypto.md#cryptogetrandomvaluestypedarray
 [`crypto.webcrypto.subtle`]: webcrypto.md#class-subtlecrypto
@@ -7097,9 +7622,12 @@ See the [list of SSL OP Flags][] for details.
 [`hmac.update()`]: #hmacupdatedata-inputencoding
 [`import()`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/import
 [`keyObject.export()`]: #keyobjectexportoptions
+[`mac.final()`]: #macfinaloutputencoding
+[`mac.update()`]: #macupdatedata-inputencoding
 [`postMessage()`]: worker_threads.md#portpostmessagevalue-transferlist
 [`sign.sign()`]: #signsignprivatekey-outputencoding
 [`sign.update()`]: #signupdatedata-inputencoding
+[`stream.Transform`]: stream.md#class-streamtransform
 [`stream.Writable` options]: stream.md#new-streamwritableoptions
 [`stream.transform` options]: stream.md#new-streamtransformoptions
 [`util.promisify()`]: util.md#utilpromisifyoriginal
diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index ac40c7612db2..2b290e170634 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -4503,6 +4503,104 @@ throwing an error. This behavior is inconsistent with `hash.digest()` and
 may lead to subtle bugs. Calling `hmac.digest()` on a finalized `Hmac` instance
 will throw an error in a future version.
 
+<!-- md-lint skip-deprecation DEP0207 -->
+
+### DEP0208: `Server.prototype._listen2`
+
+<!-- YAML
+changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/64794
+    description: Documentation-only.
+-->
+
+Type: Documentation-only
+
+`net.Server.prototype._listen2` is an undocumented alias for an internal
+function that sets up the listening handle. It is kept only so that code
+replacing it keeps being called by [`server.listen()`][], and it will be
+removed in a future version of Node.js. Use [`server.listen()`][] instead of
+calling or overriding `_listen2`.
+
+### DEP0209: Using `AbortSignal` to dispose of resources
+
+<!-- YAML
+changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/64342
+    description: Documentation-only deprecation.
+-->
+
+Type: Documentation-only
+
+Using `AbortSignal` to destroy long-lived resources is deprecated. Prefer
+`using` for resource cleanup.
+
+`AbortSignal` is still a good fit for canceling actions, propagating
+cancellation from the outside, and timeouts.
+
+```js
+// Deprecated
+async function example() {
+  const ac = new AbortController();
+  const server = http.createServer(handler);
+  server.listen({ port: 3000, signal: ac.signal });
+
+  await doWork();
+  ac.abort();
+}
+```
+
+```js
+// Use this instead
+async function example() {
+  await using server = http.createServer(handler);
+  server.listen(3000);
+
+  await doWork();
+}
+```
+
+```js
+// Deprecated
+async function example() {
+  const ac = new AbortController();
+  const stream = addAbortSignal(ac.signal, fs.createReadStream(file));
+
+  await consume(stream);
+  ac.abort();
+}
+```
+
+```js
+// Use this instead
+async function example() {
+  await using stream = fs.createReadStream(file);
+
+  await consume(stream);
+}
+```
+
+```js
+// Deprecated
+async function example() {
+  const ac = new AbortController();
+  const child = spawn(command, args, { signal: ac.signal });
+
+  await doWork();
+  ac.abort();
+}
+```
+
+```js
+// Use this instead
+async function example() {
+  using child = spawn(command, args);
+
+  await doWork();
+}
+```
+
 [DEP0142]: #dep0142-repl_builtinlibs
 [NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
 [RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
@@ -4634,6 +4732,7 @@ will throw an error in a future version.
 [`response.writableEnded`]: http.md#responsewritableended
 [`response.writableFinished`]: http.md#responsewritablefinished
 [`script.createCachedData()`]: vm.md#scriptcreatecacheddata
+[`server.listen()`]: net.md#serverlisten
 [`setInterval()`]: timers.md#setintervalcallback-delay-args
 [`setTimeout()`]: timers.md#settimeoutcallback-delay-args
 [`socket.bufferSize`]: net.md#socketbuffersize
diff --git a/doc/api/diagnostics_channel.md b/doc/api/diagnostics_channel.md
index a8bee956f88d..b2897f48ccb3 100644
--- a/doc/api/diagnostics_channel.md
+++ b/doc/api/diagnostics_channel.md
@@ -1149,6 +1149,72 @@ passed to `console.warn()`.
 Emitted when `console.error()` is called. Receives and array of the arguments
 passed to `console.error()`.
 
+#### Crypto
+
+<!-- YAML
+added: v24.22.0
+-->
+
+> Stability: 1 - Experimental
+
+##### Event: `'crypto.fips.indicator'`
+
+* `operation` {string} The provider-defined operation type.
+* `reason` {string} The provider-defined description of why the operation is
+  not approved.
+* `blocked` {boolean} Whether an indicator callback blocked the operation.
+* `count` {number} The number of matching pending indicator invocations
+  represented by this message.
+* `dropped` {number} The number of additional indicator invocations dropped
+  before this message was delivered.
+
+Emitted when the OpenSSL FIPS provider used by Node.js detects an operation that
+is not FIPS approved after the corresponding provider check was relaxed. Such
+operations are possible when the provider is configured for backwards
+compatibility. The `operation` and `reason` values come from the provider and
+should be treated as opaque strings rather than stable enumerations.
+
+Start Node.js with [`--enable-fips-indicator-events`][] to enable this channel.
+Without the option, subscribing does not install the OpenSSL callback and no
+messages are published.
+
+Subscribing to the channel is observation-only and never changes the result of
+an operation. Node.js preserves the result from any native indicator callback
+installed before Node.js initializes its crypto support. When
+[`--force-fips=strict`][] is used, Node.js rejects callback-indicated
+non-approved operations whether or not indicator events are enabled or the
+channel has subscribers.
+
+Messages are published asynchronously on the main thread because OpenSSL
+indicators can originate from Workers or other threads. Only subscriptions on
+the main thread receive messages. Delivery order relative to the originating
+operation is not defined, and a message cannot be correlated with a particular
+call or Worker.
+
+One cryptographic operation can invoke the OpenSSL indicator more than once.
+Matching pending invocations are coalesced and reflected in `count`, which does
+not necessarily represent a number of cryptographic operations. At most 256
+distinct messages are queued. Additional invocations are reported in `dropped`
+on the first queued message. Queued messages do not keep the event loop active,
+so this channel is best-effort diagnostics rather than an authoritative audit
+log.
+
+This channel observes the default OpenSSL library context used by Node.js. It
+does not observe native addons or other code that uses another `OSSL_LIB_CTX`
+or another copy of `libcrypto`. It is active with OpenSSL 3.4 and later and is
+not available with BoringSSL. A provider configured to reject a check directly,
+including a pedantic OpenSSL FIPS provider, can reject an operation without
+emitting an indicator. Receiving or not receiving a message does not establish
+that Node.js or a cryptographic operation is FIPS validated.
+
+```mjs
+import diagnosticsChannel from 'node:diagnostics_channel';
+
+diagnosticsChannel.subscribe('crypto.fips.indicator', (message) => {
+  console.error('Non-approved cryptographic operation', message);
+});
+```
+
 #### HTTP
 
 > Stability: 1 - Experimental
@@ -1501,8 +1567,47 @@ added: v16.18.0
 
 Emitted when a new thread is created.
 
+#### SQLite
+
+<!-- YAML
+added: v24.22.0
+-->
+
+> Stability: 1 - Experimental
+
+##### Event: `'sqlite.db.query'`
+
+* `sql` {string} The expanded SQL with bound parameter values substituted.
+  If expansion fails, the source SQL with unsubstituted placeholders is used
+  instead.
+* `database` {DatabaseSync} The [`DatabaseSync`][] instance that executed the
+  statement.
+* `duration` {number} SQLite's internal estimate of the statement run time in
+  nanoseconds. This reflects C-layer execution time only and does not include
+  JavaScript binding overhead such as argument marshaling or result-row
+  construction.
+
+Emitted after a SQL statement finishes executing against a [`DatabaseSync`][]
+instance. This is a **profiling** event: it fires once per statement upon
+completion and reports an estimated duration from SQLite's internal profiler.
+It is not a distributed-tracing span. There is no corresponding start event,
+no async context propagation, and no parent-span linkage. If you need
+OpenTelemetry-compatible spans or async context propagation, wrap your SQLite
+calls with a [`TracingChannel`][] at the JavaScript layer instead.
+
+Publishing is zero-overhead when there are no subscribers.
+
+No event is emitted for a statement that is abandoned mid-iteration and later
+finalized, either explicitly through [`statement.close()`][] or when the
+statement is garbage collected. Subscribers must not close the database or the
+statement, since both are still in use while the event is being delivered; see
+[`database.close()`][] and [`statement.close()`][].
+
 [TracingChannel Channels]: #tracingchannel-channels
 [`'uncaughtException'`]: process.md#event-uncaughtexception
+[`--enable-fips-indicator-events`]: cli.md#--enable-fips-indicator-events
+[`--force-fips=strict`]: cli.md#--force-fipsmode
+[`DatabaseSync`]: sqlite.md#class-databasesync
 [`TracingChannel`]: #class-tracingchannel
 [`asyncEnd` event]: #asyncendevent
 [`asyncStart` event]: #asyncstartevent
@@ -1511,6 +1616,7 @@ Emitted when a new thread is created.
 [`channel.subscribe(onMessage)`]: #channelsubscribeonmessage
 [`channel.unsubscribe(onMessage)`]: #channelunsubscribeonmessage
 [`child_process.spawn()`]: child_process.md#child_processspawncommand-args-options
+[`database.close()`]: sqlite.md#databaseclose
 [`diagnostics_channel.channel(name)`]: #diagnostics_channelchannelname
 [`diagnostics_channel.subscribe(name, onMessage)`]: #diagnostics_channelsubscribename-onmessage
 [`diagnostics_channel.tracingChannel()`]: #diagnostics_channeltracingchannelnameorchannels
@@ -1520,5 +1626,6 @@ Emitted when a new thread is created.
 [`net.Server.listen()`]: net.md#serverlisten
 [`process.execve()`]: process.md#processexecvefile-args-env
 [`start` event]: #startevent
+[`statement.close()`]: sqlite.md#statementclose
 [`worker_threads.locks`]: worker_threads.md#worker_threadslocks
 [context loss]: async_context.md#troubleshooting-context-loss
diff --git a/doc/api/embedding.md b/doc/api/embedding.md
index 0309e1120969..dfb84b49ef9b 100644
--- a/doc/api/embedding.md
+++ b/doc/api/embedding.md
@@ -93,6 +93,16 @@ to as `node::Environment`. Each `node::Environment` is associated with:
   that `node::IsolateData` is shared only among `node::Environment`s that
   use the same `v8::Isolate`, Node.js does not perform this check.
 
+`node::Environment`s that share a `node::IsolateData` also share its
+`uv_loop_t`. `node::FreeEnvironment()` runs that loop until the handles of the
+`node::Environment` being freed have closed, and JavaScript execution is
+disallowed on the whole `v8::Isolate` while it does, so pending timers, I/O
+callbacks and thread pool completions that belong to other `node::Environment`s
+on the same loop can run inside that call without being able to call into
+JavaScript. `node::Environment`s that are freed independently of one another
+should each use their own `uv_loop_t` and `node::IsolateData`, or the embedder
+should make sure the others have no pending work when one of them is freed.
+
 In order to set up a `v8::Isolate`, an `v8::ArrayBuffer::Allocator` needs
 to be provided. One possible choice is the default Node.js allocator, which
 can be created through `node::ArrayBufferAllocator::Create()`. Using the Node.js
diff --git a/doc/api/errors.md b/doc/api/errors.md
index 9b81ad526084..49103c267ef1 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -397,6 +397,32 @@ error object, such as a {Proxy}.
 Indicates the failure of an assertion. For details, see
 [`Class: assert.AssertionError`][].
 
+## Class: `DOMException`
+
+<!-- YAML
+added: v17.0.0
+-->
+
+* Extends: {errors.Error}
+
+The Web IDL {DOMException} class. These errors are thrown by web-platform APIs
+in Node.js such as [`fetch()`][], {AbortController}, {AbortSignal}, and Web
+Streams. For details, see also [`Class: DOMException`][] on the Globals page.
+
+The [`domException.name`][] property identifies the type of the exception (for
+example, `'AbortError'`). Unlike most errors in Node.js, the
+[`domException.code`][] property is a number that corresponds to a
+[legacy error code name][Web IDL error names] (for example, `20` for
+`ABORT_ERR`).
+
+Node.js-specific APIs that support {AbortSignal} (such as
+[`events.once()`][]) throw a Node.js `AbortError` (a native {errors.Error} with
+`name` of `'AbortError'` and `code` of [`'ABORT_ERR'`][ABORT_ERR]) rather than a
+{DOMException}. To identify abort errors in either case, checking
+`err?.name === 'AbortError'` is sufficient.
+
+See also [`ABORT_ERR`][].
+
 ## Class: `RangeError`
 
 * Extends: {errors.Error}
@@ -928,7 +954,7 @@ be called no more than one time per instance of a `Hash` object.
 
 ### `ERR_CRYPTO_HASH_UPDATE_FAILED`
 
-[`hash.update()`][] failed for any reason. This should rarely, if ever, happen.
+[`hash.update()`][] failed for an unspecified reason.
 
 <a id="ERR_CRYPTO_INCOMPATIBLE_KEY"></a>
 
@@ -1044,6 +1070,16 @@ An invalid key type was provided.
 
 The given crypto key object's type is invalid for the attempted operation.
 
+<a id="ERR_CRYPTO_INVALID_MAC"></a>
+
+### `ERR_CRYPTO_INVALID_MAC`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+An invalid MAC algorithm was specified.
+
 <a id="ERR_CRYPTO_INVALID_MESSAGELEN"></a>
 
 ### `ERR_CRYPTO_INVALID_MESSAGELEN`
@@ -1117,6 +1153,37 @@ added: v24.7.0
 Attempted to use KEM operations while Node.js was not compiled with
 OpenSSL with KEM support.
 
+<a id="ERR_CRYPTO_MAC_FINALIZED"></a>
+
+### `ERR_CRYPTO_MAC_FINALIZED`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+An operation was attempted on a `Mac` object after finalization was attempted
+or an underlying MAC update failed.
+
+<a id="ERR_CRYPTO_MAC_NOT_SUPPORTED"></a>
+
+### `ERR_CRYPTO_MAC_NOT_SUPPORTED`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+Node.js was built without support for the OpenSSL `EVP_MAC` API.
+
+<a id="ERR_CRYPTO_MAC_UPDATE_FAILED"></a>
+
+### `ERR_CRYPTO_MAC_UPDATE_FAILED`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+[`mac.update()`][] failed for an unspecified reason.
+
 <a id="ERR_CRYPTO_OPERATION_FAILED"></a>
 
 ### `ERR_CRYPTO_OPERATION_FAILED`
@@ -2957,8 +3024,9 @@ A call was made and the UDP subsystem was not running.
 ### `ERR_SOCKET_HANDLE_ADOPTED`
 
 An operation was attempted on a [`BoundSocket`][] that had already been adopted
-by a [`net.Server`][] or [`net.Socket`][]. Once a bound socket is adopted, its
-`address()` and `close()` methods can no longer be used.
+by a [`net.Server`][] or [`net.Socket`][], or transferred to another thread.
+Once a bound socket is adopted or transferred, its `address()` and `close()`
+methods can no longer be used.
 
 <a id="ERR_SOURCE_MAP_CORRUPT"></a>
 
@@ -3112,6 +3180,13 @@ This error represents a failed test. Additional information about the failure
 is available via the `cause` property. The `failureType` property specifies
 what the test was doing when the failure occurred.
 
+<a id="ERR_THROTTLED"></a>
+
+### `ERR_THROTTLED`
+
+A call was dropped because a throttled function could not invoke it immediately
+or its pending queue was full.
+
 <a id="ERR_TLS_ALPN_CALLBACK_INVALID_RESULT"></a>
 
 ### `ERR_TLS_ALPN_CALLBACK_INVALID_RESULT`
@@ -3254,7 +3329,8 @@ category.
 ### `ERR_TRACE_EVENTS_UNAVAILABLE`
 
 The `node:trace_events` module could not be loaded because Node.js was compiled
-with the `--without-v8-platform` flag.
+with the `--without-v8-platform` flag, or because the process was initialized by
+an embedder that provides its own V8 platform.
 
 <a id="ERR_TRAILING_JUNK_AFTER_STREAM_END"></a>
 
@@ -3526,9 +3602,10 @@ The `Response` that has been passed to `WebAssembly.compileStreaming` or to
 
 ### `ERR_WORKER_HANDLE_NOT_TRANSFERABLE`
 
-An attempt was made to transfer a `net.Socket` or `net.Server` to another thread
-via a `worker_threads` `postMessage()` call while it was not in a transferable
-state, for example because it had already started reading or had buffered data.
+An attempt was made to transfer a `net.Socket`, `net.Server` or
+`net.BoundSocket` to another thread via a `worker_threads` `postMessage()` call
+while it was not in a transferable state, for example because it had already
+started reading, had buffered data, or had already been adopted.
 
 <a id="ERR_WORKER_INIT_FAILED"></a>
 
@@ -4528,6 +4605,7 @@ The public key in the certificate SubjectPublicKeyInfo could not be read.
 
 An error occurred trying to allocate memory. This should never happen.
 
+[ABORT_ERR]: #abort_err
 [ES Module]: esm.md
 [ICU]: intl.md#internationalization-support
 [JSON Web Key Elliptic Curve Registry]: https://www.iana.org/assignments/jose/jose.xhtml#web-key-elliptic-curve
@@ -4541,14 +4619,17 @@ An error occurred trying to allocate memory. This should never happen.
 [V8's stack trace API]: https://v8.dev/docs/stack-trace-api
 [WHATWG Supported Encodings]: util.md#whatwg-supported-encodings
 [WHATWG URL API]: url.md#the-whatwg-url-api
+[Web IDL error names]: https://webidl.spec.whatwg.org/#dfn-error-names-table
 [`"exports"`]: packages.md#exports
 [`"imports"`]: packages.md#imports
 [`'uncaughtException'`]: process.md#event-uncaughtexception
 [`--disable-proto=throw`]: cli.md#--disable-protomode
-[`--force-fips`]: cli.md#--force-fips
+[`--force-fips`]: cli.md#--force-fipsmode
 [`--no-addons`]: cli.md#--no-addons
 [`--unhandled-rejections`]: cli.md#--unhandled-rejectionsmode
+[`ABORT_ERR`]: #abort_err
 [`BoundSocket`]: net.md#class-netboundsocket
+[`Class: DOMException`]: globals.md#class-domexception
 [`Class: assert.AssertionError`]: assert.md#class-assertassertionerror
 [`ERR_INCOMPATIBLE_OPTION_PAIR`]: #err_incompatible_option_pair
 [`ERR_INVALID_ARG_TYPE`]: #err_invalid_arg_type
@@ -4574,10 +4655,13 @@ An error occurred trying to allocate memory. This should never happen.
 [`dgram.createSocket()`]: dgram.md#dgramcreatesocketoptions-callback
 [`dgram.disconnect()`]: dgram.md#socketdisconnect
 [`dgram.remoteAddress()`]: dgram.md#socketremoteaddress
+[`domException.code`]: https://developer.mozilla.org/en-US/docs/Web/API/DOMException/code
 [`domException.name`]: https://developer.mozilla.org/en-US/docs/Web/API/DOMException/name
 [`errno`(3) man page]: https://man7.org/linux/man-pages/man3/errno.3.html
 [`error.code`]: #errorcode
 [`error.message`]: #errormessage
+[`events.once()`]: events.md#eventsonceemitter-name-options
+[`fetch()`]: globals.md#fetch
 [`fs.Dir`]: fs.md#class-fsdir
 [`fs.cp()`]: fs.md#fscpsrc-dest-options-callback
 [`fs.readFileSync`]: fs.md#fsreadfilesyncpath-options
@@ -4591,6 +4675,7 @@ An error occurred trying to allocate memory. This should never happen.
 [`http`]: http.md
 [`https`]: https.md
 [`libuv Error handling`]: https://docs.libuv.org/en/v1.x/errors.html
+[`mac.update()`]: crypto.md#macupdatedata-inputencoding
 [`net.Server`]: net.md#class-netserver
 [`net.Socket.write()`]: net.md#socketwritedata-encoding-callback
 [`net.Socket`]: net.md#class-netsocket
diff --git a/doc/api/fs.md b/doc/api/fs.md
index 4003651052d0..cdeac8778c6d 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1625,8 +1625,10 @@ changes:
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
-* Returns: {Promise}  Fulfills with a string containing the file system path
-  of the newly created temporary directory.
+* Returns: {Promise} Fulfills with the created directory path.
+  If `encoding` is `'buffer'`, then the resulting directory
+  path is returned as a {Buffer}. Otherwise, the path is returned as a
+  {string} using the specified encoding.
 
 Creates a unique temporary directory. A unique directory name is generated by
 appending six random characters to the end of the provided `prefix`. Due to
@@ -1665,14 +1667,15 @@ added: v24.4.0
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
 * Returns: {Promise} Fulfills with a Promise for an async-disposable Object:
-  * `path` {string} The path of the created directory.
+  * `path` {string|Buffer} The path of the created directory.
   * `remove` {AsyncFunction} A function which removes the created directory.
   * `[Symbol.asyncDispose]` {AsyncFunction} The same as `remove`.
 
 The resulting Promise holds an async-disposable object whose `path` property
-holds the created directory path. When the object is disposed, the directory
-and its contents will be removed asynchronously if it still exists. If the
-directory cannot be deleted, disposal will throw an error. The object has an
+holds the created directory path. If `encoding` is `'buffer'`, the `path` will
+also be a {Buffer}, otherwise a {string}. When the object is disposed, the
+directory and its contents will be removed asynchronously if it still exists. If
+the directory cannot be deleted, disposal will throw an error. The object has an
 async `remove()` method which will perform the same task.
 
 Both this function and the disposal function on the resulting object are
@@ -2213,9 +2216,9 @@ added:
     should stop.
   * `maxQueue` {number} Specifies the number of events to queue between iterations
     of the {AsyncIterator} returned. **Default:** `2048`.
-  * `overflow` {string} Either `'ignore'` or `'throw'` when there are more events to be
+  * `overflow` {string} Either `'ignore'` or `'error'` when there are more events to be
     queued than `maxQueue` allows. `'ignore'` means overflow events are dropped and a
-    warning is emitted, while `'throw'` means to throw an exception. **Default:** `'ignore'`.
+    warning is emitted, while `'error'` means to throw an exception. **Default:** `'ignore'`.
   * `ignore` {string|RegExp|Function|Array} Pattern(s) to ignore. Strings are
     glob patterns (using [`minimatch`][]), RegExp patterns are tested against
     the filename, and functions receive the filename and return `true` to
@@ -3951,7 +3954,7 @@ changes:
   * `encoding` {string} **Default:** `'utf8'`
 * `callback` {Function}
   * `err` {Error}
-  * `directory` {string}
+  * `directory` {string|Buffer}
 
 Creates a unique temporary directory.
 
@@ -3961,12 +3964,14 @@ inconsistencies, avoid trailing `X` characters in `prefix`. Some platforms,
 notably the BSDs, can return more than six random characters, and replace
 trailing `X` characters in `prefix` with random characters.
 
-The created directory path is passed as a string to the callback's second
-parameter.
-
 The optional `options` argument can be a string specifying an encoding, or an
 object with an `encoding` property specifying the character encoding to use.
 
+The created directory path is passed to the callback's second parameter. If
+`encoding` is `'buffer'`, then the resulting directory path is passed as a
+{Buffer}. Otherwise, the path is passed as a {string} using the specified
+encoding.
+
 ```mjs
 import { mkdtemp } from 'node:fs';
 import { join } from 'node:path';
@@ -6423,9 +6428,11 @@ changes:
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
-* Returns: {string}
+* Returns: {string|Buffer}
 
-Returns the created directory path.
+Returns the created directory path. If `encoding` is `'buffer'`, then the
+resulting directory path is returned as a {Buffer}. Otherwise, the path
+is returned as a {string} using the specified encoding.
 
 For detailed information, see the documentation of the asynchronous version of
 this API: [`fs.mkdtemp()`][].
@@ -6443,15 +6450,15 @@ added: v24.4.0
 * `options` {string|Object}
   * `encoding` {string} **Default:** `'utf8'`
 * Returns: {Object} A disposable object:
-  * `path` {string} The path of the created directory.
+  * `path` {string|Buffer} The path of the created directory.
   * `remove` {Function} A function which removes the created directory.
   * `[Symbol.dispose]` {Function} The same as `remove`.
 
 Returns a disposable object whose `path` property holds the created directory
-path. When the object is disposed, the directory and its contents will be
-removed if it still exists. If the directory cannot be deleted, disposal will
-throw an error. The object has a `remove()` method which will perform the same
-task.
+path. If `encoding` is `'buffer'`, the `path` will be a {Buffer}. When the
+object is disposed, the directory and its contents will be removed if it still
+exists. If the directory cannot be deleted, disposal will throw an error. The
+object has a `remove()` method which will perform the same task.
 
 See the [MDN documentation on `using` statements][`using`] for more information about
 explicit resource management.
@@ -7256,8 +7263,9 @@ Asynchronously read the next directory entry via readdir(3) as an
 A promise is returned that will be fulfilled with an {fs.Dirent}, or `null`
 if there are no more directory entries to read.
 
-Directory entries returned by this function are in no particular order as
-provided by the operating system's underlying directory mechanisms.
+For directory reads handled by the native file system, directory entries
+returned by this function are in no particular order as provided by the
+operating system's underlying directory mechanisms.
 Entries added or removed while iterating over the directory might not be
 included in the iteration results.
 
diff --git a/doc/api/http.md b/doc/api/http.md
index 6e6df57bbe12..905f7cb9897c 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -1124,7 +1124,7 @@ const hasContentType = request.hasHeader('content-type');
 
 ### `request.maxHeadersCount`
 
-* Type: {number} **Default:** `2000`
+* Type: {number} **Default:** `1000`
 
 Limits maximum response headers count. If set to 0, no limit will be applied.
 
@@ -1895,7 +1895,7 @@ added: v5.7.0
 added: v0.7.0
 -->
 
-* Type: {number} **Default:** `2000`
+* Type: {number} **Default:** `1000`
 
 Limits maximum incoming headers count. If set to 0, no limit will be applied.
 
diff --git a/doc/api/https.md b/doc/api/https.md
index b08e53d59956..242938d0c9da 100644
--- a/doc/api/https.md
+++ b/doc/api/https.md
@@ -197,7 +197,7 @@ This method is identical to [`server.listen()`][] from [`net.Server`][].
 
 ### `server.maxHeadersCount`
 
-* Type: {number} **Default:** `2000`
+* Type: {number} **Default:** `1000`
 
 See [`server.maxHeadersCount`][] in the `node:http` module.
 
diff --git a/doc/api/net.md b/doc/api/net.md
index d148c2844b44..e43d0036662b 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -739,6 +739,11 @@ Otherwise, if `path` is specified, it behaves the same as
 [`server.listen(path[, backlog][, callback])`][`server.listen(path)`].
 If none of them is specified, an error will be thrown.
 
+> Using the `signal` option to destroy a long-lived server as a resource cleanup
+> mechanism is deprecated. The `signal` option remains appropriate for
+> cancellation, externally propagated aborts, and timeouts. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 If `exclusive` is `false` (default), then cluster workers will use the same
 underlying handle, allowing connection handling duties to be shared. When
 `exclusive` is `true`, the handle is not shared, and attempted port sharing
@@ -935,6 +940,13 @@ server.listen(8000);
 A listening [`net.Server`][] can be transferred the same way, which moves the
 listening socket itself (and its pending accept queue) to the receiving thread.
 
+An un-adopted TCP [`BoundSocket`][] can also be transferred, which moves the
+bound (but not yet listening or connected) socket. This allows a port to be
+reserved synchronously on one thread and adopted by a server or outgoing
+connection on another. Pipe binds are not transferable. After the transfer, the
+source `BoundSocket` behaves as if it had been adopted: `address()`, `fd()` and
+`close()` throw [`ERR_SOCKET_HANDLE_ADOPTED`][].
+
 ### `new net.Socket([options])`
 
 <!-- YAML
@@ -1616,7 +1628,9 @@ corresponding system default unchanged.
 
 `initialDelay` and `interval` are specified in milliseconds but the
 underlying socket options are configured in whole seconds; the values are
-divided by `1000` and rounded down before being applied.
+divided by `1000` and rounded down before being applied. For example,
+setting `initialDelay` to `400` will result in a `TCP_KEEPIDLE` of `0`
+seconds (since `400 / 1000` rounds down to `0`).
 
 Enabling the keep-alive functionality will set the following socket options:
 
@@ -1858,6 +1872,13 @@ file system entry; abstract and TCP binds have none to remove.
 When a pipe `BoundSocket` bound to a source `path` is adopted as a client, that
 path is reported as the socket's `localAddress` once it connects.
 
+An un-adopted TCP `BoundSocket` can be moved to another thread by listing it in
+the `transferList` of a [`worker_threads`][] `postMessage()` call, see
+[Transferring TCP handles to other threads][]. It can likewise be sent to a
+child process as the `sendHandle` argument of [`subprocess.send()`][]. In both
+cases the source is left in the adopted state. Pipe binds cannot be moved
+either way.
+
 When an adopted `BoundSocket` connects to a numeric IP literal, `connect(2)` is
 issued synchronously, so [`socket.localAddress`][] is resolved once
 [`socket.connect()`][] returns. Connection failures are still reported via a
@@ -2488,6 +2509,7 @@ net.isIPv6('fhqwhgads'); // returns false
 [`socket.setTimeout()`]: #socketsettimeouttimeout-callback
 [`socket.setTimeout(timeout)`]: #socketsettimeouttimeout-callback
 [`stream.getDefaultHighWaterMark()`]: stream.md#streamgetdefaulthighwatermarkobjectmode
+[`subprocess.send()`]: child_process.md#subprocesssendmessage-sendhandle-options-callback
 [`worker_threads`]: worker_threads.md
 [`writable.destroy()`]: stream.md#writabledestroyerror
 [`writable.destroyed`]: stream.md#writabledestroyed
diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index 1a91a5724362..970b4b6728cd 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1087,6 +1087,54 @@ changes:
 The high resolution millisecond timestamp representing the time immediately
 before Node.js receives the first byte of the response from the server.
 
+### `performanceResourceTiming.finalResponseHeadersStart`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the final response,
+as opposed to an interim response.
+
+### `performanceResourceTiming.firstInterimResponseStart`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the first interim response, such as
+a `103 Early Hints` response.
+
+### `performanceResourceTiming.responseStart`
+
+<!-- YAML
+added:
+  - v18.2.0
+  - v16.17.0
+changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65017
+    description: This property now returns `firstInterimResponseStart`
+                 when it is non-zero.
+  - version: v19.0.0
+    pr-url: https://github.com/nodejs/node/pull/44483
+    description: This property getter must be called with the
+                 `PerformanceResourceTiming` object as the receiver.
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the response from the server. This
+is `firstInterimResponseStart` when it is non-zero, and
+`finalResponseHeadersStart` otherwise.
+
 ### `performanceResourceTiming.responseEnd`
 
 <!-- YAML
@@ -1162,6 +1210,37 @@ A number representing the size (in octets) received from the fetch
 (HTTP or cache), of the message body, after removing any applied
 content-codings.
 
+### `performanceResourceTiming.renderBlockingStatus`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* Type: {string}
+
+The render blocking status of the resource. It is either `'blocking'` or `'non-blocking'`.
+
+### `performanceResourceTiming.contentType`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* Type: {string}
+
+The minimized MIME type of the content of the fetched resource, or an empty
+string if it cannot be determined.
+
+### `performanceResourceTiming.contentEncoding`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* Type: {string}
+
+The content encoding of the fetched resource, such as `'gzip'` or `'br'`.
+
 ### `performanceResourceTiming.toJSON()`
 
 <!-- YAML
@@ -1635,6 +1714,89 @@ added:
 
 Returns a {RecordableHistogram}.
 
+## `perf_hooks.createSlidingWindowHistogram(options)`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `options` {Object}
+  * `chunks` {number} The number of histogram chunks retained. Must be an
+    integer between `1` and `1024`.
+  * `chunkDuration` {number} The duration of each chunk in milliseconds. Must
+    be an integer between `1` and `18_446_744_073_709`. Exactly one of
+    `chunkDuration` and `recordsPerChunk` must be specified.
+  * `recordsPerChunk` {number} The number of calls to `record()` assigned to
+    each chunk. Must be an integer between `1` and `Number.MAX_SAFE_INTEGER`.
+    Exactly one of `chunkDuration` and `recordsPerChunk` must be specified.
+  * `lowest` {number|bigint} The lowest discernible value. Must be an integer
+    value greater than `0`. **Default:** `1`.
+  * `highest` {number|bigint} The highest recordable value. Must be an integer
+    value that is equal to or greater than two times `lowest`.
+    **Default:** `Number.MAX_SAFE_INTEGER`.
+  * `figures` {number} The number of accuracy digits. Must be an integer between
+    `1` and `5`. **Default:** `3`.
+* Returns: {SlidingWindowHistogram}
+
+Creates a {SlidingWindowHistogram} that retains the latest `chunks` histogram
+chunks. Rotation is lazy and does not create a timer. Time-based rotation is
+evaluated when `record()` or `snapshot()` is called. Count-based rotation is
+evaluated when `record()` is called.
+
+One histogram chunk is allocated during construction. Additional chunks are
+allocated lazily. The maximum native memory used by the window scales with
+`chunks` and with the `lowest`, `highest`, and `figures` histogram options.
+
+The window boundary has chunk-level precision. With `N` chunks of duration
+`D`, a recorded value is retained for between `(N - 1) * D` and `N * D`
+milliseconds. Once a count-based window is populated, it retains between
+`(N - 1) * C + 1` and `N * C` recording attempts, where `C` is
+`recordsPerChunk`. Recording attempts which exceed `highest` are included when
+determining count-based rotation.
+
+```js
+const { createSlidingWindowHistogram } = require('node:perf_hooks');
+
+const window = createSlidingWindowHistogram({
+  chunks: 6,
+  chunkDuration: 10_000,
+});
+
+window.record(20_000_000);
+
+// Materialize the current window as an independent Histogram.
+const snapshot = window.snapshot();
+console.log(snapshot.percentile(99));
+```
+
+## `perf_hooks.importHistogram(data)`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `data` {Uint8Array} A CBOR-encoded histogram previously produced by
+  [`histogram.export()`][].
+* Returns: {RecordableHistogram}
+
+Reconstructs a histogram from a CBOR-encoded `Uint8Array`. The returned
+histogram is a full {RecordableHistogram} with all bucket data, configuration,
+and EWMA state restored. New values can be recorded into it.
+
+```js
+const { createHistogram, importHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+for (let i = 1; i <= 1000; i++) h.record(i);
+
+// Serialize and reconstruct
+const data = h.export();
+const h2 = importHistogram(data);
+
+console.log(h2.count);          // 1000
+console.log(h2.percentile(99)); // Same as h.percentile(99)
+```
+
 ## `perf_hooks.eventLoopUtilization([utilization1[, utilization2]])`
 
 <!-- YAML
@@ -1961,6 +2123,43 @@ added:
 The number of times the event loop delay exceeded the maximum 1 hour event
 loop delay threshold.
 
+### `histogram.export()`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* Returns: {Uint8Array}
+
+Serializes the histogram to a [CBOR][]-encoded (RFC 8949) `Uint8Array`
+suitable for transmission or persistent storage. The encoding uses a
+delta-encoded sparse representation of the bucket counts, so the output size
+scales with the number of distinct recorded values rather than the total
+bucket count.
+
+The output includes all histogram configuration, bucket data, and EWMA
+state (when enabled). It can be reconstructed into a new histogram using
+[`perf_hooks.importHistogram()`][].
+
+The CBOR payload is a map with integer keys:
+
+| Key | Type    | Field                                         |
+| --- | ------- | --------------------------------------------- |
+| 0   | uint    | Format version (currently 1)                  |
+| 1   | uint    | Lowest discernible value                      |
+| 2   | uint    | Highest trackable value                       |
+| 3   | uint    | Significant figures                           |
+| 4   | uint    | Total count                                   |
+| 5   | uint    | Min value                                     |
+| 6   | uint    | Max value                                     |
+| 7   | uint    | Normalizing index offset                      |
+| 8   | float64 | Conversion ratio                              |
+| 9   | uint    | Counts array length                           |
+| 10  | array   | Delta-encoded sparse counts `[delta, c, ...]` |
+| 11  | map     | EWMA state (omitted when disabled)            |
+
+Any standard CBOR decoder can parse the output.
+
 ### `histogram.ewmaMean`
 
 <!-- YAML
@@ -2132,6 +2331,41 @@ added: v11.10.0
 
 The mean of the recorded event loop delays.
 
+### `histogram.meanCI([options])`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `options` {Object}
+  * `confidence` {number} The confidence level for the interval, between
+    0 and 1 (exclusive). **Default:** `0.95`.
+* Returns: {Object}
+  * `mean` {number} The mean estimate, equivalent to `histogram.mean`.
+  * `lower` {number} The lower bound of the confidence interval.
+  * `upper` {number} The upper bound of the confidence interval.
+
+Returns a two-sided confidence interval for the mean using Student's
+t-distribution and the sample standard error. A higher confidence level
+produces a wider interval. This interval assumes that samples are independent
+and approximately normally distributed, although the approximation is robust
+for sufficiently large samples.
+
+The result reflects the histogram's configured precision and is calculated
+from the values represented by its buckets. With fewer than two recorded
+values, `lower` and `upper` are `NaN`. When all recorded values are equal,
+`lower` and `upper` equal `mean`.
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+for (let i = 1; i <= 100; i++) h.record(i);
+
+const { mean, lower, upper } = h.meanCI();
+console.log(`mean=${mean}, 95% CI=[${lower}, ${upper}]`);
+```
+
 ### `histogram.min`
 
 <!-- YAML
@@ -2248,6 +2482,82 @@ Returns the values at the specified percentiles, computed in a single
 efficient pass over the histogram data. More efficient than calling
 `histogram.percentile()` multiple times.
 
+### `histogram.qrde([options])`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `options` {Object}
+  * `bins` {number} The number of equal-probability density bins to return.
+    Must be between 1 and 1000. Cannot be used with `probabilities`.
+    **Default:** `100`.
+  * `probabilities` {number\[]} Custom probability boundaries. The array must
+    contain between 2 and 1001 strictly increasing values, start with `0`, and
+    end with `1`. Cannot be used with `bins`.
+  * `dequantize` {string} Controls whether repeated bucket values are spread
+    deterministically over their equivalent-value ranges. May be `'none'`,
+    `'hdr'`, or `'all'`. **Default:** `'hdr'`.
+  * `cache` {boolean} When `true`, retains the expanded histogram snapshot for
+    reuse by subsequent calls with `cache: true`. The snapshot is invalidated
+    when the histogram is modified. **Default:** `false`.
+* Returns: {Promise} Fulfills with an {Object} containing:
+  * `probabilities` {Float64Array} The probability boundaries used by the
+    estimate.
+  * `quantiles` {Float64Array} The quantiles at the probability boundaries.
+  * `densities` {Float64Array} The density within each quantile interval.
+  * `count` {bigint} The number of values in the histogram snapshot.
+  * `bucketCount` {number} The number of occupied HDR buckets.
+  * `corrections` {number} The number of non-monotonic floating-point results
+    that were clamped to the preceding quantile.
+  * `dequantize` {string} The selected dequantization mode.
+
+Returns a quantile-respectful density estimate based on the Harrell-Davis
+quantile estimator. By default, `bins` generates equal probability boundaries.
+The `probabilities` option can instead focus the estimate on regions such as
+p90, p99, p99.9, and p99.99. The density for interval `i` contains probability
+mass `probabilities[i + 1] - probabilities[i]`. The histogram is snapshotted
+when the method is called. Snapshot expansion and the estimate are calculated
+in the libuv thread pool. Highly concentrated beta weights use a second-order
+asymptotic approximation to avoid numerical convergence loss at large sample
+counts.
+
+Setting `cache` to `true` avoids repeating snapshot capture and expansion when
+several estimates are requested from an unchanged histogram. The retained
+snapshot uses memory proportional to the number of occupied HDR buckets and is
+released when the histogram is next modified.
+
+QRDE temporarily uses approximately one additional HDR count array plus 32
+bytes per occupied bucket. With `cache: true`, the expanded 32-byte-per-bucket
+snapshot remains allocated. The following estimates use `lowest: 1` and
+`highest: Number.MAX_SAFE_INTEGER` and exclude allocator and JavaScript object
+overhead:
+
+| `figures` | Histogram | Maximum expanded snapshot | Peak cache-miss QRDE |
+| --------- | --------: | ------------------------: | -------------------: |
+| 1         |   6.3 KiB |                    25 KiB |               31 KiB |
+| 2         |    47 KiB |                   188 KiB |              235 KiB |
+| 3         |   352 KiB |                   1.4 MiB |              1.7 MiB |
+| 4         |   5.0 MiB |                    20 MiB |               25 MiB |
+| 5         |    37 MiB |                   148 MiB |              185 MiB |
+
+The maximum snapshot column assumes every representable bucket is occupied.
+Lower `highest` values reduce histogram and temporary copy sizes. Concurrent
+calls that miss the cache each require their own temporary copy and expanded
+snapshot.
+
+HDR histograms aggregate observations into equivalent-value buckets. The
+`'hdr'` dequantization mode models repeated values in buckets wider than one
+unit as a continuous uniform distribution over the bucket resolution. This
+reduces density artifacts introduced by HDR quantization while preserving
+repeated unit-resolution values as point masses. The `'all'` mode also
+dequantizes repeated unit-resolution values. Use `'none'` to calculate the
+grouped Harrell-Davis estimator using bucket midpoints directly.
+
+An empty histogram returns the requested `probabilities` but produces empty
+`quantiles` and `densities` arrays. A non-dequantized interval whose quantile
+boundaries are equal has an infinite density.
+
 ### `histogram.reset()`
 
 <!-- YAML
@@ -2422,6 +2732,54 @@ Subtracts the values of `other` from this histogram. Both histograms should
 have compatible configurations. Bucket counts that would become negative
 are clamped to zero.
 
+## Class: `SlidingWindowHistogram`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+Records values into a lazily rotated ring of histogram chunks. Instances are
+created using [`perf_hooks.createSlidingWindowHistogram()`][] and cannot be
+constructed directly. A `SlidingWindowHistogram` does not extend {Histogram};
+call `snapshot()` to materialize the current window as a {Histogram}.
+
+`SlidingWindowHistogram` instances cannot be cloned or transferred through a
+{MessagePort}.
+
+### `slidingWindowHistogram.record(val)`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `val` {number|bigint} The amount to record.
+
+Records `val` in the current chunk. For a count-based window, every call that
+reaches the native histogram counts toward rotation, including values which
+exceed the configured `highest` value.
+
+### `slidingWindowHistogram.reset()`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+Invalidates all chunks in the current window. Allocated chunks are reset
+lazily when reused.
+
+### `slidingWindowHistogram.snapshot()`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* Returns: {Histogram}
+
+Materializes the current window as a new, independent {Histogram}. Values
+recorded or expired after this method returns do not change the returned
+histogram. Materialization allocates one histogram and merges every retained
+chunk.
+
 ## Histogram analysis examples
 
 The `Histogram` class provides statistical analysis methods useful for
@@ -2836,6 +3194,7 @@ dns.promises.resolve('localhost');
 ```
 
 [Async Hooks]: async_hooks.md
+[CBOR]: https://www.rfc-editor.org/rfc/rfc8949
 [Cliff's delta]: https://en.wikipedia.org/wiki/Effect_size#Cliff's_delta
 [Cohen's d]: https://en.wikipedia.org/wiki/Effect_size#Cohen's_d
 [Fetch Response Body Info]: https://fetch.spec.whatwg.org/#response-body-info
@@ -2850,7 +3209,10 @@ dns.promises.resolve('localhost');
 [Worker threads]: worker_threads.md#worker-threads
 [`'exit'`]: process.md#event-exit
 [`child_process.spawnSync()`]: child_process.md#child_processspawnsynccommand-args-options
+[`histogram.export()`]: #histogramexport
+[`perf_hooks.createSlidingWindowHistogram()`]: #perf_hookscreateslidingwindowhistogramoptions
 [`perf_hooks.eventLoopUtilization()`]: #perf_hookseventlooputilizationutilization1-utilization2
+[`perf_hooks.importHistogram()`]: #perf_hooksimporthistogramdata
 [`perf_hooks.monitorEventLoopDelay()`]: #perf_hooksmonitoreventloopdelayoptions
 [`perf_hooks.timerify()`]: #perf_hookstimerifyfn-options
 [`process.hrtime()`]: process.md#processhrtimetime
diff --git a/doc/api/permissions.md b/doc/api/permissions.md
index 3d8f9fe81038..2887d9624f61 100644
--- a/doc/api/permissions.md
+++ b/doc/api/permissions.md
@@ -250,6 +250,14 @@ does not exist, the wildcard will not be added, and access will be limited to
 yet, make sure to explicitly include the wildcard:
 `/my-path/folder-do-not-exist/*`.
 
+Some `node:fs` operations act on an already-open file descriptor rather than a
+path, so they cannot be tied to a `--allow-fs-read` or `--allow-fs-write` grant.
+When the permission model is enabled these operations are disabled and throw
+`ERR_ACCESS_DENIED`, regardless of how the descriptor was obtained. This applies
+both to the top-level `node:fs` functions and to the equivalent
+`FileHandle` methods, and currently includes `fsync`/`fdatasync`,
+`fchmod`, and `fchown` (and their synchronous variants).
+
 #### Configuration file support
 
 In addition to passing permission flags on the command line, they can also be
@@ -333,6 +341,14 @@ There are constraints you need to know before using this system:
   to read files before environment initialization. As a result, such flags are
   not subject to the rules of the Permission Model. The same applies for V8
   flags that can be set via runtime through `v8.setFlagsFromString`.
+* Files that Node.js itself creates, writes, or reads at a location selected
+  by an operator flag may not be consistently checked against the Permission
+  Model, in particular when the flag accepts a template or pattern that
+  expands to several paths. For example, trace files rotated by
+  `--trace-event-file-pattern` (`${rotation}`) can be written even when the
+  expanded path is not covered by `--allow-fs-write`. Because the location is
+  chosen by the operator, gaps like this are treated as regular bugs rather
+  than vulnerabilities. Please report them through the regular issue tracker.
 * OpenSSL engines cannot be requested at runtime when the Permission
   Model is enabled, affecting the built-in crypto, https, and tls modules.
 * Run-Time Loadable Extensions cannot be loaded when the Permission Model is
diff --git a/doc/api/process.md b/doc/api/process.md
index 4d2add1373cb..e58695636215 100644
--- a/doc/api/process.md
+++ b/doc/api/process.md
@@ -756,7 +756,8 @@ process.on('SIGTERM', handle);
 * `'SIGTERM'` and `'SIGINT'` have default handlers on non-Windows platforms that
   reset the terminal mode before exiting with code `128 + signal number`. If one
   of these signals has a listener installed, its default behavior will be
-  removed (Node.js will no longer exit).
+  removed. Signal events are emitted asynchronously, so Node.js may exit before
+  the listener is called if the event loop is otherwise empty.
 * `'SIGPIPE'` is ignored by default. It can have a listener installed.
 * `'SIGHUP'` is generated on Windows when the console window is closed, and on
   other platforms under various similar conditions. See signal(7). It can have a
diff --git a/doc/api/quic.md b/doc/api/quic.md
index 75dba5028425..71d1d7215d07 100644
--- a/doc/api/quic.md
+++ b/doc/api/quic.md
@@ -321,10 +321,17 @@ There are two ways to write data to a stream:
   up front or can be expressed as an iterable.
 * **Writer** — access [`stream.writer`][] to push data incrementally. The
   writer exposes synchronous methods (`writeSync()`, `writevSync()`,
-  `endSync()`) that return immediately, as well as async equivalents
-  (`write()`, `writev()`, `end()`) that wait for drain when backpressured.
+  `endSync()`) that return immediately, as well as asynchronous counterparts
+  (`write()`, `writev()`, `end()`). The asynchronous `write()` and `writev()`
+  methods use the stream/iter strict backpressure policy: when the write buffer
+  is full, they reject with `ERR_INVALID_STATE` instead of waiting for capacity.
+  If a drain is already pending, `end()` waits for it before closing. Check
+  `writer.canWrite` before writing. To wait for capacity, use `ondrain()` from
+  `node:stream/iter`, then retry the write. The stream's `onblocked` callback
+  reports that transport flow control has blocked progress, but does not
+  signal that writer capacity is available again.
   `writeSync()` returns `false` when the write buffer is full; the caller
-  should wait for drain before retrying.
+  should wait with `ondrain()` before retrying.
 
 These two approaches are mutually exclusive for a given stream.
 
@@ -2322,12 +2329,16 @@ The Writer has the following methods:
 
 * `writeSync(chunk)` — Synchronous write. Returns `true` if accepted,
   `false` if flow-controlled. Data is NOT accepted on `false`.
-* `write(chunk[, options])` — Async write with drain wait. `options.signal`
-  is checked at entry but not observed during the write.
+* `write(chunk[, options])` — Async write. Rejects with `ERR_INVALID_STATE`
+  when the stream is flow-controlled rather than waiting for capacity.
+  `options.signal` is checked at entry but not observed during the write.
 * `writevSync(chunks)` — Synchronous vectored write. All-or-nothing.
-* `writev(chunks[, options])` — Async vectored write.
+* `writev(chunks[, options])` — Async vectored write. Rejects with
+  `ERR_INVALID_STATE` when the stream is flow-controlled rather than waiting
+  for capacity.
 * `endSync()` — Synchronous close. Returns total bytes or `-1`.
-* `end([options])` — Async close.
+* `end([options])` — Async close. If a drain is already pending, waits for it
+  before closing.
 * `fail(reason)` — Errors the stream (sends `RESET_STREAM` to peer).
   When `reason` is a [`QuicError`][], its [`error.errorCode`][] is used
   as the wire code on the resulting `RESET_STREAM` frame; otherwise
@@ -2337,7 +2348,20 @@ The Writer has the following methods:
   See [`stream.destroy()`][] for a full-stream abort that also resets
   the readable side via `STOP_SENDING`.
 * `canWrite` — `true` if writes will be accepted, `false` if at capacity,
-  or `null` if closed/errored.
+  or `null` if closed/errored. When `writeSync()` returns `false`, use
+  `ondrain()` from `node:stream/iter` to wait before retrying. If `ondrain()`
+  returns `null`, no drain wait is available and the write should not be
+  retried.
+
+```mjs
+import { ondrain } from 'node:stream/iter';
+
+while (!writer.writeSync(chunk)) {
+  const drain = ondrain(writer);
+  if (drain === null) break;
+  await drain;
+}
+```
 
 The bytes from each `writeSync()` / `writevSync()` / `write()` / `writev()`
 input chunk are copied into an internal buffer, so the caller's source
@@ -2657,8 +2681,8 @@ added: v23.8.0
 
 The endpoint maintains an internal cache of validated socket addresses as a
 performance optimization. This option sets the maximum number of addresses
-that are cached. This is an advanced option that users typically won't have
-need to specify.
+that are cached. The value must be greater than `0`. This is an advanced option
+that users typically won't have need to specify.
 
 #### `endpointOptions.disableStatelessReset`
 
diff --git a/doc/api/repl.md b/doc/api/repl.md
index 03dd7dc490f7..a9f0f662a6a4 100644
--- a/doc/api/repl.md
+++ b/doc/api/repl.md
@@ -276,6 +276,15 @@ Uncaught SyntaxError: Identifier 'm' has already been declared
 
 [`--no-experimental-repl-await`][] shall disable top-level await in REPL.
 
+### Error handling
+
+By default, uncaught exceptions in the REPL are printed to the output stream
+(as with `Uncaught Error: REPL await` above). `uncaughtException` listeners
+can be added freely in both standalone and nested REPLs. The `handleError`
+option of [`repl.start()`][] can customize this behavior, including
+forwarding exceptions to [`'uncaughtException'`][] by returning
+`'unhandled'`.
+
 ### Reverse-i-search
 
 <!-- YAML
@@ -469,6 +478,9 @@ const firstInstance = repl.start(options);
 const secondInstance = new repl.REPLServer(options);
 ```
 
+Calling `repl.REPLServer()` without the `new` keyword throws a `TypeError`
+(see [DEP0185][]).
+
 ### Event: `'exit'`
 
 <!-- YAML
@@ -1154,6 +1166,7 @@ avoiding open network interfaces.
 
 Original code from <https://gist.github.com/TooTallNate/2053342>.
 
+[DEP0185]: deprecations.md#dep0185-instantiating-noderepl-classes-without-new
 [TTY keybindings]: readline.md#tty-keybindings
 [ZSH]: https://en.wikipedia.org/wiki/Z_shell
 [`'uncaughtException'`]: process.md#event-uncaughtexception
diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 1b222ee1b4b7..9a2afaca13b5 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -30,7 +30,9 @@ import sqlite from 'node:sqlite';
 const sqlite = require('node:sqlite');
 ```
 
-This module is only available under the `node:` scheme.
+This module is only available under the `node:` scheme. SQL trace events can
+be observed via the [`diagnostics_channel`][] module. See
+[`'sqlite.db.query'`][] for details.
 
 The following example shows the basic usage of the `node:sqlite` module to open
 an in-memory database, write data to the database, and then read the data back.
@@ -298,7 +300,10 @@ added: v22.5.0
 -->
 
 Closes the database connection. An exception is thrown if the database is not
-open. This method is a wrapper around [`sqlite3_close_v2()`][].
+open. An [`ERR_INVALID_STATE`][] error is thrown if the method is called while
+a statement is executing, such as inside a user-defined function, an aggregate
+function, an authorizer callback, or a [`'sqlite.db.query'`][] subscriber. This
+method is a wrapper around [`sqlite3_close_v2()`][].
 
 ### `database.loadExtension(path[, entryPoint])`
 
@@ -425,6 +430,11 @@ wrapper around [`sqlite3_create_function_v2()`][].
 
 <!-- YAML
 added: v24.10.0
+changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65156
+    description: Accessing the invoking database connection from the authorizer
+                 callback now throws.
 -->
 
 * `callback` {Function|null} The authorizer function to set, or `null` to
@@ -450,6 +460,31 @@ The callback must return one of the following constants:
 * `SQLITE_DENY` - Deny the operation (causes an error).
 * `SQLITE_IGNORE` - Ignore the operation (silently skip).
 
+SQLite requires that the authorizer callback not modify the database connection
+that invoked it, which includes preparing and stepping statements. Methods that
+would do so throw an error with code `ERR_INVALID_STATE` while the callback is
+on the stack, including `database.prepare()`, `database.exec()`, the execution
+methods of that connection's statements, iterators, and tag stores, and
+`database.setAuthorizer()` itself. Other connections remain usable.
+
+The callback can also be invoked from within `statement.run()`,
+`statement.get()`, and similar methods, because SQLite may re-prepare a
+statement during execution after a schema change.
+
+Separately, a statement that is currently being executed cannot be reentered.
+Calling `statement.close()` on it would free the virtual machine that is
+running, and re-running it through `statement.run()`, `statement.get()`,
+`statement.all()`, `statement.iterate()`, `iterator.next()`,
+`iterator.return()`, or the equivalent tag store methods would reset that
+virtual machine mid-execution. All of these throw an `ERR_INVALID_STATE` error
+instead. This applies to any callback SQLite invokes during execution, such as a
+user-defined function. Other statements on the connection remain usable.
+
+Operations that touch no SQLite state stay available from the callback:
+`sqlTagStore.clear()`, which only drops cached statements, and `next()` and
+`return()` on an already-drained iterator, which keep returning
+`{ done: true }`.
+
 ```cjs
 const { DatabaseSync, constants } = require('node:sqlite');
 const db = new DatabaseSync(':memory:');
@@ -607,8 +642,10 @@ added: v24.16.0
 Loads a serialized database into this connection, replacing the current
 database. The deserialized database is writable. Existing prepared statements
 are finalized before deserialization is attempted, even if the operation
-subsequently fails. This method is a wrapper around
-[`sqlite3_deserialize()`][].
+subsequently fails. An [`ERR_INVALID_STATE`][] error is thrown if the method is
+called while a database callback is on the stack, for example a user-defined
+function, an aggregate function, an authorizer, or a changeset filter or conflict
+handler. This method is a wrapper around [`sqlite3_deserialize()`][].
 
 ```mjs
 import { DatabaseSync } from 'node:sqlite';
@@ -1052,6 +1089,20 @@ returns an empty array. The prepared statement [parameters are bound][] using
 the values in `namedParameters` and `anonymousParameters`. See
 [Binding parameters][].
 
+### `statement.close()`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+Finalizes the prepared statement. An exception is thrown if the statement is
+already finalized. An [`ERR_INVALID_STATE`][] error is thrown if this statement
+is currently executing, which happens when the method is called from a callback
+that the statement itself triggered, such as a user-defined function, an
+aggregate function, or a [`'sqlite.db.query'`][] subscriber. Other statements
+on the same connection can be finalized from such a callback. This method is a
+wrapper around [`sqlite3_finalize()`][].
+
 ### `statement.columns()`
 
 <!-- YAML
@@ -1274,6 +1325,17 @@ added: v22.5.0
 The source SQL text of the prepared statement. This property is a
 wrapper around [`sqlite3_sql()`][].
 
+### `statement[Symbol.dispose]()`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+Finalizes the prepared statement. If the prepared statement is already
+finalized, then this is a no-op. An [`ERR_INVALID_STATE`][] error is thrown if
+this statement is currently executing, under the same conditions as
+[`statement.close()`][].
+
 ## Class: `SQLTagStore`
 
 <!-- YAML
@@ -1752,7 +1814,9 @@ callback function to indicate what type of operation is being authorized.
 [Run-Time Limits]: https://www.sqlite.org/c3ref/limit.html
 [SQL injection]: https://en.wikipedia.org/wiki/SQL_injection
 [Type conversion between JavaScript and SQLite]: #type-conversion-between-javascript-and-sqlite
+[`'sqlite.db.query'`]: diagnostics_channel.md#event-sqlitedbquery
 [`ATTACH DATABASE`]: https://www.sqlite.org/lang_attach.html
+[`ERR_INVALID_STATE`]: errors.md#err_invalid_state
 [`PRAGMA foreign_keys`]: https://www.sqlite.org/pragma.html#pragma_foreign_keys
 [`SQLITE_DBCONFIG_DEFENSIVE`]: https://www.sqlite.org/c3ref/c_dbconfig_defensive.html#sqlitedbconfigdefensive
 [`SQLITE_DETERMINISTIC`]: https://www.sqlite.org/c3ref/c_deterministic.html
@@ -1763,6 +1827,7 @@ callback function to indicate what type of operation is being authorized.
 [`database.createTagStore()`]: #databasecreatetagstoremaxsize
 [`database.serialize()`]: #databaseserializedbname
 [`database.setAuthorizer()`]: #databasesetauthorizercallback
+[`diagnostics_channel`]: diagnostics_channel.md
 [`sqlite3_backup_finish()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupfinish
 [`sqlite3_backup_init()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupinit
 [`sqlite3_backup_step()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupstep
@@ -1779,6 +1844,7 @@ callback function to indicate what type of operation is being authorized.
 [`sqlite3_deserialize()`]: https://sqlite.org/c3ref/deserialize.html
 [`sqlite3_exec()`]: https://www.sqlite.org/c3ref/exec.html
 [`sqlite3_expanded_sql()`]: https://www.sqlite.org/c3ref/expanded_sql.html
+[`sqlite3_finalize()`]: https://www.sqlite.org/c3ref/finalize.html
 [`sqlite3_get_autocommit()`]: https://sqlite.org/c3ref/get_autocommit.html
 [`sqlite3_last_insert_rowid()`]: https://www.sqlite.org/c3ref/last_insert_rowid.html
 [`sqlite3_load_extension()`]: https://www.sqlite.org/c3ref/load_extension.html
@@ -1792,6 +1858,7 @@ callback function to indicate what type of operation is being authorized.
 [`sqlite3session_create()`]: https://www.sqlite.org/session/sqlite3session_create.html
 [`sqlite3session_delete()`]: https://www.sqlite.org/session/sqlite3session_delete.html
 [`sqlite3session_patchset()`]: https://www.sqlite.org/session/sqlite3session_patchset.html
+[`statement.close()`]: #statementclose
 [`statement.setAllowBareNamedParameters()`]: #statementsetallowbarenamedparametersenabled
 [`statement.setAllowUnknownNamedParameters()`]: #statementsetallowunknownnamedparametersenabled
 [busy timeout]: https://sqlite.org/c3ref/busy_timeout.html
diff --git a/doc/api/stream.md b/doc/api/stream.md
index d4061bb5fce0..828135b13cea 100644
--- a/doc/api/stream.md
+++ b/doc/api/stream.md
@@ -3531,6 +3531,10 @@ changes:
                  `WritableStream`.
 -->
 
+> Stability: 0 - Deprecated. Using [`stream.addAbortSignal()`][] to destroy
+> long-lived stream resources is documentation-only deprecated. See
+> [DEP0209](deprecations.md#dep0209-using-abortsignal-to-dispose-of-resources).
+
 * `signal` {AbortSignal} A signal representing possible cancellation
 * `stream` {Stream|ReadableStream|WritableStream} A stream to attach a signal
   to.
diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index cf2168e326b5..dafd57917d7c 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -458,6 +458,12 @@ or errored, this is a no-op. Unlike `write()` and `end()`, `fail()` is
 unconditionally synchronous because failing a writer is a pure state
 transition with no async work to perform.
 
+#### `writer[Symbol.asyncDispose]()`
+
+If the writer is open, calls `writer.fail()`. If the writer is closing after
+`end()` or `endSync()`, waits for buffered data to drain. If the writer is
+already closed or errored, resolves immediately.
+
 #### `writer.write(chunk[, options])`
 
 * `chunk` {Uint8Array|string}
@@ -531,7 +537,8 @@ added: v24.20.0
 
 Create an async byte stream from the given input. Strings are UTF-8 encoded.
 `ArrayBuffer` and `ArrayBufferView` values are wrapped as `Uint8Array`. Arrays
-and iterables in `input` are recursively flattened and normalized.
+and iterables in `input` are recursively flattened and normalized. Flattened
+values may be split across implementation-defined bounded batches.
 
 Objects implementing `Symbol.for('Stream.toAsyncStreamable')` or
 `Symbol.for('Stream.toStreamable')` are converted via those protocols. The
@@ -599,7 +606,8 @@ added: v24.20.0
 * `...transforms` {Function|Object} Zero or more transforms to apply.
 * `writer` {Object} Destination with `write(chunk)` method.
 * `options` {Object}
-  * `signal` {AbortSignal} Abort the pipeline.
+  * `signal` {AbortSignal} Abort the pipeline. Aborting fails the destination
+    writer unless `preventFail` is `true`.
   * `preventClose` {boolean} If `true`, do not call `writer.end()` when
     the source ends. **Default:** `false`.
   * `preventFail` {boolean} If `true`, do not call `writer.fail()` on
@@ -678,8 +686,10 @@ added: v24.20.0
   * `signal` {AbortSignal} Abort the pipeline.
 * Returns: {AsyncIterable} whose chunks fulfill with {Uint8Array\[]}
 
-Create a lazy async pipeline. Data is not read from `source` until the
-returned iterable is consumed. Transforms are applied in order.
+Create a lazy async pipeline. Source conversion and streamable protocol
+dispatch occur when `pull()` is called, but data is not read from `source`
+until the returned iterable is consumed. A signal that is already aborted is
+thrown synchronously after source conversion. Transforms are applied in order.
 
 ```mjs
 import { from, pull, text } from 'node:stream/iter';
@@ -747,7 +757,8 @@ added: v24.20.0
 * `...transforms` {Function|Object} Zero or more sync transforms.
 * Returns: {Iterable} whose chunks return {Uint8Array\[]}
 
-Synchronous version of [`pull()`][]. All transforms must be synchronous.
+Synchronous version of [`pull()`][]. Source conversion and streamable protocol
+dispatch occur when `pullSync()` is called. All transforms must be synchronous.
 
 ## Push streams
 
@@ -765,7 +776,9 @@ added: v24.20.0
     **Default:** `16384`.
   * `backpressure` {string} Backpressure policy: `'strict'`, `'unbounded'`,
     `'drop-oldest'`, or `'drop-newest'`. **Default:** `'strict'`.
-  * `signal` {AbortSignal} Abort the stream.
+  * `signal` {AbortSignal} Abort the stream. The signal remains active while
+    buffered data drains after `writer.end()`; aborting during that time fails
+    the writer and rejects the pending `end()` promise.
 * Returns: {Object}
   * `writer` {Writable} The writer side.
   * `readable` {AsyncIterable} whose chunks fulfill with {Uint8Array\[]}
diff --git a/doc/api/test.md b/doc/api/test.md
index 02f9cc30ec57..145346d3823e 100644
--- a/doc/api/test.md
+++ b/doc/api/test.md
@@ -3500,6 +3500,74 @@ Global events are emitted once per test run:
 The root test also emits [`'test:plan'`][] and [`'test:diagnostic'`][] events
 at the end of the run to report run level totals.
 
+### Event lifecycle
+
+The tables above group the events; the diagram below places them on a
+timeline. The declaration ordered events form the main spine, buffered so that
+a reporter sees them in source order, while each execution ordered twin is
+emitted immediately, when the work actually happens. In particular,
+[`'test:start'`][] marks when a test begins _reporting_ its own and its
+subtests' status, not when its body begins executing; that moment is
+[`'test:dequeue'`][].
+
+```text
+                     node:test reporter event lifecycle
+   main spine = DECLARATION order (buffered; matches source order)
+   right side = EXECUTION order (emitted immediately); ◄ marks each twin
+
+  LEAF TEST
+  ─────────
+   ┌──────────────┐                   test:enqueue
+   │ test:start   │ ◄──── twins ────  (queued for execution;
+   └──────────────┘                    type: 'suite' | 'test')
+        │  begins REPORTING           test:dequeue
+        │  (not the start of          (about to run; emitted right
+        │   the test body)             before the test body runs)
+        │
+        │     [ between the twins, on the execution timeline, the test
+        │       body runs: context.log() emits test:log live, and
+        │       test:stdout / test:stderr stream with --test ]
+        │
+        ▼
+   ┌───────────────────────┐
+   │ test:pass │ test:fail │ ◄──── twin ────  test:complete
+   └───────────────────────┘   result         (details.passed says which)
+        │
+        ▼
+   test:diagnostic    the test's own context.diagnostic() messages,
+                      buffered while it runs, flushed after its result
+
+
+  SUITE / PARENT TEST   (each subtest is the whole LEAF flow above)
+  ───────────────────
+   test:start ─► [ full flow of each subtest ... ] ─►
+        test:plan (count = subtests) ─► test:pass │ test:fail ─►
+        test:diagnostic
+
+
+  RUN-LEVEL FINALE   (root, after all top-level tests)
+  ────────────────
+   test:plan         top-level count
+        │
+        ▼
+   test:diagnostic   x N   tests, suites, pass, fail, cancelled,
+        │                  skipped, todo, duration_ms (+ coverage errors)
+        ▼
+   test:coverage     only if coverage is enabled
+        │
+        ▼
+   test:summary  ─►  stream ends
+
+
+  INTERRUPTION   (SIGINT, e.g. Ctrl+C, while tests are still running)
+  ────────────
+   test:interrupted   the innermost tests still running at that moment
+        │             (not emitted if none were running)
+        ▼
+   the run exits immediately — the buffered spine never flushes, so
+   neither the finale above nor those tests' own results are emitted
+```
+
 ### Event: `'test:coverage'`
 
 * `data` {Object}
diff --git a/doc/api/tls.md b/doc/api/tls.md
index 4ff31989bf3a..fc75ff077aaf 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -1094,6 +1094,11 @@ property is set only when `tlsSocket.authorized === false`.
 
 <!-- YAML
 added: v0.11.4
+changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/64677
+    description: On TLS 1.3, a resumed session where the client presented no
+                 certificate is no longer reported as authorized.
 -->
 
 * Type: {boolean}
@@ -1103,15 +1108,10 @@ specified when creating the `tls.TLSSocket` instance, otherwise `false`.
 
 The peer certificate is only verified during a full TLS handshake. When a
 connection is established by resuming a previous session (see
-[Session Resumption][]), verification is not repeated. If the client
-presented a certificate in the original handshake, `authorized` and
+[Session Resumption][]), verification is not repeated: `authorized` and
 `authorizationError` carry the result stored with the session, including
-any verification error. On TLS 1.3, a client that sent no certificate at
-all can resume a session and report `authorized` as `true`, while
-[`tls.TLSSocket.getPeerCertificate()`][] returns an empty object. Servers
-that authorize clients manually with `rejectUnauthorized: false` should
-therefore also check [`tls.TLSSocket.isSessionReused()`][] and that a peer
-certificate is present.
+any verification error and the case where the client presented no
+certificate at all.
 
 ### `tlsSocket.disableRenegotiation()`
 
@@ -2612,7 +2612,6 @@ added: v0.11.3
 [`tls.TLSSocket.getProtocol()`]: #tlssocketgetprotocol
 [`tls.TLSSocket.getSession()`]: #tlssocketgetsession
 [`tls.TLSSocket.getTLSTicket()`]: #tlssocketgettlsticket
-[`tls.TLSSocket.isSessionReused()`]: #tlssocketissessionreused
 [`tls.TLSSocket.servername`]: #tlssocketservername
 [`tls.TLSSocket`]: #class-tlstlssocket
 [`tls.connect()`]: #tlsconnectoptions-callback
diff --git a/doc/api/util.md b/doc/api/util.md
index d6719b88f4fb..6e15405e9337 100644
--- a/doc/api/util.md
+++ b/doc/api/util.md
@@ -383,6 +383,213 @@ The `--throw-deprecation` command-line flag and `process.throwDeprecation`
 property take precedence over `--trace-deprecation` and
 `process.traceDeprecation`.
 
+## `util.debounce(fn, wait[, options])`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `fn` {Function} The function to debounce.
+* `wait` {integer} The number of milliseconds to delay `fn`.
+* `options` {Object}
+  * `leading` {boolean} When `true`, invokes `fn` immediately when a new
+    debounce window begins. **Default:** `false`.
+  * `rejectOnCancel` {boolean} When `true`, a call superseded by a later call
+    rejects with an `AbortError`. **Default:** `false`.
+  * `signal` {AbortSignal} An `AbortSignal` that cancels pending calls and
+    prevents future calls when aborted.
+* Returns: {Function} The debounced function.
+
+Creates a function that delays calling `fn` until `wait` milliseconds have
+elapsed since the most recent invocation. The debounced function returns a
+{Promise} for the value returned by `fn`. If `fn` throws or returns a rejected
+promise, the returned promise is rejected with the same reason.
+
+When the debounced function is called more than once before the delay expires,
+`fn` receives the arguments from the most recent call. By default, the promises
+from all calls resolve or reject with the result of that invocation. If
+`options.rejectOnCancel` is `true`, the promises from superseded calls reject
+with an `AbortError` instead.
+
+When `options.leading` is `true`, the first call in a debounce window invokes
+`fn` immediately. Calls made during that window are delayed until `wait`
+milliseconds have elapsed since the most recent call. A trailing invocation
+only occurs if the debounced function was called again during the window.
+The window begins before `fn` is invoked, so recursive calls and calls made
+while an asynchronous `fn` is pending are part of the same window if they occur
+before the delay expires. This also applies to calls made after a synchronous
+`fn` returns but before the delay expires.
+
+If `options.signal` is aborted, pending and future calls reject with an
+`AbortError`, with the signal's reason set as the error's `cause`, and `fn` is
+not invoked by those calls. If the signal is already aborted, `debounce()`
+throws an `AbortError`.
+
+The returned function has the following properties:
+
+* `cancel([reason])` cancels the current debounce window. Its pending promises
+  reject with an `AbortError`. If provided, `reason` is set as the error's
+  `cause`.
+* `flush()` cancels the delay and invokes `fn` immediately. It has no effect if
+  no invocation is pending.
+* `pending` {Promise|null} is the promise returned by the most recent call in
+  the current debounce window, or `null` if no invocation is pending.
+* `pendingCount` {integer} is the number of calls awaiting the invocation in
+  the current debounce window.
+* `ref()` makes the pending and future timeout keep the Node.js event loop
+  active. Returns the debounced function.
+* `unref()` allows the event loop to exit while a timeout is pending. This also
+  applies to future timeouts. Returns the debounced function.
+
+When invoked, `fn` has the debounced function as its `this` value. After a
+trailing invocation, a new debounce window can begin even if a promise returned
+by `fn` is still pending. The debounced function preserves the `name` and
+`length` of `fn`.
+
+```mjs
+import { setTimeout as wait } from 'node:timers/promises';
+import { debounce } from 'node:util';
+
+const fn = debounce(async (value) => {
+  await wait(100);
+  return value;
+}, 50);
+
+const first = fn(1);
+const second = fn(2);
+
+console.log(await first);  // 2
+console.log(await second); // 2
+```
+
+A debounced function can be used to trigger an action after a period of
+inactivity. Each call resets the timeout:
+
+```cjs
+const { debounce } = require('node:util');
+
+const onInactivity = debounce(() => {
+  console.log('No activity for 5 seconds');
+}, 5_000).unref();
+
+process.stdin.on('data', (data) => {
+  console.log(`Received ${data.length} bytes`);
+  onInactivity();
+});
+
+// Start the initial inactivity timeout.
+onInactivity();
+```
+
+## `util.throttle(fn, limit, interval[, options])`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `fn` {Function} The function to throttle.
+* `limit` {integer} The maximum number of times to invoke `fn` during an
+  interval. Must be greater than `0`.
+* `interval` {integer} The length of each interval in milliseconds.
+* `options` {Object}
+  * `concurrency` {number} The maximum number of invocations of `fn` whose
+    return values may be unsettled at once. Must be a positive integer or
+    `Infinity`. **Default:** `Infinity`.
+  * `maxPending` {number} The maximum number of calls that may be queued when
+    `overflow` is `'queue'`. Must be a non-negative integer or `Infinity`.
+    **Default:** `Infinity`.
+  * `overflow` {string} Determines how calls exceeding the limit are handled.
+    **Default:** `'queue'`.
+    * `'queue'`: Queue calls in the order received.
+    * `'drop'`: Reject calls immediately without queueing them.
+  * `signal` {AbortSignal} An `AbortSignal` that cancels pending calls and
+    prevents future calls when aborted.
+  * `strict` {boolean} When `true`, ensures that `limit` is not exceeded during
+    any rolling interval. **Default:** `false`.
+* Returns: {Function} The throttled function.
+
+Creates a function that limits how often `fn` is invoked. By default, calls that
+exceed the limit are queued in the order received rather than discarded. The
+throttled function returns a {Promise} for the value returned by `fn`. If `fn`
+throws or returns a rejected promise, the returned promise is rejected with the
+same reason.
+
+An invocation starts only when both rate and concurrency capacity are
+available. Rate capacity is consumed when `fn` starts, not when a call enters
+the queue. Concurrency capacity is released when the value returned by `fn`
+settles. Non-promise values settle during the next microtask.
+
+When `options.overflow` is `'drop'`, calls made without available rate or
+concurrency capacity are rejected immediately. When `options.overflow` is
+`'queue'` and `options.maxPending` calls are already queued, additional calls
+are also rejected immediately. `maxPending` has no effect when `overflow` is
+`'drop'`.
+
+In both cases, rejected calls return a promise rejected with an
+`ERR_THROTTLED` error. The rejected promise is marked as handled, so ignoring it
+does not emit an `'unhandledRejection'` event. Awaiting or explicitly handling
+the promise still observes the rejection. Rejected calls do not consume rate
+or concurrency capacity, enter the queue, or schedule a timeout.
+
+By default, the interval begins when the first call in a new window invokes
+`fn`. Up to `limit` calls can invoke `fn` during that window. Queued calls are
+processed in groups of up to `limit` as each subsequent window begins. This
+windowed behavior can result in calls occurring close together at a window
+boundary.
+
+When `options.strict` is `true`, invocation times are tracked individually.
+This ensures that no more than `limit` calls begin during any rolling interval,
+at the cost of additional bookkeeping.
+
+If `options.signal` is aborted, pending and future calls reject with an
+`AbortError`, with the signal's reason set as the error's `cause`, and `fn` is
+not invoked by those calls. If the signal is already aborted, `throttle()`
+throws an `AbortError`.
+
+The returned function has the following properties:
+
+* `cancel([reason])` cancels all queued calls and resets the current throttle
+  window. The queued promises reject with an `AbortError`. If provided,
+  `reason` is set as the error's `cause`. Does not cancel invocations that have
+  already started.
+* `hasImmediateCapacity()` returns `true` if a call made at that moment could
+  invoke `fn` without being queued or rejected. The check does not reserve
+  capacity, and the throttled function always checks again when called. It
+  returns `false` while calls are queued to preserve their order. Callers can
+  avoid creating a timeout by only calling the throttled function when this
+  method returns `true`.
+* `pending` {Promise|null} is the promise returned by the most recently queued
+  call, or `null` if no invocation is queued.
+* `pendingCount` {integer} is the number of calls awaiting invocation.
+* `activeCount` {integer} is the number of invocations whose return values have
+  not settled.
+* `ref()` makes the pending and future timeout keep the Node.js event loop
+  active. Returns the throttled function.
+* `unref()` allows the event loop to exit while a timeout is pending. This also
+  applies to future timeouts. Returns the throttled function.
+
+Calls that have already invoked `fn` are not affected by `cancel()` or by an
+aborted signal. When invoked, `fn` has the throttled function as its `this`
+value. The throttled function preserves the `name` and `length` of `fn`.
+
+```mjs
+import { throttle } from 'node:util';
+
+const request = throttle(async (id) => {
+  const response = await fetch(`https://example.com/items/${id}`);
+  return response.json();
+}, 2, 1_000);
+
+// At most two requests begin during each one-second interval. All other calls
+// remain queued and retain their original arguments.
+const results = await Promise.all([
+  request(1),
+  request(2),
+  request(3),
+  request(4),
+]);
+```
+
 ## `util.diff(actual, expected)`
 
 <!-- YAML
@@ -1665,6 +1872,17 @@ console.log(util.isDeepStrictEqual(foo, bar, true));
 See [`assert.deepStrictEqual()`][] for more information about deep strict
 equality.
 
+## `util.markPromiseAsHandled(promise)`
+
+<!-- YAML
+added: v24.22.0
+-->
+
+* `promise` {Promise} The promise to mark as handled
+
+Marks a promise as handled so that unhandled rejections are ignored and are not
+reported to the `'unhandledrejection'` event.
+
 ## Class: `util.MIMEType`
 
 <!-- YAML
diff --git a/doc/api/webcrypto.md b/doc/api/webcrypto.md
index 2e54d76f0eae..458e5fedaabc 100644
--- a/doc/api/webcrypto.md
+++ b/doc/api/webcrypto.md
@@ -2,6 +2,9 @@
 
 <!-- YAML
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version: v24.18.0
     pr-url: https://github.com/nodejs/node/pull/62183
     description: TurboSHAKE and KangarooTwelve algorithms
@@ -133,6 +136,9 @@ Algorithms:
 * `'ML-KEM-512'`[^openssl35]
 * `'ML-KEM-768'`[^openssl35]
 * `'ML-KEM-1024'`[^openssl35]
+* `'MLKEM768-P256'`[^openssl35]
+* `'MLKEM768-X25519'`[^openssl35]
+* `'MLKEM1024-P384'`[^openssl35]
 * `'SHA3-256'`
 * `'SHA3-384'`
 * `'SHA3-512'`
@@ -528,9 +534,10 @@ Crypto API implementation and the APIs supported for each:
   `'ECDSA'`, `'Ed25519'`, `'Ed448'`[^secure-curves],
   `'ML-DSA-44'`[^modern-algos], `'ML-DSA-65'`[^modern-algos],
   `'ML-DSA-87'`[^modern-algos], `'ML-KEM-512'`[^modern-algos],
-  `'ML-KEM-768'`[^modern-algos], `'ML-KEM-1024'`[^modern-algos], `'RSA-OAEP'`,
-  `'RSA-PSS'`, `'RSASSA-PKCS1-v1_5'`, `'X25519'`, and
-  `'X448'`[^secure-curves].
+  `'ML-KEM-768'`[^modern-algos], `'ML-KEM-1024'`[^modern-algos],
+  `'MLKEM768-P256'`[^modern-algos], `'MLKEM768-X25519'`[^modern-algos],
+  `'MLKEM1024-P384'`[^modern-algos], `'RSA-OAEP'`, `'RSA-PSS'`,
+  `'RSASSA-PKCS1-v1_5'`, `'X25519'`, and `'X448'`[^secure-curves].
 
 ### Crypto Operation APIs
 
@@ -550,8 +557,10 @@ Crypto API implementation and the APIs supported for each:
   `'ChaCha20-Poly1305'`[^modern-algos], and `'RSA-OAEP'`.
 * [`subtle.encapsulateBits()`][], [`subtle.decapsulateBits()`][],
   [`subtle.encapsulateKey()`][], and [`subtle.decapsulateKey()`][] support
-  `'ML-KEM-512'`[^modern-algos], `'ML-KEM-768'`[^modern-algos], and
-  `'ML-KEM-1024'`[^modern-algos].
+  `'ML-KEM-512'`[^modern-algos], `'ML-KEM-768'`[^modern-algos],
+  `'ML-KEM-1024'`[^modern-algos], `'MLKEM768-P256'`[^modern-algos],
+  `'MLKEM768-X25519'`[^modern-algos], and
+  `'MLKEM1024-P384'`[^modern-algos].
 * [`subtle.digest()`][] supports `'cSHAKE128'`[^modern-algos],
   `'cSHAKE256'`[^modern-algos], `'KT128'`[^modern-algos],
   `'KT256'`[^modern-algos], `'SHA-1'`, `'SHA-256'`, `'SHA-384'`, `'SHA-512'`,
@@ -583,6 +592,10 @@ and [`subtle.exportKey()`][].
   `'ML-KEM-768'`[^modern-algos], and `'ML-KEM-1024'`[^modern-algos]** can be
   imported and exported using `'spki'`, `'pkcs8'`, `'jwk'`,
   `'raw-public'`[^modern-algos], and `'raw-seed'`[^modern-algos].
+* **`'MLKEM768-P256'`[^modern-algos],
+  `'MLKEM768-X25519'`[^modern-algos], and
+  `'MLKEM1024-P384'`[^modern-algos]** can be imported and exported using
+  `'jwk'`, `'raw-public'`[^modern-algos], and `'raw-seed'`[^modern-algos].
 * **`'RSA-OAEP'`, `'RSA-PSS'`, and `'RSASSA-PKCS1-v1_5'`** can be imported
   and exported using `'spki'`, `'pkcs8'`, and `'jwk'`.
 
@@ -787,6 +800,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.decapsulateKey(decapsulationAlgorithm, decapsulationKey, ciphertext, sharedKeyAlgorithm, extractable, keyUsages)`
 
@@ -813,6 +829,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.decrypt(algorithm, key, data)`
 
@@ -1009,6 +1028,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.encapsulateKey(encapsulationAlgorithm, encapsulationKey, sharedKeyAlgorithm, extractable, keyUsages)`
 
@@ -1033,6 +1055,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.encrypt(algorithm, key, data)`
 
@@ -1071,6 +1096,9 @@ The algorithms currently supported include:
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version: v24.18.0
     pr-url: https://github.com/nodejs/node/pull/62706
     description: Added JWK format support for ML-KEM key types.
@@ -1135,6 +1163,9 @@ Derives the public key from a given private key.
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version: v24.8.0
     pr-url: https://github.com/nodejs/node/pull/59647
     description: KMAC algorithms are now supported.
@@ -1176,6 +1207,9 @@ include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 * `'RSA-OAEP'`
 * `'RSA-PSS'`
 * `'RSASSA-PKCS1-v1_5'`
@@ -1199,6 +1233,9 @@ The {CryptoKey} (secret key) generating algorithms supported include:
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: v24.22.0
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version: v24.18.0
     pr-url: https://github.com/nodejs/node/pull/62706
     description: Added JWK format support for ML-KEM key types.
@@ -1368,6 +1405,9 @@ The unwrapped key algorithms supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 * `'RSA-OAEP'`
 * `'RSA-PSS'`
 * `'RSASSA-PKCS1-v1_5'`
diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md
index 49ec391e4008..b276975239c4 100644
--- a/doc/api/worker_threads.md
+++ b/doc/api/worker_threads.md
@@ -1236,7 +1236,7 @@ port2.postMessage(circularData);
 ```
 
 `transferList` may be a list of {ArrayBuffer}, [`MessagePort`][],
-[`FileHandle`][], {net.Server}, and {net.Socket} objects.
+[`FileHandle`][], {net.Server}, {net.Socket}, and {net.BoundSocket} objects.
 After transferring, they are not usable on the sending side of the channel
 anymore (even if they are not contained in `value`).
 
@@ -1247,6 +1247,8 @@ freshly accepted or created TCP connection that has not yet started reading and
 has no buffered data, otherwise `postMessage()` throws
 `ERR_WORKER_HANDLE_NOT_TRANSFERABLE`. This makes it possible to accept
 connections on one thread and distribute them across a pool of worker threads.
+Transferring a {net.BoundSocket} moves an un-adopted pre-bound socket, so a
+port can be reserved synchronously on one thread and adopted on another.
 Only TCP handles are supported.
 
 If `value` contains {SharedArrayBuffer} instances, those are accessible
diff --git a/doc/api/zlib.md b/doc/api/zlib.md
index 08b3dcbb1d98..db37b7b4a85b 100644
--- a/doc/api/zlib.md
+++ b/doc/api/zlib.md
@@ -1056,7 +1056,8 @@ added: v0.5.8
 -->
 
 * `kind` **Default:** `zlib.constants.Z_FULL_FLUSH` for zlib-based streams,
-  `zlib.constants.BROTLI_OPERATION_FLUSH` for Brotli-based streams.
+  `zlib.constants.BROTLI_OPERATION_FLUSH` for Brotli-based streams, and
+  `zlib.constants.ZSTD_e_flush` for Zstd-based streams.
 * `callback` {Function}
 
 Flush pending data. Don't call this frivolously, premature flushes negatively
@@ -1088,8 +1089,14 @@ Only applicable to deflate algorithm.
 added: v0.7.0
 -->
 
-Reset the compressor/decompressor to factory defaults. Only applicable to
-the inflate and deflate algorithms.
+For inflate and deflate streams, reset the compressor/decompressor to factory
+defaults.
+
+For Zstd streams, cancel the current frame and start a new session while
+preserving the configured parameters and dictionary. If `pledgedSrcSize` was
+configured for a Zstd compressor, it applies again to the next frame.
+
+Calling `reset()` while a write is in progress throws an `Error`.
 
 ## Class: `ZstdOptions`
 
@@ -1117,6 +1124,9 @@ Each Zstd-based class takes an `options` object. All options are optional.
 * `finishFlush` {integer} **Default:** `zlib.constants.ZSTD_e_end`
 * `chunkSize` {integer} **Default:** `16 * 1024`
 * `params` {Object} Key-value object containing indexed [Zstd parameters][].
+* `pledgedSrcSize` {number} Expected total size of the uncompressed input. It
+  must be a non-negative safe integer and must match the input size when
+  compression finishes. Only applicable to Zstd compressors.
 * `maxOutputLength` {integer} Limits output size when using
   [convenience methods][]. **Default:** [`buffer.kMaxLength`][]
 * `info` {boolean} If `true`, returns an object with `buffer` and `engine`. **Default:** `false`
@@ -1124,7 +1134,7 @@ Each Zstd-based class takes an `options` object. All options are optional.
   to improve compression efficiency when compressing or decompressing data that
   shares common patterns with the dictionary.
 * `rejectGarbageAfterEnd` {boolean} If `true`, decompression fails when
-  input remains after the first complete compressed stream. **Default:** `false`
+  input remains after a complete sequence of Zstd frames. **Default:** `false`
 
 For example:
 
@@ -1160,7 +1170,8 @@ added:
   - v22.15.0
 -->
 
-Decompress data using the Zstd algorithm.
+Decompress data using the Zstd algorithm. Concatenated Zstd and skippable frames
+are decoded as a single stream.
 
 ## `zlib.constants`
 
@@ -1740,6 +1751,8 @@ Compress a chunk of data with [`ZstdCompress`][].
 
 ### `zlib.zstdDecompress(buffer[, options], callback)`
 
+> Stability: 1 - Experimental
+
 <!-- YAML
 added:
   - v23.8.0
diff --git a/doc/changelogs/CHANGELOG_V24.md b/doc/changelogs/CHANGELOG_V24.md
index 290c9c1f833c..d6df5c85cdf2 100644
--- a/doc/changelogs/CHANGELOG_V24.md
+++ b/doc/changelogs/CHANGELOG_V24.md
@@ -9,6 +9,7 @@
 </tr>
 <tr>
 <td>
+<a href="#24.22.0">24.22.0</a><br/>
 <a href="#24.21.0">24.21.0</a><br/>
 <a href="#24.20.0">24.20.0</a><br/>
 <a href="#24.19.0">24.19.0</a><br/>
@@ -70,6 +71,373 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="24.22.0"></a>
+
+## 2026-10-14, Version 24.22.0 'Krypton' (LTS), @aduh95
+
+### Notable Changes
+
+* \[[`ddbf974b47`](https://github.com/nodejs/node/commit/ddbf974b47)] - **(SEMVER-MINOR)** **crypto**: add crypto.parsePKCS12() (Brian Muenzenmeyer) [#65627](https://github.com/nodejs/node/pull/65627)
+* \[[`c162c68ff0`](https://github.com/nodejs/node/commit/c162c68ff0)] - **(SEMVER-MINOR)** **crypto**: add a generic MAC API (Filip Skokan) [#65553](https://github.com/nodejs/node/pull/65553)
+* \[[`a4ab3d84d7`](https://github.com/nodejs/node/commit/a4ab3d84d7)] - **(SEMVER-MINOR)** **crypto**: discover ciphers from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`c2f1e829ea`](https://github.com/nodejs/node/commit/c2f1e829ea)] - **(SEMVER-MINOR)** **crypto**: discover hashes from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`51aad5a80d`](https://github.com/nodejs/node/commit/51aad5a80d)] - **(SEMVER-MINOR)** **crypto**: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) [#63411](https://github.com/nodejs/node/pull/63411)
+* \[[`d11c65d2f2`](https://github.com/nodejs/node/commit/d11c65d2f2)] - **doc**: add araujogui to collaborators (Guilherme Araújo) [#66090](https://github.com/nodejs/node/pull/66090)
+* \[[`acc1578179`](https://github.com/nodejs/node/commit/acc1578179)] - **doc**: deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) [#65593](https://github.com/nodejs/node/pull/65593)
+* \[[`a7f8de6362`](https://github.com/nodejs/node/commit/a7f8de6362)] - **(SEMVER-MINOR)** **net**: support sending net.BoundSocket to threads and child processes (Guy Bedford) [#64725](https://github.com/nodejs/node/pull/64725)
+* \[[`60c3eb61bd`](https://github.com/nodejs/node/commit/60c3eb61bd)] - **(SEMVER-MINOR)** **perf\_hooks**: implement SlidingWindowHistogram (James M Snell) [#65825](https://github.com/nodejs/node/pull/65825)
+* \[[`6b3e6f9d5c`](https://github.com/nodejs/node/commit/6b3e6f9d5c)] - **(SEMVER-MINOR)** **perf\_hooks**: implement qrde analysis support in Histogram (James M Snell) [#65806](https://github.com/nodejs/node/pull/65806)
+* \[[`75456a3512`](https://github.com/nodejs/node/commit/75456a3512)] - **(SEMVER-MINOR)** **perf\_hooks**: implement Histogram meanCI API (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`72d1b40c56`](https://github.com/nodejs/node/commit/72d1b40c56)] - **(SEMVER-MINOR)** **perf\_hooks**: add CBOR export/import for histogram exchange (James M Snell) [#65434](https://github.com/nodejs/node/pull/65434)
+* \[[`41161dda87`](https://github.com/nodejs/node/commit/41161dda87)] - **(SEMVER-MINOR)** **sqlite**: add StatementSync.prototype.close() (Guilherme Araújo) [#64232](https://github.com/nodejs/node/pull/64232)
+* \[[`adbc757d70`](https://github.com/nodejs/node/commit/adbc757d70)] - **(SEMVER-MINOR)** **sqlite**: add StatementSync.prototype\[Symbol.dispose]\() (Guilherme Araújo) [#64232](https://github.com/nodejs/node/pull/64232)
+* \[[`241339f072`](https://github.com/nodejs/node/commit/241339f072)] - **(SEMVER-MINOR)** **src,lib**: add util.markPromiseAsHandled (James M Snell) [#65805](https://github.com/nodejs/node/pull/65805)
+* \[[`b4a6719f37`](https://github.com/nodejs/node/commit/b4a6719f37)] - **(SEMVER-MINOR)** **test**: expand histogram test coverage (James M Snell) [#65825](https://github.com/nodejs/node/pull/65825)
+* \[[`63b0974d9e`](https://github.com/nodejs/node/commit/63b0974d9e)] - **(SEMVER-MINOR)** **util**: implement util.throttle (James M Snell) [#65899](https://github.com/nodejs/node/pull/65899)
+* \[[`a3bbb5a26f`](https://github.com/nodejs/node/commit/a3bbb5a26f)] - **(SEMVER-MINOR)** **util**: implement debounce (James M Snell) [#65899](https://github.com/nodejs/node/pull/65899)
+
+### Commits
+
+* \[[`e6832b2cb1`](https://github.com/nodejs/node/commit/e6832b2cb1)] - **assert**: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) [#64449](https://github.com/nodejs/node/pull/64449)
+* \[[`a079177d9f`](https://github.com/nodejs/node/commit/a079177d9f)] - **benchmark**: add --csv option to compare.js with --analyze (James M Snell) [#65922](https://github.com/nodejs/node/pull/65922)
+* \[[`10b1a0f70f`](https://github.com/nodejs/node/commit/10b1a0f70f)] - **benchmark**: fix max-regressions detection in compare.js (James M Snell) [#65587](https://github.com/nodejs/node/pull/65587)
+* \[[`e0c7ba8ad5`](https://github.com/nodejs/node/commit/e0c7ba8ad5)] - **benchmark**: add --analyze option to benchmark/scatter.js (James M Snell) [#65594](https://github.com/nodejs/node/pull/65594)
+* \[[`21fed10bb0`](https://github.com/nodejs/node/commit/21fed10bb0)] - **benchmark**: add crypto class benchmarks (Filip Skokan) [#65518](https://github.com/nodejs/node/pull/65518)
+* \[[`fa912242b7`](https://github.com/nodejs/node/commit/fa912242b7)] - **buffer**: fix unaligned UTF-16LE decoding (Matteo Collina) [#65905](https://github.com/nodejs/node/pull/65905)
+* \[[`a6bd0c1413`](https://github.com/nodejs/node/commit/a6bd0c1413)] - **build**: suppress OpenSSL asm warnings with clang (Richard Lau) [#66023](https://github.com/nodejs/node/pull/66023)
+* \[[`94e12139ee`](https://github.com/nodejs/node/commit/94e12139ee)] - **build**: derive V8\_LOGGING\_LEVEL from dcheck\_always\_on (Joyee Cheung) [#65744](https://github.com/nodejs/node/pull/65744)
+* \[[`7a2f322943`](https://github.com/nodejs/node/commit/7a2f322943)] - **build**: fix quiet default for make builds (Shelley Vohr) [#65826](https://github.com/nodejs/node/pull/65826)
+* \[[`c280d650b0`](https://github.com/nodejs/node/commit/c280d650b0)] - **build**: allow linking shared dependencies in the GN build (Shelley Vohr) [#65797](https://github.com/nodejs/node/pull/65797)
+* \[[`4b23a4472c`](https://github.com/nodejs/node/commit/4b23a4472c)] - **build**: enable the V8 sandbox in shared-cage builds (Shelley Vohr) [#62237](https://github.com/nodejs/node/pull/62237)
+* \[[`676e15c003`](https://github.com/nodejs/node/commit/676e15c003)] - **build**: define V8\_CONTIGUOUS\_COMPRESSED\_RO\_SPACE for shared cage (Shelley Vohr) [#65464](https://github.com/nodejs/node/pull/65464)
+* \[[`f784058482`](https://github.com/nodejs/node/commit/f784058482)] - **build**: remove obsolete configure flags (Chengzhong Wu) [#65456](https://github.com/nodejs/node/pull/65456)
+* \[[`f63f37d243`](https://github.com/nodejs/node/commit/f63f37d243)] - **build**: activate correct default flags for riscv64 (Stewart X Addison) [#65708](https://github.com/nodejs/node/pull/65708)
+* \[[`da46ac075d`](https://github.com/nodejs/node/commit/da46ac075d)] - **build**: derive NODE\_ARCH from target\_cpu in the GN build (Shelley Vohr) [#65491](https://github.com/nodejs/node/pull/65491)
+* \[[`249e9a16dd`](https://github.com/nodejs/node/commit/249e9a16dd)] - **build,src**: gate jspi flag on V8\_ENABLE\_WEBASSEMBLY (Piotr Kubaj) [#66082](https://github.com/nodejs/node/pull/66082)
+* \[[`146f00f64b`](https://github.com/nodejs/node/commit/146f00f64b)] - **child\_process**: clear timeout timer on spawn-time error too (kishore280) [#65506](https://github.com/nodejs/node/pull/65506)
+* \[[`13987f4418`](https://github.com/nodejs/node/commit/13987f4418)] - **crypto**: remove redundent `std::move` call (Antoine du Hamel) [#66111](https://github.com/nodejs/node/pull/66111)
+* \[[`ef957ac85f`](https://github.com/nodejs/node/commit/ef957ac85f)] - **crypto**: skip private RSA parameters in key details (Filip Skokan) [#66108](https://github.com/nodejs/node/pull/66108)
+* \[[`8feccc5e22`](https://github.com/nodejs/node/commit/8feccc5e22)] - **crypto**: use provider EC group names (Filip Skokan) [#66108](https://github.com/nodejs/node/pull/66108)
+* \[[`764e0d1120`](https://github.com/nodejs/node/commit/764e0d1120)] - **crypto**: fetch ciphers for private-key encoding (Filip Skokan) [#66108](https://github.com/nodejs/node/pull/66108)
+* \[[`50ffed1979`](https://github.com/nodejs/node/commit/50ffed1979)] - **crypto**: decode PKCS#1 keys through providers (Filip Skokan) [#66108](https://github.com/nodejs/node/pull/66108)
+* \[[`56c16b2fd6`](https://github.com/nodejs/node/commit/56c16b2fd6)] - **crypto**: derive keys through EVP\_KDF (Filip Skokan) [#66108](https://github.com/nodejs/node/pull/66108)
+* \[[`a4effe6809`](https://github.com/nodejs/node/commit/a4effe6809)] - **crypto**: use names for asymmetric key algorithms (Filip Skokan) [#65966](https://github.com/nodejs/node/pull/65966)
+* \[[`ddbf974b47`](https://github.com/nodejs/node/commit/ddbf974b47)] - **(SEMVER-MINOR)** **crypto**: add crypto.parsePKCS12() (Brian Muenzenmeyer) [#65627](https://github.com/nodejs/node/pull/65627)
+* \[[`8e631aa48f`](https://github.com/nodejs/node/commit/8e631aa48f)] - **crypto**: add Hybrid KEMs to Web Cryptography (Filip Skokan) [#65759](https://github.com/nodejs/node/pull/65759)
+* \[[`5c51129e16`](https://github.com/nodejs/node/commit/5c51129e16)] - **crypto**: optimize private EC JWK import (Filip Skokan) [#65908](https://github.com/nodejs/node/pull/65908)
+* \[[`c2ec40c2d7`](https://github.com/nodejs/node/commit/c2ec40c2d7)] - **crypto**: disable non-FIPS WebCrypto paths in FIPS mode (Filip Skokan) [#65172](https://github.com/nodejs/node/pull/65172)
+* \[[`e198aa0f79`](https://github.com/nodejs/node/commit/e198aa0f79)] - **crypto**: read RSA-PSS restrictions from provider (Filip Skokan) [#66108](https://github.com/nodejs/node/pull/66108)
+* \[[`253784f0e9`](https://github.com/nodejs/node/commit/253784f0e9)] - **crypto**: optimize and benchmark key preparation (Filip Skokan) [#65892](https://github.com/nodejs/node/pull/65892)
+* \[[`80a6ad509b`](https://github.com/nodejs/node/commit/80a6ad509b)] - **crypto**: avoid EC reconstruction for signature sizing (Filip Skokan) [#65908](https://github.com/nodejs/node/pull/65908)
+* \[[`5b592b772c`](https://github.com/nodejs/node/commit/5b592b772c)] - **crypto**: avoid EC raw export reconstruction (Filip Skokan) [#65908](https://github.com/nodejs/node/pull/65908)
+* \[[`ee956ae3bf`](https://github.com/nodejs/node/commit/ee956ae3bf)] - **crypto**: export EC JWK coordinates directly (Filip Skokan) [#65908](https://github.com/nodejs/node/pull/65908)
+* \[[`684008be58`](https://github.com/nodejs/node/commit/684008be58)] - **crypto**: read EC curve metadata directly (Filip Skokan) [#65908](https://github.com/nodejs/node/pull/65908)
+* \[[`f4665f1c41`](https://github.com/nodejs/node/commit/f4665f1c41)] - **crypto**: validate the limit of PBKDF2 iterations (Filip Skokan) [#65704](https://github.com/nodejs/node/pull/65704)
+* \[[`624abbecd7`](https://github.com/nodejs/node/commit/624abbecd7)] - **crypto**: use primordials in HKDF info validation (Filip Skokan) [#65704](https://github.com/nodejs/node/pull/65704)
+* \[[`e4d916f175`](https://github.com/nodejs/node/commit/e4d916f175)] - **crypto**: add mgf1Hash for RSA-OAEP (Adam Mcgrath) [#65073](https://github.com/nodejs/node/pull/65073)
+* \[[`db8a9162a8`](https://github.com/nodejs/node/commit/db8a9162a8)] - **crypto**: fix multi-prime RSA JWKs (Filip Skokan) [#65649](https://github.com/nodejs/node/pull/65649)
+* \[[`022ac83504`](https://github.com/nodejs/node/commit/022ac83504)] - **crypto**: cache valid ECDH key pairs (Filip Skokan) [#65615](https://github.com/nodejs/node/pull/65615)
+* \[[`c61953ebcc`](https://github.com/nodejs/node/commit/c61953ebcc)] - **crypto**: add strict mode to --force-fips (Filip Skokan) [#65645](https://github.com/nodejs/node/pull/65645)
+* \[[`db6ea132a5`](https://github.com/nodejs/node/commit/db6ea132a5)] - **crypto**: add FIPS indicator diagnostics channel (Filip Skokan) [#65645](https://github.com/nodejs/node/pull/65645)
+* \[[`c162c68ff0`](https://github.com/nodejs/node/commit/c162c68ff0)] - **(SEMVER-MINOR)** **crypto**: add a generic MAC API (Filip Skokan) [#65553](https://github.com/nodejs/node/pull/65553)
+* \[[`2b62aafd20`](https://github.com/nodejs/node/commit/2b62aafd20)] - **crypto**: validate JWK usages before key\_ops (Filip Skokan) [#65550](https://github.com/nodejs/node/pull/65550)
+* \[[`ec7819db69`](https://github.com/nodejs/node/commit/ec7819db69)] - **crypto**: fix RSA-PSS oversized salt handling (Filip Skokan) [#65550](https://github.com/nodejs/node/pull/65550)
+* \[[`a4ab3d84d7`](https://github.com/nodejs/node/commit/a4ab3d84d7)] - **(SEMVER-MINOR)** **crypto**: discover ciphers from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`c2f1e829ea`](https://github.com/nodejs/node/commit/c2f1e829ea)] - **(SEMVER-MINOR)** **crypto**: discover hashes from OpenSSL providers (Filip Skokan) [#65484](https://github.com/nodejs/node/pull/65484)
+* \[[`51aad5a80d`](https://github.com/nodejs/node/commit/51aad5a80d)] - **(SEMVER-MINOR)** **crypto**: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) [#63411](https://github.com/nodejs/node/pull/63411)
+* \[[`5a46a9acbb`](https://github.com/nodejs/node/commit/5a46a9acbb)] - **crypto**: improve SubtleCrypto.supports() accuracy (Filip Skokan) [#65222](https://github.com/nodejs/node/pull/65222)
+* \[[`191ebfb26c`](https://github.com/nodejs/node/commit/191ebfb26c)] - **crypto**: fix public PKCS8 export error (한국) [#65609](https://github.com/nodejs/node/pull/65609)
+* \[[`b6d7ed372b`](https://github.com/nodejs/node/commit/b6d7ed372b)] - **crypto**: fix private SPKI export error (Filip Skokan) [#65550](https://github.com/nodejs/node/pull/65550)
+* \[[`79509c25a4`](https://github.com/nodejs/node/commit/79509c25a4)] - **crypto**: correct CCM decryption FIPS error message (kyungrae) [#65450](https://github.com/nodejs/node/pull/65450)
+* \[[`9adc87bc16`](https://github.com/nodejs/node/commit/9adc87bc16)] - **crypto**: harden X509Certificate state (Filip Skokan) [#65518](https://github.com/nodejs/node/pull/65518)
+* \[[`c63aa331b4`](https://github.com/nodejs/node/commit/c63aa331b4)] - **crypto**: optimize key slot caching (Filip Skokan) [#65518](https://github.com/nodejs/node/pull/65518)
+* \[[`87daea43a7`](https://github.com/nodejs/node/commit/87daea43a7)] - **crypto**: add null checks for OPENSSL\_INIT\_new() (Nora Dossche) [#63457](https://github.com/nodejs/node/pull/63457)
+* \[[`98ca5e9358`](https://github.com/nodejs/node/commit/98ca5e9358)] - **crypto**: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) [#65112](https://github.com/nodejs/node/pull/65112)
+* \[[`0c090a28cd`](https://github.com/nodejs/node/commit/0c090a28cd)] - **crypto**: avoid throwing CryptoKey brand checks (Filip Skokan) [#65503](https://github.com/nodejs/node/pull/65503)
+* \[[`a13cc3f723`](https://github.com/nodejs/node/commit/a13cc3f723)] - **crypto**: avoid throwing KeyObject brand checks (Filip Skokan) [#65503](https://github.com/nodejs/node/pull/65503)
+* \[[`b8db0045ef`](https://github.com/nodejs/node/commit/b8db0045ef)] - **deps**: V8: cherry-pick ea9c016f26ad (Gundepalli Sravani) [#66570](https://github.com/nodejs/node/pull/66570)
+* \[[`ba09b53487`](https://github.com/nodejs/node/commit/ba09b53487)] - **deps**: V8: backport c3553509f460 (Jakob Linke) [#66089](https://github.com/nodejs/node/pull/66089)
+* \[[`9ce8ef405b`](https://github.com/nodejs/node/commit/9ce8ef405b)] - **deps**: V8: backport 8901c793e439 (Toon Verwaest) [#66089](https://github.com/nodejs/node/pull/66089)
+* \[[`fb0d0ca289`](https://github.com/nodejs/node/commit/fb0d0ca289)] - **deps**: V8: backport 0b94a9fd23ba (Ruan Gustavo) [#65753](https://github.com/nodejs/node/pull/65753)
+* \[[`2faca508c0`](https://github.com/nodejs/node/commit/2faca508c0)] - **deps**: update googletest to 8eff9e336692fc95961e096564f1044c600b881d (Node.js GitHub Bot) [#66009](https://github.com/nodejs/node/pull/66009)
+* \[[`4396c9bffe`](https://github.com/nodejs/node/commit/4396c9bffe)] - **deps**: update googletest to 283c17563fe7a1111cd7f581aa5d541e8baeff2f (Node.js GitHub Bot) [#65833](https://github.com/nodejs/node/pull/65833)
+* \[[`8a5b12570c`](https://github.com/nodejs/node/commit/8a5b12570c)] - **deps**: update simdjson to 4.6.11 (Node.js GitHub Bot) [#65834](https://github.com/nodejs/node/pull/65834)
+* \[[`c47feb09e8`](https://github.com/nodejs/node/commit/c47feb09e8)] - **deps**: update zlib to 1.3.2.1-motley-285e94b (Node.js GitHub Bot) [#65835](https://github.com/nodejs/node/pull/65835)
+* \[[`9f0d905286`](https://github.com/nodejs/node/commit/9f0d905286)] - **deps**: upgrade npm to 11.19.1 (npm team) [#65573](https://github.com/nodejs/node/pull/65573)
+* \[[`373cd332d8`](https://github.com/nodejs/node/commit/373cd332d8)] - **deps**: update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) [#65654](https://github.com/nodejs/node/pull/65654)
+* \[[`aeed6132a7`](https://github.com/nodejs/node/commit/aeed6132a7)] - **deps**: update simdjson to 4.6.9 (Node.js GitHub Bot) [#65655](https://github.com/nodejs/node/pull/65655)
+* \[[`2583571342`](https://github.com/nodejs/node/commit/2583571342)] - **deps**: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) [#65494](https://github.com/nodejs/node/pull/65494)
+* \[[`d11c65d2f2`](https://github.com/nodejs/node/commit/d11c65d2f2)] - **doc**: add araujogui to collaborators (Guilherme Araújo) [#66090](https://github.com/nodejs/node/pull/66090)
+* \[[`0a4a8d602a`](https://github.com/nodejs/node/commit/0a4a8d602a)] - **doc**: fix duplicate 'the' typo in `node_platform.cc` (Muhammad Al-Muzahid) [#66058](https://github.com/nodejs/node/pull/66058)
+* \[[`b6538138ef`](https://github.com/nodejs/node/commit/b6538138ef)] - **doc**: clarify sub-1000ms behavior in socket.setKeepAlive (Haram Jeong) [#65869](https://github.com/nodejs/node/pull/65869)
+* \[[`d319fa7de4`](https://github.com/nodejs/node/commit/d319fa7de4)] - **doc**: remove obsolete mentioning of cl.exe on windows (Chengzhong Wu) [#66038](https://github.com/nodejs/node/pull/66038)
+* \[[`67cb305b59`](https://github.com/nodejs/node/commit/67cb305b59)] - **doc**: note that default signal handling resets the signal mask (Shelley Vohr) [#65877](https://github.com/nodejs/node/pull/65877)
+* \[[`160d44e025`](https://github.com/nodejs/node/commit/160d44e025)] - **doc**: clarify QUIC async write backpressure (John Finnerty) [#65947](https://github.com/nodejs/node/pull/65947)
+* \[[`ffd47a7ee5`](https://github.com/nodejs/node/commit/ffd47a7ee5)] - **doc**: clarify permission model scope for output paths (Rafael Gonzaga) [#66004](https://github.com/nodejs/node/pull/66004)
+* \[[`2e1772a8ab`](https://github.com/nodejs/node/commit/2e1772a8ab)] - **doc**: fill in missing zstd docs (James M Snell) [#65867](https://github.com/nodejs/node/pull/65867)
+* \[[`9f88c6f8dc`](https://github.com/nodejs/node/commit/9f88c6f8dc)] - **doc**: add inoway46 as triager (Yuya Inoue) [#65565](https://github.com/nodejs/node/pull/65565)
+* \[[`c2620d01f3`](https://github.com/nodejs/node/commit/c2620d01f3)] - **doc**: document windowsHide for child\_process.fork (Christopher Buss) [#65887](https://github.com/nodejs/node/pull/65887)
+* \[[`6076111e1a`](https://github.com/nodejs/node/commit/6076111e1a)] - **doc**: qualify directory read ordering for native fs (Trivikram Kamat) [#65868](https://github.com/nodejs/node/pull/65868)
+* \[[`7bf048a336`](https://github.com/nodejs/node/commit/7bf048a336)] - **doc**: add DOMException section to errors API reference (Avocado) [#65206](https://github.com/nodejs/node/pull/65206)
+* \[[`414b6bfa62`](https://github.com/nodejs/node/commit/414b6bfa62)] - **doc**: expand revert commit collaborator instructions (Mike McCready) [#65848](https://github.com/nodejs/node/pull/65848)
+* \[[`c8ac91692c`](https://github.com/nodejs/node/commit/c8ac91692c)] - **doc**: note that FreeEnvironment() runs a shared event loop (Shelley Vohr) [#65691](https://github.com/nodejs/node/pull/65691)
+* \[[`cc47cc0983`](https://github.com/nodejs/node/commit/cc47cc0983)] - **doc**: clarify security triage dispositions and permission boundaries (Rafael Gonzaga) [#65436](https://github.com/nodejs/node/pull/65436)
+* \[[`8b79a71e78`](https://github.com/nodejs/node/commit/8b79a71e78)] - **doc**: fix default limit of maxHeadersCount (Aryn H) [#65472](https://github.com/nodejs/node/pull/65472)
+* \[[`56b1252a54`](https://github.com/nodejs/node/commit/56b1252a54)] - **doc**: fix return types for sync methods (Chiang Fong Lee) [#58575](https://github.com/nodejs/node/pull/58575)
+* \[[`da0d32a333`](https://github.com/nodejs/node/commit/da0d32a333)] - **doc**: document REPL DEP0185 throws and uncaught-exception behavior (Adrián Estrada) [#64993](https://github.com/nodejs/node/pull/64993)
+* \[[`f8ab3619b6`](https://github.com/nodejs/node/commit/f8ab3619b6)] - **doc**: document close() error when in a sqlite callback (Trivikram Kamat) [#65090](https://github.com/nodejs/node/pull/65090)
+* \[[`131f1db302`](https://github.com/nodejs/node/commit/131f1db302)] - **doc**: clarify return type of `fs.mkdtemp*` (Antoine du Hamel) [#65743](https://github.com/nodejs/node/pull/65743)
+* \[[`7755e98183`](https://github.com/nodejs/node/commit/7755e98183)] - **doc**: update `changelog-maker` instructions for releasing (Juan José) [#65707](https://github.com/nodejs/node/pull/65707)
+* \[[`f982a53433`](https://github.com/nodejs/node/commit/f982a53433)] - **doc**: add stability status to `crypto.setEngine` (Antoine du Hamel) [#65746](https://github.com/nodejs/node/pull/65746)
+* \[[`17be003f7c`](https://github.com/nodejs/node/commit/17be003f7c)] - **doc**: remove outdated TLS authorized warning (Tim Perry) [#65597](https://github.com/nodejs/node/pull/65597)
+* \[[`424002232d`](https://github.com/nodejs/node/commit/424002232d)] - **doc**: fix stale TOC in maintaining-dependencies (greenhead) [#65523](https://github.com/nodejs/node/pull/65523)
+* \[[`dddb9b57a5`](https://github.com/nodejs/node/commit/dddb9b57a5)] - **doc**: refactor the AI guidelines (Joyee Cheung) [#65269](https://github.com/nodejs/node/pull/65269)
+* \[[`397b58e113`](https://github.com/nodejs/node/commit/397b58e113)] - **doc**: fix triggerAsyncId() comment in async\_hooks example (soreavis) [#64583](https://github.com/nodejs/node/pull/64583)
+* \[[`338ec94d83`](https://github.com/nodejs/node/commit/338ec94d83)] - **doc**: fix fsPromises.watch overflow value (Matt Radbourne) [#64605](https://github.com/nodejs/node/pull/64605)
+* \[[`f18be21b14`](https://github.com/nodejs/node/commit/f18be21b14)] - **doc**: clarify stream direction in options.stdio note (Avocado) [#65236](https://github.com/nodejs/node/pull/65236)
+* \[[`f07c6acd8b`](https://github.com/nodejs/node/commit/f07c6acd8b)] - **doc**: clarify signal listener behavior (Som Samantray) [#65243](https://github.com/nodejs/node/pull/65243)
+* \[[`8bc17b0c7a`](https://github.com/nodejs/node/commit/8bc17b0c7a)] - **doc**: add test reporter event lifecycle diagram (sangwook) [#63780](https://github.com/nodejs/node/pull/63780)
+* \[[`452e7477d4`](https://github.com/nodejs/node/commit/452e7477d4)] - **doc**: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) [#64342](https://github.com/nodejs/node/pull/64342)
+* \[[`acc1578179`](https://github.com/nodejs/node/commit/acc1578179)] - **doc**: deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) [#65593](https://github.com/nodejs/node/pull/65593)
+* \[[`e7ed4361d6`](https://github.com/nodejs/node/commit/e7ed4361d6)] - **doc,test**: account for OpenSSL 4.1 behaviours (Filip Skokan) [#65956](https://github.com/nodejs/node/pull/65956)
+* \[[`c65fafeab4`](https://github.com/nodejs/node/commit/c65fafeab4)] - **errors**: validate constructor name (Christian Aurich) [#65607](https://github.com/nodejs/node/pull/65607)
+* \[[`f6b47938b7`](https://github.com/nodejs/node/commit/f6b47938b7)] - **events**: fix weak listener retention overwrite (Aryan) [#64024](https://github.com/nodejs/node/pull/64024)
+* \[[`a27db42c3e`](https://github.com/nodejs/node/commit/a27db42c3e)] - **fs**: coerce FileHandle.read length like fs.read (Xia Chao) [#65521](https://github.com/nodejs/node/pull/65521)
+* \[[`f3019b522a`](https://github.com/nodejs/node/commit/f3019b522a)] - **fs**: throw on existing dir in cpSync with errorOnExist (Daijiro Wachi) [#64124](https://github.com/nodejs/node/pull/64124)
+* \[[`cd1011458f`](https://github.com/nodejs/node/commit/cd1011458f)] - **fs**: support removing read-only files in rmSync on Windows (Sparsh :)) [#64453](https://github.com/nodejs/node/pull/64453)
+* \[[`d659dd8cd8`](https://github.com/nodejs/node/commit/d659dd8cd8)] - **fs**: give directories created by cpSync the source directory's mode (Shelley Vohr) [#65488](https://github.com/nodejs/node/pull/65488)
+* \[[`1dfb047293`](https://github.com/nodejs/node/commit/1dfb047293)] - **fs**: handle recursive watch setup races (Filip Skokan) [#65699](https://github.com/nodejs/node/pull/65699)
+* \[[`bc431c8413`](https://github.com/nodejs/node/commit/bc431c8413)] - **fs**: apply nocase to literal glob exclude patterns (Yusuke Hayashi) [#64817](https://github.com/nodejs/node/pull/64817)
+* \[[`dd5662e641`](https://github.com/nodejs/node/commit/dd5662e641)] - **fs**: do not descend into symlinks for \*\* unless following symlinks (RafaelGSS) [#65435](https://github.com/nodejs/node/pull/65435)
+* \[[`ac4cf54292`](https://github.com/nodejs/node/commit/ac4cf54292)] - **fs**: watch directories, not files, in recursive fs.watch fallback (Shelley Vohr) [#65486](https://github.com/nodejs/node/pull/65486)
+* \[[`7804bfbd71`](https://github.com/nodejs/node/commit/7804bfbd71)] - **fs**: preserve directory timestamps in cp (Abhinandan Kumar) [#65540](https://github.com/nodejs/node/pull/65540)
+* \[[`ba5ca5a1a5`](https://github.com/nodejs/node/commit/ba5ca5a1a5)] - **fs**: fix recursive watch error handling (Filip Skokan) [#65635](https://github.com/nodejs/node/pull/65635)
+* \[[`b71c4c0551`](https://github.com/nodejs/node/commit/b71c4c0551)] - **fs**: fix rmSync error messages for non-ASCII paths (Yeaseen) [#61233](https://github.com/nodejs/node/pull/61233)
+* \[[`53b4700892`](https://github.com/nodejs/node/commit/53b4700892)] - **http**: don't destroy socket after request completes (Barath Raj) [#65952](https://github.com/nodejs/node/pull/65952)
+* \[[`96d4c23f17`](https://github.com/nodejs/node/commit/96d4c23f17)] - **http**: fast-forward teardown of unread messages (Matteo Collina) [#65732](https://github.com/nodejs/node/pull/65732)
+* \[[`742b4bf5a6`](https://github.com/nodejs/node/commit/742b4bf5a6)] - **http**: coalesce chunked writes during auto-corking (GetThatCookie) [#64987](https://github.com/nodejs/node/pull/64987)
+* \[[`8921108175`](https://github.com/nodejs/node/commit/8921108175)] - **http2**: settle pending write callbacks on destroy (Matteo Collina) [#66016](https://github.com/nodejs/node/pull/66016)
+* \[[`9a2f77a3fc`](https://github.com/nodejs/node/commit/9a2f77a3fc)] - **http2**: fix onread assert when destroying session from stream handler (Sankalp Thakur) [#65116](https://github.com/nodejs/node/pull/65116)
+* \[[`99e41eb43a`](https://github.com/nodejs/node/commit/99e41eb43a)] - **http2**: error for incomplete reads on RST, auto-drain, deprecate aborted (Tim Perry) [#63249](https://github.com/nodejs/node/pull/63249)
+* \[[`d520b9601c`](https://github.com/nodejs/node/commit/d520b9601c)] - **http2**: fix write deadlock exposed by larger window sizes (Tim Perry) [#65440](https://github.com/nodejs/node/pull/65440)
+* \[[`86b2497aae`](https://github.com/nodejs/node/commit/86b2497aae)] - **http2**: fix async context loss when trailers carry END\_STREAM (Orgad Shaneh) [#63814](https://github.com/nodejs/node/pull/63814)
+* \[[`536ccc7daf`](https://github.com/nodejs/node/commit/536ccc7daf)] - **https**: limit proxy CONNECT response headers (Matteo Collina) [#64545](https://github.com/nodejs/node/pull/64545)
+* \[[`fe6147832b`](https://github.com/nodejs/node/commit/fe6147832b)] - **inspector**: fix abort when two Environments own the inspector (Shelley Vohr) [#65877](https://github.com/nodejs/node/pull/65877)
+* \[[`843a27782a`](https://github.com/nodejs/node/commit/843a27782a)] - **inspector**: fix crash when the IsolateData has no platform (Shelley Vohr) [#65818](https://github.com/nodejs/node/pull/65818)
+* \[[`3f0b6d3308`](https://github.com/nodejs/node/commit/3f0b6d3308)] - **lib**: avoid repeat internal receiver checks (Filip Skokan) [#65910](https://github.com/nodejs/node/pull/65910)
+* \[[`0039479b4a`](https://github.com/nodejs/node/commit/0039479b4a)] - **lib**: fix shared buffer growability validation (Filip Skokan) [#65845](https://github.com/nodejs/node/pull/65845)
+* \[[`e7907130ae`](https://github.com/nodejs/node/commit/e7907130ae)] - **lib**: use Web IDL interface brand checks (Filip Skokan) [#65846](https://github.com/nodejs/node/pull/65846)
+* \[[`7ae085552b`](https://github.com/nodejs/node/commit/7ae085552b)] - **lib**: fix AbortSignal.any() abort propagation (Yuya Inoue) [#66014](https://github.com/nodejs/node/pull/66014)
+* \[[`01032f4fdc`](https://github.com/nodejs/node/commit/01032f4fdc)] - **lib**: fix for FileHandle.readableWebStream (Patrick Dähne) [#58842](https://github.com/nodejs/node/pull/58842)
+* \[[`60a9a28206`](https://github.com/nodejs/node/commit/60a9a28206)] - **lib**: avoid unsafe array iteration in cli table (Donghoon Kang) [#65838](https://github.com/nodejs/node/pull/65838)
+* \[[`230a7fcef0`](https://github.com/nodejs/node/commit/230a7fcef0)] - **lib**: optimize internal Web IDL dictionaries (Filip Skokan) [#65857](https://github.com/nodejs/node/pull/65857)
+* \[[`7cc02b14ec`](https://github.com/nodejs/node/commit/7cc02b14ec)] - **lib**: validate sequence iterator objects (Filip Skokan) [#65844](https://github.com/nodejs/node/pull/65844)
+* \[[`c2bb3aeccc`](https://github.com/nodejs/node/commit/c2bb3aeccc)] - **lib**: defer source map payload decoding until first use (Shelley Vohr) [#65490](https://github.com/nodejs/node/pull/65490)
+* \[[`c4b390cf17`](https://github.com/nodejs/node/commit/c4b390cf17)] - **lib**: optimize async context frame activation (Tim Perry) [#65519](https://github.com/nodejs/node/pull/65519)
+* \[[`3e4fc50a4f`](https://github.com/nodejs/node/commit/3e4fc50a4f)] - **lib**: use validateArray for array arguments (JunHwan Choi) [#65344](https://github.com/nodejs/node/pull/65344)
+* \[[`b351ac9cd4`](https://github.com/nodejs/node/commit/b351ac9cd4)] - **meta**: bump step-security/harden-runner from 2.21.0 to 2.21.1 (dependabot\[bot]) [#66044](https://github.com/nodejs/node/pull/66044)
+* \[[`693e890fec`](https://github.com/nodejs/node/commit/693e890fec)] - **meta**: bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 (dependabot\[bot]) [#66046](https://github.com/nodejs/node/pull/66046)
+* \[[`9c2abc13c2`](https://github.com/nodejs/node/commit/9c2abc13c2)] - **meta**: bump github/codeql-action/init from 4.37.9 to 4.38.0 (dependabot\[bot]) [#66048](https://github.com/nodejs/node/pull/66048)
+* \[[`b3c5c2b91d`](https://github.com/nodejs/node/commit/b3c5c2b91d)] - **meta**: bump github/codeql-action/analyze from 4.37.9 to 4.38.0 (dependabot\[bot]) [#66049](https://github.com/nodejs/node/pull/66049)
+* \[[`2428b13b02`](https://github.com/nodejs/node/commit/2428b13b02)] - **meta**: bump github/codeql-action/autobuild from 4.37.9 to 4.38.0 (dependabot\[bot]) [#66050](https://github.com/nodejs/node/pull/66050)
+* \[[`eff5d15041`](https://github.com/nodejs/node/commit/eff5d15041)] - **meta**: add joyeecheung as v8 currency strategic initiative champion (Joyee Cheung) [#65965](https://github.com/nodejs/node/pull/65965)
+* \[[`aa549fed0d`](https://github.com/nodejs/node/commit/aa549fed0d)] - **meta**: expand on collaborator restoration process (Chengzhong Wu) [#65962](https://github.com/nodejs/node/pull/65962)
+* \[[`593b40eb2b`](https://github.com/nodejs/node/commit/593b40eb2b)] - **meta**: add web-standards as webidl owners (Filip Skokan) [#65856](https://github.com/nodejs/node/pull/65856)
+* \[[`e711d3fef3`](https://github.com/nodejs/node/commit/e711d3fef3)] - **meta**: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot\[bot]) [#65718](https://github.com/nodejs/node/pull/65718)
+* \[[`0fc8a38f5b`](https://github.com/nodejs/node/commit/0fc8a38f5b)] - **meta**: cleanup targos emeritus changes (Antoine du Hamel) [#65738](https://github.com/nodejs/node/pull/65738)
+* \[[`2ca2fd566d`](https://github.com/nodejs/node/commit/2ca2fd566d)] - **meta**: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65714](https://github.com/nodejs/node/pull/65714)
+* \[[`325709818e`](https://github.com/nodejs/node/commit/325709818e)] - **meta**: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65717](https://github.com/nodejs/node/pull/65717)
+* \[[`8481d22f72`](https://github.com/nodejs/node/commit/8481d22f72)] - **meta**: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot\[bot]) [#65720](https://github.com/nodejs/node/pull/65720)
+* \[[`cd2bd5d9fd`](https://github.com/nodejs/node/commit/cd2bd5d9fd)] - **meta**: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot\[bot]) [#65721](https://github.com/nodejs/node/pull/65721)
+* \[[`fdec747105`](https://github.com/nodejs/node/commit/fdec747105)] - **meta**: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65722](https://github.com/nodejs/node/pull/65722)
+* \[[`34c2fca088`](https://github.com/nodejs/node/commit/34c2fca088)] - **meta**: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65723](https://github.com/nodejs/node/pull/65723)
+* \[[`46d4549938`](https://github.com/nodejs/node/commit/46d4549938)] - **meta**: document collaborator automation (Filip Skokan) [#65671](https://github.com/nodejs/node/pull/65671)
+* \[[`a7f8de6362`](https://github.com/nodejs/node/commit/a7f8de6362)] - **(SEMVER-MINOR)** **net**: support sending net.BoundSocket to threads and child processes (Guy Bedford) [#64725](https://github.com/nodejs/node/pull/64725)
+* \[[`466f1f8e62`](https://github.com/nodejs/node/commit/466f1f8e62)] - **net**: fix BlockList.fromJSON for IPv4-mapped IPv6 rules (Daijiro Wachi) [#64125](https://github.com/nodejs/node/pull/64125)
+* \[[`cd04cb10d6`](https://github.com/nodejs/node/commit/cd04cb10d6)] - **net**: recognize bare IPv6 loopback addresses in isLoopback (Daijiro Wachi) [#63619](https://github.com/nodejs/node/pull/63619)
+* \[[`d983942636`](https://github.com/nodejs/node/commit/d983942636)] - **node-api**: make object property arrays const (Yilong Li) [#65621](https://github.com/nodejs/node/pull/65621)
+* \[[`cc124394cc`](https://github.com/nodejs/node/commit/cc124394cc)] - **path**: remove `StringPrototypeCharCodeAt` from some methods of `posix` (Wiyeong Seo) [#54668](https://github.com/nodejs/node/pull/54668)
+* \[[`60c3eb61bd`](https://github.com/nodejs/node/commit/60c3eb61bd)] - **(SEMVER-MINOR)** **perf\_hooks**: implement SlidingWindowHistogram (James M Snell) [#65825](https://github.com/nodejs/node/pull/65825)
+* \[[`6b3e6f9d5c`](https://github.com/nodejs/node/commit/6b3e6f9d5c)] - **(SEMVER-MINOR)** **perf\_hooks**: implement qrde analysis support in Histogram (James M Snell) [#65806](https://github.com/nodejs/node/pull/65806)
+* \[[`8aa870940c`](https://github.com/nodejs/node/commit/8aa870940c)] - **perf\_hooks**: reuse buffer for uv metrics (Donghoon Kang) [#65985](https://github.com/nodejs/node/pull/65985)
+* \[[`9cfbfae660`](https://github.com/nodejs/node/commit/9cfbfae660)] - **perf\_hooks**: validate import normalization offset (Matteo Collina) [#65950](https://github.com/nodejs/node/pull/65950)
+* \[[`75456a3512`](https://github.com/nodejs/node/commit/75456a3512)] - **(SEMVER-MINOR)** **perf\_hooks**: implement Histogram meanCI API (James M Snell) [#65606](https://github.com/nodejs/node/pull/65606)
+* \[[`127cb31864`](https://github.com/nodejs/node/commit/127cb31864)] - **perf\_hooks**: add missing resource timing attributes (greenhead) [#65017](https://github.com/nodejs/node/pull/65017)
+* \[[`72d1b40c56`](https://github.com/nodejs/node/commit/72d1b40c56)] - **(SEMVER-MINOR)** **perf\_hooks**: add CBOR export/import for histogram exchange (James M Snell) [#65434](https://github.com/nodejs/node/pull/65434)
+* \[[`847fe4d049`](https://github.com/nodejs/node/commit/847fe4d049)] - **permission**: block FileHandle fsync and fdatasync (Rafael Gonzaga) [#65431](https://github.com/nodejs/node/pull/65431)
+* \[[`fa9188bd63`](https://github.com/nodejs/node/commit/fa9188bd63)] - **quic**: fix two small bugs in HTTP/3 stream internals (Tim Perry) [#65970](https://github.com/nodejs/node/pull/65970)
+* \[[`ee80beaa9f`](https://github.com/nodejs/node/commit/ee80beaa9f)] - **quic**: fix crash in onStreamClose (Marten Richter) [#65861](https://github.com/nodejs/node/pull/65861)
+* \[[`98486dd764`](https://github.com/nodejs/node/commit/98486dd764)] - **quic**: reject zero addressLRUSize (Christian Aurich) [#65827](https://github.com/nodejs/node/pull/65827)
+* \[[`97516fc256`](https://github.com/nodejs/node/commit/97516fc256)] - **quic**: stop guarding ngtcp2\_recv\_stop\_sending callback field (René) [#65688](https://github.com/nodejs/node/pull/65688)
+* \[[`024bef25eb`](https://github.com/nodejs/node/commit/024bef25eb)] - **quic**: remove unused fin flag from blob reader wakeup (trivenay) [#65315](https://github.com/nodejs/node/pull/65315)
+* \[[`5468337456`](https://github.com/nodejs/node/commit/5468337456)] - **quic**: release stream arenas before cleanup (Trivikram Kamat) [#65410](https://github.com/nodejs/node/pull/65410)
+* \[[`a794e36970`](https://github.com/nodejs/node/commit/a794e36970)] - **sqlite**: throw on invalid URL path instead of abort (Guilherme Araújo) [#66026](https://github.com/nodejs/node/pull/66026)
+* \[[`f58a55b8d0`](https://github.com/nodejs/node/commit/f58a55b8d0)] - **sqlite**: add diagnostic channel (Guilherme Araújo) [#62241](https://github.com/nodejs/node/pull/62241)
+* \[[`be849bc6af`](https://github.com/nodejs/node/commit/be849bc6af)] - **sqlite**: reject connection access from authorizer callbacks (Trevor Burnham) [#65156](https://github.com/nodejs/node/pull/65156)
+* \[[`41161dda87`](https://github.com/nodejs/node/commit/41161dda87)] - **(SEMVER-MINOR)** **sqlite**: add StatementSync.prototype.close() (Guilherme Araújo) [#64232](https://github.com/nodejs/node/pull/64232)
+* \[[`adbc757d70`](https://github.com/nodejs/node/commit/adbc757d70)] - **(SEMVER-MINOR)** **sqlite**: add StatementSync.prototype\[Symbol.dispose]\() (Guilherme Araújo) [#64232](https://github.com/nodejs/node/pull/64232)
+* \[[`b7b18fdbc9`](https://github.com/nodejs/node/commit/b7b18fdbc9)] - **sqlite**: run backup completion in callback scope (Filip Skokan) [#65666](https://github.com/nodejs/node/pull/65666)
+* \[[`59827acd7f`](https://github.com/nodejs/node/commit/59827acd7f)] - **sqlite**: isolate applyChangeset filter errors (Trivikram Kamat) [#64823](https://github.com/nodejs/node/pull/64823)
+* \[[`5a01df2d15`](https://github.com/nodejs/node/commit/5a01df2d15)] - **sqlite**: reject deserialize() while in a callback (Trivikram Kamat) [#64796](https://github.com/nodejs/node/pull/64796)
+* \[[`c9b6e75a2e`](https://github.com/nodejs/node/commit/c9b6e75a2e)] - **sqlite**: refactor error helpers and user function pointers (Ali Hassan) [#62794](https://github.com/nodejs/node/pull/62794)
+* \[[`d4eb6c62a9`](https://github.com/nodejs/node/commit/d4eb6c62a9)] - **sqlite**: prevent database close during callbacks (Matteo Collina) [#64743](https://github.com/nodejs/node/pull/64743)
+* \[[`83b3431c25`](https://github.com/nodejs/node/commit/83b3431c25)] - **src**: detach cppgc wrappers from their Realm before it is freed (Shelley Vohr) [#65778](https://github.com/nodejs/node/pull/65778)
+* \[[`13ed7e35e7`](https://github.com/nodejs/node/commit/13ed7e35e7)] - **src**: list scripts when `--run` has no command (James Ross) [#64606](https://github.com/nodejs/node/pull/64606)
+* \[[`0f62f2b2df`](https://github.com/nodejs/node/commit/0f62f2b2df)] - **src**: print exception thrown during primordial initialization (Joyee Cheung) [#65991](https://github.com/nodejs/node/pull/65991)
+* \[[`70117640f7`](https://github.com/nodejs/node/commit/70117640f7)] - **src**: don't kill own process group on failed spawn (Lazizbek Ergashev) [#65054](https://github.com/nodejs/node/pull/65054)
+* \[[`64649abfd4`](https://github.com/nodejs/node/commit/64649abfd4)] - **src**: keep the first snapshot blob alive for later isolates (Shelley Vohr) [#65779](https://github.com/nodejs/node/pull/65779)
+* \[[`3c814e8c3c`](https://github.com/nodejs/node/commit/3c814e8c3c)] - **src**: fix Stop() terminating the next Environment on the isolate (Shelley Vohr) [#65819](https://github.com/nodejs/node/pull/65819)
+* \[[`a3ababcebb`](https://github.com/nodejs/node/commit/a3ababcebb)] - **src**: fix null pointer call when running without a startup snapshot (Shelley Vohr) [#65820](https://github.com/nodejs/node/pull/65820)
+* \[[`7331f5cfcc`](https://github.com/nodejs/node/commit/7331f5cfcc)] - **src**: stop leaking a CppHeap in CommonEnvironmentSetup (Shelley Vohr) [#65792](https://github.com/nodejs/node/pull/65792)
+* \[[`5570a84048`](https://github.com/nodejs/node/commit/5570a84048)] - **src**: fix use-after-free in CleanupHookThunkRun (Caleb Everett) [#65630](https://github.com/nodejs/node/pull/65630)
+* \[[`abe1b673e9`](https://github.com/nodejs/node/commit/abe1b673e9)] - **src**: keep global list of addon-provided cleanup hooks (Anna Henningsen) [#63985](https://github.com/nodejs/node/pull/63985)
+* \[[`2203ac9382`](https://github.com/nodejs/node/commit/2203ac9382)] - **src**: fix startup snapshot reproducibility of InternalFieldInfo (Chengzhong Wu) [#65684](https://github.com/nodejs/node/pull/65684)
+* \[[`b282765d99`](https://github.com/nodejs/node/commit/b282765d99)] - **src**: fix live lock between environments with blocked requests (Ilyas Shabi) [#65520](https://github.com/nodejs/node/pull/65520)
+* \[[`61ca3ba93c`](https://github.com/nodejs/node/commit/61ca3ba93c)] - **src**: apply IsolateSettings when using a snapshot (Shelley Vohr) [#65407](https://github.com/nodejs/node/pull/65407)
+* \[[`33b8d6e10f`](https://github.com/nodejs/node/commit/33b8d6e10f)] - **src**: add re-entrancy guard to TriggerUncaughtException (Temuulen Undrakhbayar) [#64327](https://github.com/nodejs/node/pull/64327)
+* \[[`49232db71e`](https://github.com/nodejs/node/commit/49232db71e)] - **src**: reuse cached strings in CompileSerializeMain (agape1225) [#65453](https://github.com/nodejs/node/pull/65453)
+* \[[`e3f52b80a5`](https://github.com/nodejs/node/commit/e3f52b80a5)] - **src**: report libuv error when openAsBlob cannot stat (Paul Bouchon) [#65517](https://github.com/nodejs/node/pull/65517)
+* \[[`42a5a19027`](https://github.com/nodejs/node/commit/42a5a19027)] - **src**: shave about 20 bytes off each TLSWrap instance (James M Snell) [#65144](https://github.com/nodejs/node/pull/65144)
+* \[[`a06bb51e22`](https://github.com/nodejs/node/commit/a06bb51e22)] - **src**: use UTF-8 for task runner filesystem paths (Archkon) [#64868](https://github.com/nodejs/node/pull/64868)
+* \[[`241339f072`](https://github.com/nodejs/node/commit/241339f072)] - **(SEMVER-MINOR)** **src,lib**: add util.markPromiseAsHandled (James M Snell) [#65805](https://github.com/nodejs/node/pull/65805)
+* \[[`1260642ace`](https://github.com/nodejs/node/commit/1260642ace)] - **stream**: destroy Duplex.from async function on early return (Aman Chadha(IVIXMMI)) [#65963](https://github.com/nodejs/node/pull/65963)
+* \[[`5f06defdbd`](https://github.com/nodejs/node/commit/5f06defdbd)] - **stream**: make share budget failures detach before throwing (James M Snell) [#66028](https://github.com/nodejs/node/pull/66028)
+* \[[`d1c60d898d`](https://github.com/nodejs/node/commit/d1c60d898d)] - **stream**: update broadcast to retain buffered data with zero consumers (James M Snell) [#66028](https://github.com/nodejs/node/pull/66028)
+* \[[`bbb00558c5`](https://github.com/nodejs/node/commit/bbb00558c5)] - **stream**: avoid promise allocation for parked transform writes (Matteo Collina) [#65625](https://github.com/nodejs/node/pull/65625)
+* \[[`3216bc3912`](https://github.com/nodejs/node/commit/3216bc3912)] - **stream**: keep webstream stream states in fast-mode objects (Matteo Collina) [#65625](https://github.com/nodejs/node/pull/65625)
+* \[[`70c1415686`](https://github.com/nodejs/node/commit/70c1415686)] - **stream**: reject closed only after sink abort settles (Lazizbek Ergashev) [#65727](https://github.com/nodejs/node/pull/65727)
+* \[[`f8737b8ee5`](https://github.com/nodejs/node/commit/f8737b8ee5)] - **stream**: fix ERR\_INVALID\_STATE when cancelling Readable.toWeb() (Richard Scarrott) [#62773](https://github.com/nodejs/node/pull/62773)
+* \[[`faa16f671c`](https://github.com/nodejs/node/commit/faa16f671c)] - **stream**: amortize writable buffer compaction (Gürgün Dayıoğlu) [#65847](https://github.com/nodejs/node/pull/65847)
+* \[[`6262e0b8c6`](https://github.com/nodejs/node/commit/6262e0b8c6)] - **stream**: create write request objects lazily (Matteo Collina) [#64455](https://github.com/nodejs/node/pull/64455)
+* \[[`0f0566de15`](https://github.com/nodejs/node/commit/0f0566de15)] - **stream**: allocate stream read buffers from a slab (Matteo Collina) [#64455](https://github.com/nodejs/node/pull/64455)
+* \[[`02c776a7c6`](https://github.com/nodejs/node/commit/02c776a7c6)] - **stream**: ensure that stateful transforms preserve this (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`4b29051971`](https://github.com/nodejs/node/commit/4b29051971)] - **stream**: fix nested async flushing with infinite sources (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`2e54186d97`](https://github.com/nodejs/node/commit/2e54186d97)] - **stream**: ensure from() observes returned rejecting promise correctly (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`fd68d5ca6a`](https://github.com/nodejs/node/commit/fd68d5ca6a)] - **stream**: apply source normalization once at call time (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`49ee85b462`](https://github.com/nodejs/node/commit/49ee85b462)] - **stream**: make pipeTo source normalization independent of Writer (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`d7d0440f08`](https://github.com/nodejs/node/commit/d7d0440f08)] - **stream**: pre-aborted pipeTo now applies dest failure handling (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`6d8e643ef3`](https://github.com/nodejs/node/commit/6d8e643ef3)] - **stream**: ensure async dispoal after endSync awaits for drain (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`a082916c00`](https://github.com/nodejs/node/commit/a082916c00)] - **stream**: ensure factory signals remain active through closing (James M Snell) [#65658](https://github.com/nodejs/node/pull/65658)
+* \[[`38829295a7`](https://github.com/nodejs/node/commit/38829295a7)] - **stream**: skip unobserved 'readable' emission at EOF (Matteo Collina) [#65749](https://github.com/nodejs/node/pull/65749)
+* \[[`d535859c22`](https://github.com/nodejs/node/commit/d535859c22)] - **stream**: avoid per-chunk promises in webstream adapters (Matteo Collina) [#65548](https://github.com/nodejs/node/pull/65548)
+* \[[`80568f6818`](https://github.com/nodejs/node/commit/80568f6818)] - **stream**: address stream/iter review feedback (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`6952928f68`](https://github.com/nodejs/node/commit/6952928f68)] - **stream**: replace object sentinel with symbol (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`9c22c4124c`](https://github.com/nodejs/node/commit/9c22c4124c)] - **stream**: cancel active stream/iter pulls (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`24d87990cf`](https://github.com/nodejs/node/commit/24d87990cf)] - **stream**: fix merge settlement tagging and falsy error tracking (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`1e215c4b51`](https://github.com/nodejs/node/commit/1e215c4b51)] - **stream**: ensure full-close semantics when closed (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`f499d6fadf`](https://github.com/nodejs/node/commit/f499d6fadf)] - **stream**: fixup writer to terminate on consumer return/throw (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`2130738033`](https://github.com/nodejs/node/commit/2130738033)] - **stream**: ensure iterator cleanup on done, reject, etc (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`748adc6275`](https://github.com/nodejs/node/commit/748adc6275)] - **stream**: fixup cancelation handling in pull() (James M Snell) [#65652](https://github.com/nodejs/node/pull/65652)
+* \[[`47b3f6a1fa`](https://github.com/nodejs/node/commit/47b3f6a1fa)] - **stream**: fix early drain after Utf8Stream reopen (Matteo Collina) [#65633](https://github.com/nodejs/node/pull/65633)
+* \[[`6dab5412cf`](https://github.com/nodejs/node/commit/6dab5412cf)] - **test**: skip RSA-PSS keygen deprecation tests with BoringSSL (Shelley Vohr) [#65808](https://github.com/nodejs/node/pull/65808)
+* \[[`95d9a25b61`](https://github.com/nodejs/node/commit/95d9a25b61)] - **test**: consolidate crypto provider cache coverage (Filip Skokan) [#66108](https://github.com/nodejs/node/pull/66108)
+* \[[`612db6d5b2`](https://github.com/nodejs/node/commit/612db6d5b2)] - **test**: deflake user timing WPT assertions (Filip Skokan) [#66036](https://github.com/nodejs/node/pull/66036)
+* \[[`61a73d31eb`](https://github.com/nodejs/node/commit/61a73d31eb)] - **test**: fix RSA/DSA wrong-passphrase flake (Filip Skokan) [#65983](https://github.com/nodejs/node/pull/65983)
+* \[[`d9f4a3ee3e`](https://github.com/nodejs/node/commit/d9f4a3ee3e)] - **test**: reuse fixed primes in DH tests (Filip Skokan) [#65980](https://github.com/nodejs/node/pull/65980)
+* \[[`a0fd0a8bd6`](https://github.com/nodejs/node/commit/a0fd0a8bd6)] - **test**: use named parameters in DH stress test (Filip Skokan) [#65980](https://github.com/nodejs/node/pull/65980)
+* \[[`810a6b00ee`](https://github.com/nodejs/node/commit/810a6b00ee)] - **test**: update tests to run with OpenSSL >= 3.0 FIPS mode (Filip Skokan) [#64960](https://github.com/nodejs/node/pull/64960)
+* \[[`dc6b9ba5b2`](https://github.com/nodejs/node/commit/dc6b9ba5b2)] - **test**: deflake test-run-watch-cwd-isolation-none-\* (Antoine du Hamel) [#66035](https://github.com/nodejs/node/pull/66035)
+* \[[`0f27bd2459`](https://github.com/nodejs/node/commit/0f27bd2459)] - **test**: unskip `test-watch-create-isolation-none` (Antoine du Hamel) [#66041](https://github.com/nodejs/node/pull/66041)
+* \[[`1019f624f3`](https://github.com/nodejs/node/commit/1019f624f3)] - **test**: deflake util.throttle tests (Filip Skokan) [#66034](https://github.com/nodejs/node/pull/66034)
+* \[[`b4a6719f37`](https://github.com/nodejs/node/commit/b4a6719f37)] - **(SEMVER-MINOR)** **test**: expand histogram test coverage (James M Snell) [#65825](https://github.com/nodejs/node/pull/65825)
+* \[[`047d7c53d2`](https://github.com/nodejs/node/commit/047d7c53d2)] - **test**: implement low-risk test optimizations (James M Snell) [#65926](https://github.com/nodejs/node/pull/65926)
+* \[[`33775d2bbb`](https://github.com/nodejs/node/commit/33775d2bbb)] - **test**: prevent parser reuse across close scenarios (Filip Skokan) [#66017](https://github.com/nodejs/node/pull/66017)
+* \[[`b8c5283cbc`](https://github.com/nodejs/node/commit/b8c5283cbc)] - **test**: fix stderr Buffer assertion in exec encoding test (greenhead) [#66008](https://github.com/nodejs/node/pull/66008)
+* \[[`13a2982002`](https://github.com/nodejs/node/commit/13a2982002)] - **test**: improve sequential test performance (James M Snell) [#65928](https://github.com/nodejs/node/pull/65928)
+* \[[`a578933da0`](https://github.com/nodejs/node/commit/a578933da0)] - **test**: overlap SLH-DSA signature checks (Filip Skokan) [#65980](https://github.com/nodejs/node/pull/65980)
+* \[[`bfdf20729d`](https://github.com/nodejs/node/commit/bfdf20729d)] - **test**: unref cancelled broadcast source timer (Filip Skokan) [#65980](https://github.com/nodejs/node/pull/65980)
+* \[[`b29154d471`](https://github.com/nodejs/node/commit/b29154d471)] - **test**: collect timeout signals explicitly (Filip Skokan) [#65980](https://github.com/nodejs/node/pull/65980)
+* \[[`384d4fe3ea`](https://github.com/nodejs/node/commit/384d4fe3ea)] - **test**: skip retries in DNS timeout coverage (Filip Skokan) [#65980](https://github.com/nodejs/node/pull/65980)
+* \[[`c7323843f4`](https://github.com/nodejs/node/commit/c7323843f4)] - **test**: synchronize ordered runner events (Filip Skokan) [#65980](https://github.com/nodejs/node/pull/65980)
+* \[[`625290573a`](https://github.com/nodejs/node/commit/625290573a)] - **test**: avoid idle HTTP/HTTPS connections (Filip Skokan) [#65980](https://github.com/nodejs/node/pull/65980)
+* \[[`2bde68398f`](https://github.com/nodejs/node/commit/2bde68398f)] - **test**: close WebAssembly test HTTP servers (Filip Skokan) [#65980](https://github.com/nodejs/node/pull/65980)
+* \[[`4c702e401b`](https://github.com/nodejs/node/commit/4c702e401b)] - **test**: deflake node-api test-free-called (Christian Aurich) [#65948](https://github.com/nodejs/node/pull/65948)
+* \[[`0b6d945ebc`](https://github.com/nodejs/node/commit/0b6d945ebc)] - **test**: skip C++ symbols in tick-processor-arguments (Philipp Dunkel) [#65906](https://github.com/nodejs/node/pull/65906)
+* \[[`e04210b383`](https://github.com/nodejs/node/commit/e04210b383)] - **test**: try fixing windows build replacing WMIC (James M Snell) [#65949](https://github.com/nodejs/node/pull/65949)
+* \[[`aed73444de`](https://github.com/nodejs/node/commit/aed73444de)] - **test**: fix flaky cleanup in http2 test (Tim Perry) [#65701](https://github.com/nodejs/node/pull/65701)
+* \[[`22f47ff728`](https://github.com/nodejs/node/commit/22f47ff728)] - **test**: update WPT WebCrypto, WebIDL and interfaces (Filip Skokan) [#65679](https://github.com/nodejs/node/pull/65679)
+* \[[`f2af511a24`](https://github.com/nodejs/node/commit/f2af511a24)] - **test**: zero-fill buffers before the string length limit check (Christian Aurich) [#65755](https://github.com/nodejs/node/pull/65755)
+* \[[`a28aad9960`](https://github.com/nodejs/node/commit/a28aad9960)] - **test**: update WPT for url to c23755a144 (Node.js GitHub Bot) [#65651](https://github.com/nodejs/node/pull/65651)
+* \[[`ba65bb149a`](https://github.com/nodejs/node/commit/ba65bb149a)] - **test**: fix recursive fs.watch error fixture (Filip Skokan) [#65683](https://github.com/nodejs/node/pull/65683)
+* \[[`f3b9f132b1`](https://github.com/nodejs/node/commit/f3b9f132b1)] - **test**: update streams WPT (Jeong SeokChan) [#65638](https://github.com/nodejs/node/pull/65638)
+* \[[`d2e0f2d3bd`](https://github.com/nodejs/node/commit/d2e0f2d3bd)] - **test**: deflake fastutf8stream destroy and reopen tests (Christian Aurich) [#65554](https://github.com/nodejs/node/pull/65554)
+* \[[`7b5896c136`](https://github.com/nodejs/node/commit/7b5896c136)] - **test**: cover Readable.from() sync iterator errors (jakecastelli) [#65515](https://github.com/nodejs/node/pull/65515)
+* \[[`66eafad642`](https://github.com/nodejs/node/commit/66eafad642)] - **test**: document WPT runner workflows (Filip Skokan) [#65510](https://github.com/nodejs/node/pull/65510)
+* \[[`2e2dc0f556`](https://github.com/nodejs/node/commit/2e2dc0f556)] - **test**: simplify test-worker-heap-profile.js (Donghoon Kang) [#65372](https://github.com/nodejs/node/pull/65372)
+* \[[`2e57caac46`](https://github.com/nodejs/node/commit/2e57caac46)] - **test**: prefer in-memory databases in sqlite tests (Paul Bouchon) [#64701](https://github.com/nodejs/node/pull/64701)
+* \[[`cef908596e`](https://github.com/nodejs/node/commit/cef908596e)] - **test**: fix typo from funciton to function (parkhojeong) [#63403](https://github.com/nodejs/node/pull/63403)
+* \[[`4c7bbd4182`](https://github.com/nodejs/node/commit/4c7bbd4182)] - **test**: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`25c81c9eff`](https://github.com/nodejs/node/commit/25c81c9eff)] - **test**: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`cab5dcedbe`](https://github.com/nodejs/node/commit/cab5dcedbe)] - **test**: only count restarts after the write in watch emit-restarted test (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`db0ca93e94`](https://github.com/nodejs/node/commit/db0ca93e94)] - **test**: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`1f0087040a`](https://github.com/nodejs/node/commit/1f0087040a)] - **test**: handle EPIPE in closed channel test (Christian Aurich) [#65770](https://github.com/nodejs/node/pull/65770)
+* \[[`ed4e5df638`](https://github.com/nodejs/node/commit/ed4e5df638)] - **test**: deflake test-runner-coverage (Christian Aurich) [#65728](https://github.com/nodejs/node/pull/65728)
+* \[[`48ecb16909`](https://github.com/nodejs/node/commit/48ecb16909)] - **test**: set type=none on IBM i for empty source (Abdirahim Musse) [#65545](https://github.com/nodejs/node/pull/65545)
+* \[[`554a3fba98`](https://github.com/nodejs/node/commit/554a3fba98)] - **test**: deflake WASI poll timing checks (Filip Skokan) [#65672](https://github.com/nodejs/node/pull/65672)
+* \[[`91b5389430`](https://github.com/nodejs/node/commit/91b5389430)] - **test**: skip `fs-watch-recursive-delete-race` on AIX (Antoine du Hamel) [#65698](https://github.com/nodejs/node/pull/65698)
+* \[[`4ed0c8cc6c`](https://github.com/nodejs/node/commit/4ed0c8cc6c)] - **test**: deflake test-inspect-async-hook-setup-at-inspect (Christian Aurich) [#65584](https://github.com/nodejs/node/pull/65584)
+* \[[`500b98cc7d`](https://github.com/nodejs/node/commit/500b98cc7d)] - **test**: deflake test-watch-mode-restart-esm-loading-error (Christian Aurich) [#65623](https://github.com/nodejs/node/pull/65623)
+* \[[`099c20fcbd`](https://github.com/nodejs/node/commit/099c20fcbd)] - **test**: avoid orphaned child on Windows abort test (Kirill Saied) [#65451](https://github.com/nodejs/node/pull/65451)
+* \[[`fc9364fe55`](https://github.com/nodejs/node/commit/fc9364fe55)] - **test**: riscv64: skip node-api sea test (Stewart X Addison) [#65569](https://github.com/nodejs/node/pull/65569)
+* \[[`c9d6b5f731`](https://github.com/nodejs/node/commit/c9d6b5f731)] - **test**: mark platform-specific tests as flaky (Filip Skokan) [#65562](https://github.com/nodejs/node/pull/65562)
+* \[[`cb93d40549`](https://github.com/nodejs/node/commit/cb93d40549)] - **test,benchmark**: use OpenSSL feature helpers (Filip Skokan) [#65762](https://github.com/nodejs/node/pull/65762)
+* \[[`b4b859319d`](https://github.com/nodejs/node/commit/b4b859319d)] - **test\_runner**: avoid reusing v8 serializers (Yuya Inoue) [#65951](https://github.com/nodejs/node/pull/65951)
+* \[[`b3766225e1`](https://github.com/nodejs/node/commit/b3766225e1)] - **test\_runner**: fix quote escaping in JUnit (Jihwan) [#65971](https://github.com/nodejs/node/pull/65971)
+* \[[`ec37f934db`](https://github.com/nodejs/node/commit/ec37f934db)] - **tls**: propagate singleUse to the secure context (Carlos Vinicius) [#66025](https://github.com/nodejs/node/pull/66025)
+* \[[`21aec3f286`](https://github.com/nodejs/node/commit/21aec3f286)] - **tls**: defer re-entrant calls to SSL state machine from JS (Tim Perry) [#65105](https://github.com/nodejs/node/pull/65105)
+* \[[`ffd3de2831`](https://github.com/nodejs/node/commit/ffd3de2831)] - **tls**: read the peer certificate chain without consuming it (Tony Gies) [#65602](https://github.com/nodejs/node/pull/65602)
+* \[[`3481ea3c43`](https://github.com/nodejs/node/commit/3481ea3c43)] - **tls**: don't trigger SNICallback or OCSPRequest from the TLS lib stack (Tim Perry) [#64827](https://github.com/nodejs/node/pull/64827)
+* \[[`d75957f0c8`](https://github.com/nodejs/node/commit/d75957f0c8)] - **tls**: drop hand-rolled TLS client hello parser (Tim Perry) [#64827](https://github.com/nodejs/node/pull/64827)
+* \[[`c555ba0aeb`](https://github.com/nodejs/node/commit/c555ba0aeb)] - **tools**: update `tools/v8` for Python 3.13 (Richard Lau) [#66109](https://github.com/nodejs/node/pull/66109)
+* \[[`aafff27ebe`](https://github.com/nodejs/node/commit/aafff27ebe)] - **tools**: bump eslint-plugin-jsdoc in /tools/eslint in the eslint group (dependabot\[bot]) [#66102](https://github.com/nodejs/node/pull/66102)
+* \[[`7a481ebd2c`](https://github.com/nodejs/node/commit/7a481ebd2c)] - **tools**: group CodeQL GHA updates (Antoine du Hamel) [#66057](https://github.com/nodejs/node/pull/66057)
+* \[[`b2252b4074`](https://github.com/nodejs/node/commit/b2252b4074)] - **tools**: summarize auto-start-ci failures (Filip Skokan) [#65979](https://github.com/nodejs/node/pull/65979)
+* \[[`499fe73da7`](https://github.com/nodejs/node/commit/499fe73da7)] - **tools**: bump the eslint group in /tools/eslint with 6 updates (dependabot\[bot]) [#66045](https://github.com/nodejs/node/pull/66045)
+* \[[`d004d957ae`](https://github.com/nodejs/node/commit/d004d957ae)] - **tools**: update pgo build doc for linux (Chengzhong Wu) [#66024](https://github.com/nodejs/node/pull/66024)
+* \[[`bfa329dbba`](https://github.com/nodejs/node/commit/bfa329dbba)] - **tools**: correct Slack action version comments (Filip Skokan) [#66013](https://github.com/nodejs/node/pull/66013)
+* \[[`d55d30313b`](https://github.com/nodejs/node/commit/d55d30313b)] - **tools**: make checkout credential use explicit (Filip Skokan) [#66013](https://github.com/nodejs/node/pull/66013)
+* \[[`0a9e844866`](https://github.com/nodejs/node/commit/0a9e844866)] - **tools**: pass author to commit message validator (Filip Skokan) [#66012](https://github.com/nodejs/node/pull/66012)
+* \[[`f5edf1cd7c`](https://github.com/nodejs/node/commit/f5edf1cd7c)] - **tools**: reduce test runner timing overhead (Filip Skokan) [#65980](https://github.com/nodejs/node/pull/65980)
+* \[[`1cb899f727`](https://github.com/nodejs/node/commit/1cb899f727)] - **tools**: bump js-yaml from 4.3.1 to 4.3.2 in /tools/eslint (dependabot\[bot]) [#65931](https://github.com/nodejs/node/pull/65931)
+* \[[`9a1d47bc53`](https://github.com/nodejs/node/commit/9a1d47bc53)] - **tools**: bump js-yaml from 4.3.1 to 4.3.2 in /tools/lint-md (dependabot\[bot]) [#65932](https://github.com/nodejs/node/pull/65932)
+* \[[`a1649b36bc`](https://github.com/nodejs/node/commit/a1649b36bc)] - **tools**: fix commit queue error summary matching (Filip Skokan) [#65913](https://github.com/nodejs/node/pull/65913)
+* \[[`ff25d0a268`](https://github.com/nodejs/node/commit/ff25d0a268)] - **tools**: lint PR commit messages without approval (Filip Skokan) [#65875](https://github.com/nodejs/node/pull/65875)
+* \[[`ab3c2a81f4`](https://github.com/nodejs/node/commit/ab3c2a81f4)] - **tools**: unlabel author ready on base branch conflicts (Filip Skokan) [#65872](https://github.com/nodejs/node/pull/65872)
+* \[[`c97d09cb4a`](https://github.com/nodejs/node/commit/c97d09cb4a)] - **tools**: apply feedback to and simplify contributor guidance workflow (Filip Skokan) [#65785](https://github.com/nodejs/node/pull/65785)
+* \[[`5410d94903`](https://github.com/nodejs/node/commit/5410d94903)] - **tools**: remove `true` from branch name for auto-update automation (Antoine du Hamel) [#64961](https://github.com/nodejs/node/pull/64961)
+* \[[`7a45a46798`](https://github.com/nodejs/node/commit/7a45a46798)] - **tools**: bump @humanfs/node from 0.16.7 to 0.16.8 in /tools/eslint (dependabot\[bot]) [#65757](https://github.com/nodejs/node/pull/65757)
+* \[[`5df6d29a24`](https://github.com/nodejs/node/commit/5df6d29a24)] - **tools**: bump browserslist from 4.28.4 to 4.28.8 in /tools/eslint (dependabot\[bot]) [#65758](https://github.com/nodejs/node/pull/65758)
+* \[[`8a9f89bdaa`](https://github.com/nodejs/node/commit/8a9f89bdaa)] - **tools**: refine contributor guidance workflow (Filip Skokan) [#65745](https://github.com/nodejs/node/pull/65745)
+* \[[`ed3e9a2583`](https://github.com/nodejs/node/commit/ed3e9a2583)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#65716](https://github.com/nodejs/node/pull/65716)
+* \[[`8d4f0cf264`](https://github.com/nodejs/node/commit/8d4f0cf264)] - **tools**: do not flag force push as invalid message (Antoine du Hamel) [#65700](https://github.com/nodejs/node/pull/65700)
+* \[[`350b3e69bb`](https://github.com/nodejs/node/commit/350b3e69bb)] - **tools**: retry first-time contributor query (Filip Skokan) [#65648](https://github.com/nodejs/node/pull/65648)
+* \[[`fbbfcc499f`](https://github.com/nodejs/node/commit/fbbfcc499f)] - **tools**: query first-time contributor status (Filip Skokan) [#65592](https://github.com/nodejs/node/pull/65592)
+* \[[`b5885fc823`](https://github.com/nodejs/node/commit/b5885fc823)] - **tools**: offset GitHub crons by 3 minutes (Michaël Zasso) [#65612](https://github.com/nodejs/node/pull/65612)
+* \[[`0cdd3171c0`](https://github.com/nodejs/node/commit/0cdd3171c0)] - **tools**: label PRs lacking second approval (Filip Skokan) [#65538](https://github.com/nodejs/node/pull/65538)
+* \[[`5240f00c2e`](https://github.com/nodejs/node/commit/5240f00c2e)] - **tools**: welcome first-time contributors (Filip Skokan) [#65533](https://github.com/nodejs/node/pull/65533)
+* \[[`fbde6050aa`](https://github.com/nodejs/node/commit/fbde6050aa)] - **tools**: enable concurrency for eslint (Huáng Jùnliàng) [#62352](https://github.com/nodejs/node/pull/62352)
+* \[[`ebc028d75d`](https://github.com/nodejs/node/commit/ebc028d75d)] - **trace\_events**: fix abort when Node.js does not own the V8 platform (Shelley Vohr) [#65954](https://github.com/nodejs/node/pull/65954)
+* \[[`55db777a9a`](https://github.com/nodejs/node/commit/55db777a9a)] - **typings**: add task\_queue internal binding types (Seongeun Lee) [#65662](https://github.com/nodejs/node/pull/65662)
+* \[[`ac37bbe109`](https://github.com/nodejs/node/commit/ac37bbe109)] - **typings**: add timeoutInfo to TimersBinding (greenhead) [#65811](https://github.com/nodejs/node/pull/65811)
+* \[[`3d9177b477`](https://github.com/nodejs/node/commit/3d9177b477)] - **typings**: add missing sea binding properties (이혜미) [#65815](https://github.com/nodejs/node/pull/65815)
+* \[[`b23928a1f1`](https://github.com/nodejs/node/commit/b23928a1f1)] - **typings**: add types for performance binding (Jungwon Sohn) [#65574](https://github.com/nodejs/node/pull/65574)
+* \[[`f67ed991a6`](https://github.com/nodejs/node/commit/f67ed991a6)] - **typings**: add encodeIntoResults to EncodingBinding (greenhead) [#65350](https://github.com/nodejs/node/pull/65350)
+* \[[`a1ae3dd285`](https://github.com/nodejs/node/commit/a1ae3dd285)] - **typings**: add typing for permission binding (Seungmin Nam) [#65385](https://github.com/nodejs/node/pull/65385)
+* \[[`fc43781ee8`](https://github.com/nodejs/node/commit/fc43781ee8)] - **typings**: fix fs\_event\_wrap start filename type (leah-1ee) [#65661](https://github.com/nodejs/node/pull/65661)
+* \[[`7e6a56c367`](https://github.com/nodejs/node/commit/7e6a56c367)] - **typings**: add fs\_event\_wrap internal binding types (leah-1ee) [#65661](https://github.com/nodejs/node/pull/65661)
+* \[[`7508db2cf8`](https://github.com/nodejs/node/commit/7508db2cf8)] - **typings**: add stream\_pipe internal binding types (Seongeun Lee) [#65664](https://github.com/nodejs/node/pull/65664)
+* \[[`1957f9a282`](https://github.com/nodejs/node/commit/1957f9a282)] - **typings**: add profiler internal binding types (Seongeun Lee) [#65660](https://github.com/nodejs/node/pull/65660)
+* \[[`62ee9eef22`](https://github.com/nodejs/node/commit/62ee9eef22)] - **typings**: add ffi internal binding types (Donghoon Kang) [#65734](https://github.com/nodejs/node/pull/65734)
+* \[[`6cad9a6f77`](https://github.com/nodejs/node/commit/6cad9a6f77)] - **typings**: update zlib binding declarations (이혜미) [#65639](https://github.com/nodejs/node/pull/65639)
+* \[[`54d77431e6`](https://github.com/nodejs/node/commit/54d77431e6)] - **url**: add Symbol.toStringTag to URLPattern (Khaidi Chu) [#65925](https://github.com/nodejs/node/pull/65925)
+* \[[`6345c6d24f`](https://github.com/nodejs/node/commit/6345c6d24f)] - **url**: align URLPatternInit dictionary conversion with WebIDL (Piyush Yadav) [#65498](https://github.com/nodejs/node/pull/65498)
+* \[[`63b0974d9e`](https://github.com/nodejs/node/commit/63b0974d9e)] - **(SEMVER-MINOR)** **util**: implement util.throttle (James M Snell) [#65899](https://github.com/nodejs/node/pull/65899)
+* \[[`a3bbb5a26f`](https://github.com/nodejs/node/commit/a3bbb5a26f)] - **(SEMVER-MINOR)** **util**: implement debounce (James M Snell) [#65899](https://github.com/nodejs/node/pull/65899)
+* \[[`212f6c6c7b`](https://github.com/nodejs/node/commit/212f6c6c7b)] - **util**: canonicalize namespaced tags in inspect() (René) [#63257](https://github.com/nodejs/node/pull/63257)
+* \[[`b44c072228`](https://github.com/nodejs/node/commit/b44c072228)] - **zlib**: reject invalid zstd dictionaries (James M Snell) [#65867](https://github.com/nodejs/node/pull/65867)
+* \[[`de1074d592`](https://github.com/nodejs/node/commit/de1074d592)] - **zlib**: fix zstd reset (James M Snell) [#65867](https://github.com/nodejs/node/pull/65867)
+* \[[`d7e7308c76`](https://github.com/nodejs/node/commit/d7e7308c76)] - **zlib**: improve zstd decoding across chunk boundaries (James M Snell) [#65865](https://github.com/nodejs/node/pull/65865)
+
 <a id="24.21.0"></a>
 
 ## 2026-09-08, Version 24.21.0 'Krypton' (LTS), @aduh95
diff --git a/doc/contributing/ai-guidelines.md b/doc/contributing/ai-guidelines.md
index baebe5dc6c80..f83c573d6cd1 100644
--- a/doc/contributing/ai-guidelines.md
+++ b/doc/contributing/ai-guidelines.md
@@ -1,35 +1,30 @@
 # AI use policy and guidelines
 
-* [Core principle](#core-principle)
-* [When AI is used in contributions](#when-ai-is-used-in-contributions)
-* [When AI is used in communications](#when-ai-is-used-in-communications)
+* [Node.js AI use policy](#nodejs-ai-use-policy)
+* [Practical guidelines](#practical-guidelines)
+  * [Naming AI tools in disclosures](#naming-ai-tools-in-disclosures)
+  * [When AI is used in code contributions](#when-ai-is-used-in-code-contributions)
+  * [When AI is used in communications](#when-ai-is-used-in-communications)
 
 This document aligns with the [OpenJS Foundation AI Coding Assistants Policy][].
 
-## Core principle
+## Node.js AI use policy
 
-Tools should never replace human judgment, regardless of whether they are
-powered by AI.
+In the Node.js project, decision making should always be based on human judgement
+instead of machine automation, regardless of whether the automation
+is powered by AI. Contributors must take full responsibility for their actions in
+the Node.js project.
 
-Node.js requires contributors to understand and take full responsibility for
-every change they propose. The answer to "Why is X an improvement?" can
-never be "I'm not sure. The AI did it."
+The Node.js project does not prohibit the use of AI tools in contributions, but
+when the contribution is generated with AI, the contributor should disclose the use
+of such tools, and what the contributor does to personally verify the generated output.
+The changes submitted to the Node.js code base must still satisfy
+the project's [Developer's Certificate of Origin][] and licensing requirements.
 
-If AI tools assisted in generating a contribution, acknowledge that honestly.
-Regardless of how much code is generated by AI, disclosure does not serve
-as a disclaimer of responsibility.
-
-Be aware that the mention of for-profit trademarks or commercial brands in
-commit messages, which are part of the code base, can be abused for
-profit-driven marketing. If the disclosure involves for-profit trademarks or
-commercial brands, it's recommended to either anonymize the branding (e.g. say
-`a frontier reasoning model`, `a closed-source coding agent` instead of
-`<brand>`), or only mention the for-profit brand/trademark in the PR
-description, but not in the commit message, unless the message would not have
-made sense without mentioning the specific brand/trademark. These
-recommendations only apply to for-profit tools/models, not any non-profit ones.
-
-Pull requests that contain AI-generated code the contributor has not
+Contributors who choose to submit changes generated with AI must be able to explain
+the value proposition and the implementation of their contributions during the
+review process. Disclosure about the use of AI does not serve as a disclaimer of this
+responsibility. Pull requests with AI-generated code that the contributor has not
 personally understood, tested, and verified waste collaborator time and
 will be subject to closure without additional review. Contributors who
 repeatedly submit such changes, show no understanding of the project or
@@ -42,53 +37,59 @@ approved in advance by the project. To request approval, either open an issue in
 be done in the form of a GitHub workflow, submit a pull request to add the
 workflow and use the usual pull request review process to seek consensus.
 
-## When AI is used in contributions
-
-Contributors may use AI tools to assist with contributions, but such tools
-never replace human judgment.
-
-When using AI as a coding assistant:
-
-* **Understand the codebase first.** Do not skip familiarizing yourself with
-  the relevant subsystem. Always verify analysis generated by tools against
-  the actual source code with human judgement.
+It's prohibited to use AI to automate fixes to issues marked as "good first issue".
+These issues are meant to help new human contributors, not an AI, learn about the
+code base and the contribution processes.
 
-* **Own every line you submit.** You are responsible for all code in your
-  pull request, regardless of how it was created. The submitted changes
-  must satisfy the project's [Developer's Certificate of Origin][] and licensing
-  requirements. Be prepared to explain any change in detail during review.
+## Practical guidelines
 
-* **Keep the commits logical.** The [commit message guidelines][]
-  and [commit squashing guidelines](./pull-requests.md#commit-squashing)
-  must be followed regardless of what tool is used in the pull request.
+### Naming AI tools in disclosures
 
-* **Test thoroughly.** Existing tests should not be removed or modified
-  without human verification. It is crucial to verify, with human judgement,
-  the correctness of new tests against the intended behavior of the feature
-  being tested, independently of how the implementation happens to behave.
-
-* **Do not disappear.** If you open a PR, follow it through. Respond to
-  feedback and iterate until the work lands or is explicitly closed. If you
-  can no longer pursue it, close the PR. Stalled PRs block progress.
-
-* **Do not use AI to claim "good first issue" tasks.** These issues exist to
-  help new contributors learn the codebase and processes hands-on.
-
-* **Keep the comments useful.** Verify with human judgement that the
-  comments are necessary and accurate. Remove comments that simply
-  restate what the code does. Add comments only where the logic is non-obvious.
-
-## When AI is used in communications
+Be aware that the mention of for-profit trademarks or commercial brands in
+commit messages, which are part of the code base, can be abused for
+profit-driven marketing. If the disclosure involves for-profit trademarks or
+commercial brands, it's recommended to either anonymize the branding (e.g. say
+`a frontier reasoning model`, `a closed-source coding agent` instead of
+`<brand>`), or only mention the for-profit brand/trademark in the PR
+description, but not in the commit message, unless the message would not have
+made sense without mentioning the specific brand/trademark. These
+recommendations only apply to for-profit tools/models, not any non-profit ones.
 
-Node.js values concise, precise communication that respects collaborator and
-contributor time.
+### When AI is used in code contributions
+
+* Contributors should treat the analysis generated by AI tools as a hypothesis
+  instead of a fact, and verify the output against the actual source code before
+  making any decisions.
+* Commits must still follow the [commit message guidelines][] and
+  [commit squashing guidelines](./pull-requests.md#commit-squashing),
+  even if they are organized with the help of AI tools.
+* Existing tests should not be removed or modified without human verification.
+  When new tests are added with the help of AI, contributors should personally
+  verify that the new tests are necessary and test the intended behavior
+  instead of merely reflecting how the implementation happens to behave.
+* If the comments are generated by AI, contributors should personally verify
+  that the comments are accurate. The comments should not restate what the code
+  does but instead should provide additional context that's not obvious from the code
+  itself, such as the history or motivation behind the choices.
+* During the review process, responses to feedback should be made by contributors
+  based on their own judgement and must not be automated by AI tools. Contributors
+  are expected to iterate in this manner until the work lands or is explicitly closed.
+  If they are unable to follow the review process personally, they should close
+  the PR so that someone else can take over the work.
+
+### When AI is used in communications
+
+In the Node.js project, if a contributor chooses to use AI for assistance in communications, they
+should respect the time spent by other contributors reading and responding to their
+communication, and avoid increasing the cognitive load of others with their own use of AI.
 
 * **Do not paste messages generated entirely by AI** in pull requests, issues,
   or the project's communication channels. Such communication may be removed in
-  accordance to [the Node.js moderation policy][].
-* **Verify claims about the code with human judgement before using them in
-  communications**. Results from AI tools should only be treated as hypothesis.
-  Link to actual code, documentation and specifications as source of truth.
+  accordance with [the Node.js moderation policy][].
+* When making a claim based on AI output in discussions, contributors should
+  personally verify the claim. Contributors are expected to provide a link
+  to actual code, documentation or specifications, instead of an AI summary of
+  them, as source of truth during discussions.
 * Grammar and spell-check tools are acceptable when they improve clarity and
   conciseness.
 
diff --git a/doc/contributing/collaborator-guide.md b/doc/contributing/collaborator-guide.md
index b81a86bd86c0..49ece70c2bb0 100644
--- a/doc/contributing/collaborator-guide.md
+++ b/doc/contributing/collaborator-guide.md
@@ -5,8 +5,10 @@
 * [Issues and pull requests](#issues-and-pull-requests)
   * [Welcoming first-time contributors](#welcoming-first-time-contributors)
   * [Closing issues and pull requests](#closing-issues-and-pull-requests)
+  * [Stale issues and pull requests](#stale-issues-and-pull-requests)
   * [Author ready pull requests](#author-ready-pull-requests)
   * [Handling own pull requests](#handling-own-pull-requests)
+  * [Repository triage views](#repository-triage-views)
   * [Security issues](#managing-security-issues)
 * [Accepting modifications](#accepting-modifications)
   * [Code reviews](#code-reviews)
@@ -66,6 +68,18 @@ request open for several days to allow for discussion. Where this does not yield
 evidence that the issue or pull request has relevance, close it. Remember that
 issues and pull requests can always be re-opened if necessary.
 
+### Stale issues and pull requests
+
+The [stale workflow](../../.github/workflows/stale.yml) runs on all open issues
+and pull requests. It adds the `stale` label after 90 days without activity and
+closes the item after another 30 days without activity. New activity removes
+the `stale` label automatically.
+
+The `never-stale` label exempts both issues and pull requests from this
+automation. The `confirmed-bug` label also exempts issues. Reserve
+`never-stale` for items that need a permanent exemption. Otherwise, leave an
+update when an item remains relevant or close it when it does not.
+
 ### Author ready pull requests
 
 A pull request is _author ready_ when:
@@ -73,10 +87,16 @@ A pull request is _author ready_ when:
 * There is a CI run in progress or completed.
 * There is at least one collaborator approval.
 * There are no outstanding review comments.
+* There are no conflicts with the base branch.
 
 Please always add the `author ready` label to the pull request in that case.
 Please always remove it again as soon as the conditions are not met anymore.
 
+When approving a pull request that qualifies, add `author ready` and, if a
+Jenkins CI run is required but has not started, `request-ci`. When the pull
+request author is not a collaborator, it is helpful to follow the CI run through
+completion and add `commit-queue` after the required CI is green.
+
 ### Handling own pull requests
 
 When you open a pull request, [start a CI](#testing-and-ci) right away. Later,
@@ -88,6 +108,28 @@ to land but is [author ready](#author-ready-pull-requests), add the
 `author ready` label. If you wish to land the pull request yourself, use the
 "assign yourself" link to self-assign it.
 
+### Repository triage views
+
+The repository has several pinned
+[triage views](https://github.com/nodejs/node/issues/views) for managing pull
+requests:
+
+* [PR action queue](https://github.com/nodejs/node/issues/views/15196):
+  Non-stale, human-authored pull requests labeled `author ready` or
+  `review wanted` that are not yet in the commit queue.
+* [PR attention queue](https://github.com/nodejs/node/issues/views/15058):
+  Non-stale pull requests awaiting a second approval, requesting fast-track, or
+  addressing flaky tests.
+* [Bot PRs queue](https://github.com/nodejs/node/issues/views/15198): Open,
+  non-stale Node.js GitHub Bot and Dependabot pull requests that are not yet in
+  the commit queue.
+* [My Active PRs](https://github.com/nodejs/node/issues/views/15142): Open pull
+  requests authored by the signed-in viewer that are not yet in the commit
+  queue.
+
+Keep `author ready`, `review wanted`, `commit-queue`, and `stale` accurate so
+these views remain useful.
+
 ### Managing security issues
 
 Use the process outlined in [SECURITY.md][] to report security
@@ -210,15 +252,18 @@ delay. For example:
   * Regressions that break the workflow (red CI or broken compilation).
   * Regressions that happen right before a release, or reported soon after.
 
-To propose fast-tracking a pull request, apply the `fast-track` label. Then a
-GitHub Actions workflow will add a comment that collaborators can upvote.
+To propose fast-tracking a pull request, apply the `fast-track` label. A GitHub
+Actions workflow then adds a comment. Collaborators approve the fast-track
+request by adding a 👍 reaction to that comment. Reactions elsewhere on the pull
+request do not count.
 
 If someone disagrees with the fast-tracking request, remove the label. Do not
 fast-track the pull request in that case.
 
 The pull request can be fast-tracked if two collaborators approve the
-fast-tracking request. To land, the pull request itself still needs two
-collaborator approvals and a passing CI.
+fast-tracking request. Fast-track approval is additional to code-review
+approval, not a replacement for it. To land, the pull request itself still
+needs two collaborator approvals and a passing CI.
 
 Collaborators can request fast-tracking of pull requests they did not author.
 In that case only, the request itself is also one fast-track approval. Upvote
@@ -235,6 +280,13 @@ yellow) [Jenkins CI](https://ci.nodejs.org/) is also required if the pull
 request contains changes that will affect the `node` binary. This is because
 GitHub Actions CI does not cover all the environments supported by Node.js.
 
+The `needs-ci` label identifies pull requests that require a full Jenkins CI
+run. It is a classification, not an indication that CI is still pending. Leave
+it in place after CI completes. Removing it does not waive the underlying CI
+requirement or make a pull request eligible to land without the required
+checks. Removing it also makes it harder for releasers to identify the scope of
+a change when working on a release proposal.
+
 <details>
 <summary>Changes that affect the `node` binary</summary>
 
@@ -439,6 +491,10 @@ generated commit message will not have a subsystem and might violate line length
 rules. That is OK. Append the reason for the revert and any `Refs` or `Fixes`
 metadata. Raise a pull request like any other change.
 
+Apply `dont-land-on-v?.x` labels to the revert pull request and to its
+corresponding original pull request,
+unless the original pull request has already been backported.
+
 ### Introducing new modules
 
 Treat commits that introduce new core modules with extra care.
@@ -940,20 +996,29 @@ If you cannot find who to cc for a file, `git shortlog -n -s <file>` can help.
 ### General labels
 
 * `confirmed-bug`: Bugs you have verified
+* `commit-queue`: Pull requests queued for automated landing. See the
+  [commit queue guide][commit-queue.md]
 * `discuss`: Things that need larger discussion
 * `fast-track`: PRs that need to land faster - see
   [Waiting for approvals](#waiting-for-approvals)
 * `feature request`: Any issue that requests a new feature
 * `good first issue`: Issues suitable for newcomers to fix
+* `lacks-second-approval`: An automatically managed label for queued pull
+  requests awaiting another approval or completion of the required wait
 * `meta`: Governance, policies, procedures, etc.
+* `needs-ci`: Pull requests that require a full Jenkins CI run. See
+  [Testing and CI](#testing-and-ci)
+* `never-stale`: Issues and pull requests exempt from automatic stale handling
 * `request-ci`: When this label is added to a PR, CI will be started
   automatically. See [Starting a Jenkins CI job](#starting-a-jenkins-ci-job)
+* `stale`: Issues and pull requests with no activity for 90 days. See
+  [Stale issues and pull requests](#stale-issues-and-pull-requests)
 * `tsc-agenda`: Open issues and pull requests with this label will be added to
   the Technical Steering Committee meeting agenda
 
 ***
 
-* `author-ready` - A pull request is _author ready_ when:
+* `author ready` - A pull request is _author ready_ when:
   * There is a CI run in progress or completed.
   * There is at least one collaborator approval (or two TSC approvals for
     semver-major pull requests).
diff --git a/doc/contributing/commit-queue.md b/doc/contributing/commit-queue.md
index e9669bf33183..43fd52f59709 100644
--- a/doc/contributing/commit-queue.md
+++ b/doc/contributing/commit-queue.md
@@ -3,13 +3,29 @@
 _tl;dr: You can ask the queue to land pull requests by adding the
 `commit-queue` label to them._
 
-Commit Queue is a feature for the project which simplifies the
-landing process by automating it via GitHub Actions. With it, collaborators can
-queue pull requests for landing by adding the `commit-queue` label to a PR. The
-selector checks readiness with `@node-core/utils`. If the pull request is only
-blocked on a deferrable condition, currently wait time, the queue leaves the
-label in place and retries later. Other failures continue to the existing
-landing and failure-reporting path.
+Commit Queue simplifies the landing process by automating it with GitHub
+Actions. Once a pull request is [author ready][] and its current CI has passed, a
+collaborator can queue it for landing by adding the `commit-queue` label. A
+second approval is not required before adding the label.
+
+The queue checks readiness with `@node-core/utils`, including the required wait
+time measured from when the pull request was opened:
+
+* Pull requests with at least two approvals must be open for 48 hours.
+* Pull requests with one approval must be open for seven days.
+* Correctly approved [fast-track pull requests][] have no minimum wait time.
+
+If wait time is the only unmet condition, the queue leaves the `commit-queue`
+label in place and retries later. For queued pull requests that are at least two
+days old and still waiting for a second approval, it also adds the
+`lacks-second-approval` label. Another approval makes the pull request eligible
+for the next queue run, provided that all other requirements remain satisfied.
+The queue removes `lacks-second-approval` automatically when it removes
+`commit-queue`; collaborators do not need to remove it manually.
+
+Hard failures remove `commit-queue`, add `commit-queue-failed`, and post a
+comment with the actionable failure reason and retry instructions. To resolve the
+failure, remove `commit-queue-failed`, and add `commit-queue` to retry.
 
 To make the Commit Queue squash all the commits of a pull request into the
 first one, add the `commit-queue-squash` label.
@@ -32,3 +48,6 @@ These are the currently known limitations of the commit queue:
 4. Only Jenkins CI and GitHub Actions are checked (V8 CI and CITGM are ignored).
 5. The PR must target the `main` branch (PRs opened against other branches, such
    as backport PRs, are ignored).
+
+[author ready]: ./collaborator-guide.md#author-ready-pull-requests
+[fast-track pull requests]: ./collaborator-guide.md#waiting-for-approvals
diff --git a/doc/contributing/first-contributions.md b/doc/contributing/first-contributions.md
index b3c539101073..174fb38d0585 100644
--- a/doc/contributing/first-contributions.md
+++ b/doc/contributing/first-contributions.md
@@ -146,8 +146,10 @@ for the technical how-tos. After a rebase, you will need a new approval from the
 Node.js uses two CI systems: [Jenkins](https://ci.nodejs.org/) and GitHub Actions. Jenkins is the primary
 CI system for testing pull requests, while GitHub Actions is used for quick checks and additional
 verifications. Pull requests that only touch documentation need to pass only the GitHub Actions
-checks. Pull requests that touch more than just documentation will be labeled `needs-ci` and will need
-to run the Jenkins CI before they can be merged.
+checks. Pull requests that affect the `node` binary also need to pass Jenkins CI before they can be
+merged. The automation determines this requirement from the changed files and may add the `needs-ci`
+label. The label describes the kind of CI required; it does not indicate that CI is still pending and
+remains applicable after a successful run. Removing it does not waive the CI requirement.
 
 ### Q: How do I trigger the CI runs?
 
@@ -194,9 +196,12 @@ for more details on how to get started.
 ### Q: My pull request has enough approvals and passed CI, but it still hasn't been merged. What should I do?
 
 Pull requests need to be merged by collaborators or triagers (normally by applying the `commit-queue`
-label). The [commit queue automation](../../.github/workflows/commit-queue.yml)
-will verify that the pull request meets all the requirements before merging it, but the
-triggering of the commit queue still requires human judgement and depends on volunteers.
+label). Once a pull request is author ready and its current CI has passed, a collaborator can add it
+to the queue without waiting for a second approval. The
+[commit queue automation](../../.github/workflows/commit-queue.yml) verifies the requirements and
+waits until the pull request has either two approvals and has been open for 48 hours, or one approval
+and has been open for seven days. Triggering the commit queue still requires human judgement and
+depends on volunteers.
 You can ask for help either in the pull request or in the Slack channel similar
 to how you ask for help to get reviews and trigger CI runs.
 
diff --git a/doc/contributing/maintaining/maintaining-dependencies.md b/doc/contributing/maintaining/maintaining-dependencies.md
index 77dbb7b351f7..c2cdb379173b 100644
--- a/doc/contributing/maintaining/maintaining-dependencies.md
+++ b/doc/contributing/maintaining/maintaining-dependencies.md
@@ -11,7 +11,6 @@ This a list of all the dependencies:
 * [acorn][]
 * [ada][]
 * [amaro][]
-* [base64][]
 * [brotli][]
 * [c-ares][]
 * [merve][]
@@ -265,7 +264,7 @@ C++ testing and mocking framework.
 The [histogram](https://github.com/HdrHistogram/HdrHistogram_c) dependency is
 a C port of High Dynamic Range (HDR) Histogram.
 
-### ic
+### icu-small
 
 The [icu](http://site.icu-project.org) is widely used set of C/C++
 and Java libraries providing Unicode and Globalization
@@ -403,7 +402,6 @@ according to [RFC 8878](https://datatracker.ietf.org/doc/html/rfc8878).
 [acorn]: #acorn
 [ada]: #ada
 [amaro]: #amaro
-[base64]: #base64
 [brotli]: #brotli
 [c-ares]: #c-ares
 [corepack]: #corepack
diff --git a/doc/contributing/offboarding.md b/doc/contributing/offboarding.md
index f9d8140b54b4..8f431b5e9a60 100644
--- a/doc/contributing/offboarding.md
+++ b/doc/contributing/offboarding.md
@@ -22,4 +22,8 @@ emeritus or leaves the project.
   the collaborator be removed from the Node.js coverity project if they had
   access.
 
+An emeritus collaborator may later ask the TSC to restore them to active status.
+See [Restoring emeritus Collaborators][].
+
+[Restoring emeritus Collaborators]: https://github.com/nodejs/node/blob/HEAD/GOVERNANCE.md#restoring-emeritus-collaborators
 [`@nodejs/collaborators`]: https://github.com/orgs/nodejs/teams/collaborators/members
diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md
index abdf8c20cfeb..4ff4fc17913e 100644
--- a/doc/contributing/releases.md
+++ b/doc/contributing/releases.md
@@ -447,7 +447,7 @@ Collect a formatted list of commits since the last release. Use
 [`changelog-maker`](https://github.com/nodejs/changelog-maker) to do this:
 
 ```bash
-changelog-maker --group --markdown
+changelog-maker --group --format=markdown
 ```
 
 `changelog-maker` counts commits since the last tag and if the last tag
@@ -455,7 +455,7 @@ in the repository was not on the current branch you may have to supply a
 `--start-ref` argument:
 
 ```bash
-changelog-maker --group --markdown --filter-release --start-ref v1.2.2
+changelog-maker --group --format=markdown --filter-release --start-ref v1.2.2
 ```
 
 `--filter-release` will remove the release commit from the previous release.
diff --git a/doc/contributing/strategic-initiatives.md b/doc/contributing/strategic-initiatives.md
index a7ee78f42aae..ce68d17d8909 100644
--- a/doc/contributing/strategic-initiatives.md
+++ b/doc/contributing/strategic-initiatives.md
@@ -11,6 +11,7 @@ agenda to ensure they are active and have the support they need.
 | QUIC / HTTP3           | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Unified HTTP API       | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Shadow Realm           | [Chengzhong Wu][legendecas]      | <https://github.com/nodejs/node/issues/42528> |
+| V8 Currency            | [Joyee Cheung][joyeecheung]      |                                               |
 | Next-10                | [Jacob Smith][JakobJingleheimer] | <https://github.com/nodejs/next-10>           |
 | Single executable apps | [Darshan Sen][RaisinTen]         | <https://github.com/nodejs/single-executable> |
 | Performance            | [Rafael Gonzaga][RafaelGSS]      | <https://github.com/nodejs/performance>       |
diff --git a/doc/contributing/writing-and-running-benchmarks.md b/doc/contributing/writing-and-running-benchmarks.md
index b1b7cc95fa65..9de63bb46adc 100644
--- a/doc/contributing/writing-and-running-benchmarks.md
+++ b/doc/contributing/writing-and-running-benchmarks.md
@@ -411,6 +411,8 @@ module, you can use the `--filter` option:_
   --set      variable=value     set benchmark variable (can be repeated)
   --no-progress                 don't show benchmark progress indicator
   --analyze                     perform statistical analysis inline (no R needed)
+  --csv      filename           write csv output to filename (can be combined
+                                with --analyze)
   --scale    1000               rate multiplier for --analyze precision
   --max-regression  N           exit with code 1 if any significant regression
                                 exceeds N% (implies --analyze)
@@ -424,6 +426,14 @@ The simplest way to get statistical results is to pass `--analyze`:
 node benchmark/compare.js --old ./node-main --new ./node-pr-5134 --analyze string_decoder
 ```
 
+Use `--csv` to retain the raw benchmark results. If you pass both `--csv` and
+`--analyze`, both the raw results and the analysis are printed:
+
+```bash
+node benchmark/compare.js --old ./node-main --new ./node-pr-5134 \
+  --analyze --csv compare-pr-5134.csv string_decoder
+```
+
 This runs the benchmarks and prints the analysis directly:
 
 ```console
@@ -433,6 +443,13 @@ string_decoder/string-decoder.js n=2500000 chunkLen=16 inLen=128 encoding='utf8'
 ...
 ```
 
+Use `-csv -` to output the raw results to stdout with the analysis.
+
+```bash
+node benchmark/compare.js --old ./node-main --new ./node-pr-5134 \
+  --analyze --csv - string_decoder
+```
+
 The `--analyze` mode uses the histogram API's `welchTest()` method to perform
 the same Welch's t-test that the R script uses. Benchmark rates are scaled to
 integers for the histogram (controlled by `--scale`, default 1000). With the
@@ -517,6 +534,124 @@ run `node benchmark/scatter.js`.
 node benchmark/scatter.js benchmark/string_decoder/string-decoder.js > scatter.csv
 ```
 
+#### Analyzing the results without R
+
+Pass `--analyze` to summarize the results directly, without generating a csv
+or installing R. It needs `--xaxis` to know which benchmark variable to
+summarize against, and takes an optional `--category` to break each point
+down by a second variable. Any remaining variable that is not constant is
+averaged over, and reported as an aggregated variable.
+
+```bash
+node benchmark/scatter.js --analyze --xaxis chunkLen --category encoding \
+    benchmark/string_decoder/string-decoder.js
+```
+
+```console
+chunkLen  encoding   samples          rate  confidence.interval        median    median.interval
+      16  'ascii'          6   2,248,111.0    61,570.3 (±2.74%)   2,241,996.7   [-3.75%, +4.47%]
+      16  'utf16le'        6   2,004,145.9    33,363.7 (±1.66%)   1,990,015.9   [-1.03%, +3.44%]
+      16  'utf8'           6   1,156,990.9    84,288.2 (±7.29%)   1,186,284.7  [-16.23%, +1.15%]  (!)
+     256  'ascii'          6  11,271,912.4   398,786.9 (±3.54%)  10,991,001.5   [-0.47%, +7.61%]
+     256  'utf16le'        6  10,243,336.8   792,495.2 (±7.74%)   9,908,838.3  [-4.73%, +17.25%]  (!)
+     256  'utf8'           6   8,247,482.7   316,510.5 (±3.84%)   8,282,009.5   [-5.80%, +3.19%]
+    1024  'ascii'          6  11,130,650.9   438,019.6 (±3.94%)  10,838,937.5   [-1.34%, +7.10%]
+    1024  'utf16le'        6   9,786,274.4   186,207.1 (±1.90%)   9,690,675.1   [-0.77%, +4.20%]
+    1024  'utf8'           6   8,479,690.1   405,762.8 (±4.79%)   8,525,516.7   [-9.01%, +4.06%]  (!)
+
+Rate in operations/second; longer is faster. │ marks the mean and the
+shaded band (░) is its 95% confidence interval, so bars whose bands
+overlap are not clearly different.
+
+                                  0                           11,670,699.3
+                                  +--------------------------------------+
+chunkLen=16 encoding='ascii'      ███████│                                   2,248,111.0
+chunkLen=16 encoding='utf16le'    ██████│                                    2,004,145.9
+chunkLen=16 encoding='utf8'       ███│                                       1,156,990.9
+
+chunkLen=256 encoding='ascii'     █████████████████████████████████████░│░  11,271,912.4
+chunkLen=256 encoding='utf16le'   ████████████████████████████████░░░│░░    10,243,336.8
+chunkLen=256 encoding='utf8'      ███████████████████████████░│              8,247,482.7
+
+chunkLen=1024 encoding='ascii'    █████████████████████████████████████░│░  11,130,650.9
+chunkLen=1024 encoding='utf16le'  █████████████████████████████████│         9,786,274.4
+chunkLen=1024 encoding='utf8'     ████████████████████████████░│             8,479,690.1
+
+Change between consecutive chunkLen values (Mann-Whitney U, Cliff's delta):
+
+  encoding='ascii'
+    16 -> 256    +401.39%  16.0x  exponent=+0.58  p=0.0039  delta=+1.000 (large)
+    256 -> 1024    -1.25%   4.0x  exponent=-0.01  p=0.3367  delta=-0.333 (medium)
+
+  encoding='utf16le'
+    16 -> 256    +411.11%  16.0x  exponent=+0.59  p=0.0039  delta=+1.000 (large)
+    256 -> 1024    -4.46%   4.0x  exponent=-0.03  p=0.1495  delta=-0.500 (large)
+
+  encoding='utf8'
+    16 -> 256    +612.84%  16.0x  exponent=+0.71  p=0.0039  delta=+1.000 (large)
+    256 -> 1024    +2.82%   4.0x  exponent=+0.02  p=0.2002  delta=+0.444 (medium)
+```
+
+The table gives, for each group, the mean rate with the 95% confidence
+interval of the mean, and the median with the 95% confidence interval of the
+median. The median interval is computed with the exact binomial method, which
+assumes nothing about the shape of the distribution, so it is the more
+trustworthy of the two when a benchmark is noisy.
+
+Rows marked `(!)` are exactly those cases: the median falls outside the mean's
+confidence interval, or the sample is strongly skewed. The mean is then being
+pulled by a few unusually slow or fast runs — commonly GC or JIT tiering — and
+more `--runs` will not necessarily fix it.
+
+The final section answers the question the sweep is usually asked to settle:
+whether the parameter changes the rate at all. It compares each x-axis value
+with the previous one using a [Mann-Whitney U test][] and [Cliff's delta][],
+holding the category fixed. Both are non-parametric, because a parameter sweep
+routinely changes the shape and spread of the distribution and not just its
+centre. Above, going from `chunkLen=16` to `256` is a large, unambiguous win
+for every encoding, while `256` to `1024` is negligible — the benchmark has
+already plateaued.
+
+When the x-axis is numeric, each comparison also reports how far the parameter
+moved and the resulting scaling exponent, which is the complexity question
+these sweeps are usually run to answer. Above, a 16× larger chunk yields an
+exponent near `+0.6` (strongly sublinear), and the next 4× yields `-0.01`
+(saturated). The exponent is reported per step rather than as a single fit
+across the whole sweep, because one exponent spanning a curve that changes
+regime describes neither part of it.
+
+A p-value has to be read against what the test was capable of producing. Below
+roughly six runs per group, the smallest p-value the Mann-Whitney test can
+return rises above the usual thresholds — at `--runs 2` the floor is `0.1213`,
+so no comparison can reach significance no matter how large the real effect
+is. `scatter.js` computes that floor and warns when a non-significant result
+therefore carries no information.
+
+Aggregated variables are reported with the share of within-group variance they
+account for. This matters more than it sounds: running the example above
+without `--set inLen=128` reports
+
+```console
+aggregating variable: inLen (explains >99% of within-group variance)
+
+Note: inLen explains most of the spread within each group, so the intervals
+below describe that variable rather than the benchmark's own noise, and more
+--runs will not narrow them. Pin it with --set inLen=<value>, or pass as
+--category, for intervals that can be acted on.
+```
+
+and the confidence intervals widen from around ±3% to over ±50%. That spread
+is a genuine effect of the averaged-over variable, not sampling noise, so
+increasing `--runs` cannot reduce it.
+
+Long or non-printable variable values are abbreviated in the output and listed
+in full under `Abbreviated values:` at the end.
+
+Pass `--no-chart` to omit the bar chart, and `--no-progress` to suppress the
+progress indicator.
+
+#### Analyzing the results with R
+
 After generating the csv, a comparison table can be created using the
 `scatter.R` tool. Even more useful it creates an actual scatter plot when using
 the `--plot filename` option.
@@ -557,7 +692,7 @@ afterwards using tools such as `sed` or `grep`. In the `sed` case be
 sure to keep the first line since that contains the header information.
 
 ```console
-$ cat scatter.csv | sed -E '1p;/([^,]+, ){3}128,/!d' | Rscript benchmark/scatter.R --xaxis chunkLen --category encoding --plot scatter-plot.png --log
+$ cat scatter.csv | sed -E '1p;/([^,]+,){3}128,/!d' | Rscript benchmark/scatter.R --xaxis chunkLen --category encoding --plot scatter-plot.png --log
 
 chunkLen     encoding      rate confidence.interval
       16        ascii 1302078.5            71692.27
@@ -764,6 +899,8 @@ Supported options keys are:
 * `benchmarker` - benchmarker to use, defaults to the first available http
   benchmarker
 
+[Cliff's delta]: https://en.wikipedia.org/wiki/Effect_size#Effect_size_for_ordinal_data
+[Mann-Whitney U test]: https://en.wikipedia.org/wiki/Mann%E2%80%93Whitney_U_test
 [autocannon]: https://github.com/mcollina/autocannon
 [benchmark-ci]: https://github.com/nodejs/benchmarking/blob/HEAD/docs/core_benchmarks.md
 [git-for-windows]: https://git-scm.com/download/win
diff --git a/doc/node.1 b/doc/node.1
index 39909107b56c..c6a18d87a116 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -163,6 +163,12 @@ Enable FIPS mode at startup. With OpenSSL 3, a configured provider named
 \fBfips\fR must be available and initialize successfully. With OpenSSL 1.1.1,
 Node.js must be built against a FIPS-capable OpenSSL.
 .
+.It Fl -enable-fips-indicator-events
+Publish OpenSSL FIPS indicator results to the
+\fB'crypto.fips.indicator'\fR diagnostics channel. This option requires OpenSSL
+3.4 or later. It does not enable FIPS mode or change whether an operation
+is permitted.
+.
 .It Fl -enable-source-maps
 Enable Source Map V3 support for stack traces.
 .
@@ -321,9 +327,23 @@ Enable experimental support for storage inspection.
 .It Fl -force-context-aware
 Disable loading native addons that are not context-aware.
 .
-.It Fl -force-fips
+.It Fl -force-fips Ns = Ns Ar [mode]
 Enable FIPS mode at startup and prevent it from being disabled from script
 code. The same OpenSSL requirements as \fB--enable-fips\fR apply.
+An optional mode can be specified using \fB--force-fips=mode\fR:
+.Bl -bullet
+.It
+\fBprovider\fR: Preserve the OpenSSL FIPS provider's configured handling of
+non-approved operations. This is the current default when the mode is
+omitted.
+.It
+\fBstrict\fR: Reject non-approved operations reported through the OpenSSL FIPS
+indicator callback. This mode requires OpenSSL 3.4 or later.
+.El
+The \fBstrict\fR mode only covers operations reported through the callback for
+OpenSSL's default library context. It does not cover native addons that use
+another \fBOSSL_LIB_CTX\fR or another copy of \fBlibcrypto\fR, nor operation-specific
+indicators that do not invoke the callback.
 .
 .It Fl -frozen-intrinsics
 Enable experimental frozen intrinsics support.
diff --git a/lib/_http_client.js b/lib/_http_client.js
index a2326d8d7b05..6283559fcf3e 100644
--- a/lib/_http_client.js
+++ b/lib/_http_client.js
@@ -691,6 +691,14 @@ ClientRequest.prototype.destroy = function destroy(err) {
     this.res._dump();
   }
 
+  // Nothing left to cancel: the request was fully sent and the response was
+  // fully received. Destroying the socket here would emit an error on a
+  // socket that is already being released to the agent, at which point
+  // socketErrorListener has been removed and nothing would handle it.
+  if (this.writableFinished && this.res?.complete) {
+    return this;
+  }
+
   this[kError] = err;
   this.socket?.destroy(err);
 
diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
index ef149e3d4a61..13ff5b6b30fc 100644
--- a/lib/_http_incoming.js
+++ b/lib/_http_incoming.js
@@ -292,6 +292,13 @@ IncomingMessage.prototype._destroy = function _destroy(err, cb) {
       cleanup();
       process.nextTick(onError, this, e || err, cb);
     });
+  } else if (err == null && !this.aborted) {
+    // The message was received completely and is being destroyed cleanly:
+    // complete the destroy synchronously. 'close' is still emitted on a
+    // later tick by the stream machinery. The deferral below only exists
+    // so that 'error' listeners attached right after destroy(err) still
+    // receive the error, which cannot matter when there is no error.
+    cb();
   } else {
     process.nextTick(onError, this, err, cb);
   }
@@ -505,7 +512,14 @@ IncomingMessage.prototype._dump = function _dump() {
     // If there is buffered data, it may trigger 'data' events.
     // Remove 'data' event listeners explicitly.
     this.removeAllListeners('data');
-    this.resume();
+    if (this.complete && !this.destroyed && this.readableLength === 0) {
+      // The message was fully received and never read: there is nothing to
+      // pull off the wire. Go straight to the 'end' emission instead of
+      // paying for the resume() and flow() scheduling machinery.
+      this.read(0);
+    } else {
+      this.resume();
+    }
   }
 };
 
diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
index 23e2856e0b99..4edfc8d7af3d 100644
--- a/lib/_http_outgoing.js
+++ b/lib/_http_outgoing.js
@@ -67,6 +67,7 @@ const {
     ERR_STREAM_DESTROYED,
     ERR_STREAM_NULL_VALUES,
     ERR_STREAM_WRITE_AFTER_END,
+    ERR_UNKNOWN_ENCODING,
   },
   hideStackFrames,
 } = require('internal/errors');
@@ -223,7 +224,12 @@ ObjectDefineProperty(OutgoingMessage.prototype, 'writableObjectMode', {
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableLength', {
   __proto__: null,
   get() {
-    return this.outputSize + this[kChunkedLength] + (this[kSocket] ? this[kSocket].writableLength : 0);
+    let bufferedLength = this[kChunkedLength];
+    if (bufferedLength !== 0) {
+      bufferedLength += bufferedLength.toString(16).length + 4 +
+        (!this._headerSent && this._header !== null ? this._header.length : 0);
+    }
+    return this.outputSize + bufferedLength + (this[kSocket] ? this[kSocket].writableLength : 0);
   },
 });
 
@@ -294,37 +300,45 @@ OutgoingMessage.prototype.cork = function cork() {
 
 OutgoingMessage.prototype.uncork = function uncork() {
   this[kCorked]--;
-  if (this[kSocket]) {
-    this[kSocket].uncork();
-  }
-
-  if (this[kCorked] || this[kChunkedBuffer].length === 0) {
-    return;
-  }
-
-  const len = this[kChunkedLength];
-  const buf = this[kChunkedBuffer];
+  const socket = this[kSocket];
+  try {
+    if (this[kCorked] || this[kChunkedBuffer].length === 0) {
+      return;
+    }
 
-  assert(this.chunkedEncoding);
+    const len = this[kChunkedLength];
+    const buf = this[kChunkedBuffer];
+    if (this.destroyed || socket?.destroyed) {
+      const error = this[kErrored] || socket?._writableState?.errored || new ERR_STREAM_DESTROYED('write');
+      for (let n = 2; n < buf.length; n += 3) {
+        if (buf[n] !== nop) {
+          process.nextTick(buf[n], error);
+        }
+      }
+      buf.length = 0;
+      this[kChunkedLength] = 0;
+      return;
+    }
+    assert(this.chunkedEncoding);
 
-  let callbacks;
-  this._send(len.toString(16), 'latin1', null);
-  this._send(crlf_buf, null, null);
-  for (let n = 0; n < buf.length; n += 3) {
-    this._send(buf[n + 0], buf[n + 1], null);
-    if (buf[n + 2]) {
-      callbacks ??= [];
+    const callbacks = [];
+    this._send(len.toString(16), 'latin1', null);
+    this._send(crlf_buf, null, null);
+    for (let n = 0; n < buf.length; n += 3) {
+      this._send(buf[n + 0], buf[n + 1], null);
       callbacks.push(buf[n + 2]);
     }
-  }
-  this._send(crlf_buf, null, callbacks.length ? (err) => {
-    for (const callback of callbacks) {
-      callback(err);
-    }
-  } : null);
+    this._send(crlf_buf, null, (err) => {
+      for (const callback of callbacks) {
+        callback(err);
+      }
+    });
 
-  this[kChunkedBuffer].length = 0;
-  this[kChunkedLength] = 0;
+    this[kChunkedBuffer].length = 0;
+    this[kChunkedLength] = 0;
+  } finally {
+    socket?.uncork();
+  }
 
   // If we had a pending drain and flushed all data, emit the drain event.
   if (this[kNeedDrain] && this.writableLength === 0) {
@@ -360,6 +374,10 @@ OutgoingMessage.prototype.destroy = function destroy(error) {
   this.destroyed = true;
 
   this[kErrored] = error;
+  if (this[kChunkedBuffer].length !== 0) {
+    this[kCorked] = 1;
+    this.uncork();
+  }
 
   if (this[kSocket]) {
     this[kSocket].destroy(error);
@@ -999,24 +1017,34 @@ function write_(msg, chunk, encoding, callback, fromEnd) {
     }
   }
 
+  if (msg.chunkedEncoding && typeof chunk === 'string' && encoding && !Buffer.isEncoding(encoding)) {
+    throw new ERR_UNKNOWN_ENCODING(encoding);
+  }
+
   if (!fromEnd && msg.socket && !msg.socket.writableCorked) {
-    msg.socket.cork();
-    process.nextTick(connectionCorkNT, msg.socket);
+    msg.cork();
+    process.nextTick(connectionCorkNT, msg);
   }
 
   let ret;
   if (msg.chunkedEncoding && chunk.length !== 0) {
     len ??= typeof chunk === 'string' ? Buffer.byteLength(chunk, encoding) : chunk.byteLength;
-    if (msg[kCorked] && msg._headerSent) {
+    if (msg[kCorked]) {
+      if (typeof chunk !== 'string' && !(chunk instanceof Buffer)) {
+        chunk = Stream._uint8ArrayToBuffer(chunk);
+      }
       msg[kChunkedBuffer].push(chunk, encoding, callback);
       msg[kChunkedLength] += len;
-      ret = msg[kChunkedLength] < msg[kHighWaterMark];
+      ret = msg.writableLength < msg.writableHighWaterMark;
     } else {
       msg._send(len.toString(16), 'latin1', null);
       msg._send(crlf_buf, null, null);
       msg._send(chunk, encoding, null, len);
       ret = msg._send(crlf_buf, null, callback);
     }
+  } else if (msg.chunkedEncoding && msg[kCorked] && msg[kChunkedBuffer].length !== 0) {
+    msg[kChunkedBuffer].push(chunk, encoding, callback);
+    ret = msg.writableLength < msg.writableHighWaterMark;
   } else {
     ret = msg._send(chunk, encoding, callback, len);
   }
@@ -1045,8 +1073,10 @@ function maybePrepareFinalChunk(msg, chunk, encoding) {
   return !!msg._header && msg._hasBody && !msg.chunkedEncoding;
 }
 
-function connectionCorkNT(conn) {
-  conn.uncork();
+function connectionCorkNT(msg) {
+  if (msg[kCorked]) {
+    msg.uncork();
+  }
 }
 
 OutgoingMessage.prototype.addTrailers = function addTrailers(headers) {
@@ -1197,6 +1227,13 @@ OutgoingMessage.prototype.end = function end(chunk, encoding, callback) {
     throw new ERR_HTTP_CONTENT_LENGTH_MISMATCH(this[kBytesWritten], this._contentLength);
   }
 
+  // Flush buffered chunks before terminating the response.
+  if (this[kChunkedBuffer].length !== 0) {
+    this[kSocket]?.cork();
+    this[kCorked] = 1;
+    this.uncork();
+  }
+
   if (finishCallback === null) {
     // If we didn't early finish, send the last data and schedule 'finish' now:
     finishCallback = onFinish.bind(undefined, this);
diff --git a/lib/child_process.js b/lib/child_process.js
index 779aebab8318..e72461ea5f73 100644
--- a/lib/child_process.js
+++ b/lib/child_process.js
@@ -824,7 +824,8 @@ function spawn(file, args, options) {
       }
     }, options.timeout);
 
-    child.once('exit', () => {
+    // 'close' always fires after 'exit', or after 'error' on a spawn failure.
+    child.once('close', () => {
       if (timeoutId) {
         clearTimeout(timeoutId);
         timeoutId = null;
@@ -873,8 +874,8 @@ function spawn(file, args, options) {
  * @returns {{
  *   pid: number;
  *   output: Array;
- *   stdout: Buffer | string;
- *   stderr: Buffer | string;
+ *   stdout: Buffer | string | null;
+ *   stderr: Buffer | string | null;
  *   status: number | null;
  *   signal: string | null;
  *   error: Error;
@@ -962,7 +963,7 @@ function checkExecSyncError(ret, args, cmd) {
  *   windowsHide?: boolean;
  *   shell?: boolean | string;
  *   }} [options]
- * @returns {Buffer | string}
+ * @returns {Buffer | string | null}
  */
 function execFileSync(file, args, options) {
   ({ file, args, options } = normalizeExecFileArgs(file, args, options));
@@ -1000,7 +1001,7 @@ function execFileSync(file, args, options) {
  *   encoding?: string;
  *   windowsHide?: boolean;
  *   }} [options]
- * @returns {Buffer | string}
+ * @returns {Buffer | string | null}
  */
 function execSync(command, options) {
   const opts = normalizeExecArgs(command, options, null);
diff --git a/lib/crypto.js b/lib/crypto.js
index ac4b0a33efb8..3e720cd3bdf6 100644
--- a/lib/crypto.js
+++ b/lib/crypto.js
@@ -84,6 +84,7 @@ const {
   createSecretKey,
   createPublicKey,
   createPrivateKey,
+  parsePKCS12,
   KeyObject,
 } = require('internal/crypto/keys');
 const {
@@ -112,6 +113,9 @@ const {
   Hmac,
   hash,
 } = require('internal/crypto/hash');
+const {
+  Mac,
+} = require('internal/crypto/provider_mac');
 const {
   X509Certificate,
 } = require('internal/crypto/x509');
@@ -119,6 +123,7 @@ const {
   getCiphers,
   getCurves,
   getHashes,
+  getMacs,
   setEngine,
   secureHeapUsed,
 } = require('internal/crypto/util');
@@ -170,6 +175,10 @@ function createHmac(hmac, key, options) {
   return new Hmac(hmac, key, options);
 }
 
+function createMac(algorithm, key, options) {
+  return new Mac(algorithm, key, options);
+}
+
 function createSign(algorithm, options) {
   return new Sign(algorithm, options);
 }
@@ -191,6 +200,7 @@ module.exports = {
   createECDH,
   createHash,
   createHmac,
+  createMac,
   createPrivateKey,
   createPublicKey,
   createSecretKey,
@@ -204,8 +214,10 @@ module.exports = {
   getCurves,
   getDiffieHellman: createDiffieHellmanGroup,
   getHashes,
+  getMacs,
   hkdf,
   hkdfSync,
+  parsePKCS12,
   pbkdf2,
   pbkdf2Sync,
   generateKeyPair,
diff --git a/lib/diagnostics_channel.js b/lib/diagnostics_channel.js
index bd4c9b4a9267..5425fb09b8bc 100644
--- a/lib/diagnostics_channel.js
+++ b/lib/diagnostics_channel.js
@@ -73,11 +73,19 @@ function markActive(channel) {
   ObjectSetPrototypeOf(channel, ActiveChannel.prototype);
   channel._subscribers = [];
   channel._stores = new SafeMap();
+
+  // Notify native modules that this channel just got its first subscriber.
+  if (channel._index !== undefined)
+    dc_binding.notifyChannelActive(channel._index);
 }
 
 function maybeMarkInactive(channel) {
   // When there are no more active subscribers or bound, restore to fast prototype.
   if (!channel._subscribers.length && !channel._stores.size) {
+    // Notify native modules that this channel just lost its last subscriber.
+    if (channel._index !== undefined)
+      dc_binding.notifyChannelInactive(channel._index);
+
     // eslint-disable-next-line no-use-before-define
     ObjectSetPrototypeOf(channel, Channel.prototype);
     channel._subscribers = undefined;
diff --git a/lib/eslint.config_partial.mjs b/lib/eslint.config_partial.mjs
index 956774cdcf76..928e85d9575e 100644
--- a/lib/eslint.config_partial.mjs
+++ b/lib/eslint.config_partial.mjs
@@ -398,8 +398,8 @@ export default [
       'node-core/lowercase-name-for-primitive': 'error',
       'node-core/non-ascii-character': 'error',
       'node-core/no-array-destructuring': 'error',
+      'node-core/no-crypto-class-instanceof': 'error',
       'node-core/no-cryptokey-public-accessors': 'error',
-      'node-core/no-keyobject-cryptokey-instanceof': 'error',
       'node-core/no-keyobject-public-accessors': 'error',
       'node-core/prefer-primordials': [
         'error',
diff --git a/lib/https.js b/lib/https.js
index 6ae2e5d8a213..75ec8bb3f895 100644
--- a/lib/https.js
+++ b/lib/https.js
@@ -70,6 +70,7 @@ let debug = require('internal/util/debuglog').debuglog('https', (fn) => {
   debug = fn;
 });
 const net = require('net');
+const { Buffer } = require('buffer');
 const { URL, urlToHttpOptions, isURL } = require('internal/url');
 const { validateObject } = require('internal/validators');
 const { isIP } = require('internal/net');
@@ -204,6 +205,7 @@ function getTunnelConfigForProxiedHttps(agent, reqOptions) {
   const result = {
     __proto__: null,
     proxyTunnelPayload: payload,
+    maxHeaderSize: reqOptions.maxHeaderSize || getOptionValue('--max-http-header-size'),
     requestOptions: {  // Options used for the request sent after the tunnel is established.
       __proto__: null,
       servername: reqOptions.servername || ipType ? undefined : reqOptions.host,
@@ -215,17 +217,17 @@ function getTunnelConfigForProxiedHttps(agent, reqOptions) {
 };
 
 function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
-  const { proxyTunnelPayload } = tunnelConfig;
+  const { proxyTunnelPayload, maxHeaderSize } = tunnelConfig;
   // By default, the socket is in paused mode. Read to look for the 200
   // connection established response.
   function read() {
     let chunk;
     while ((chunk = socket.read()) !== null) {
-      if (onProxyData(chunk) !== -1) {
-        break;
+      if (onProxyData(chunk)) {
+        return;
       }
     }
-    socket.on('readable', read);
+    socket.once('readable', read);
   }
 
   function cleanup() {
@@ -243,14 +245,25 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
 
   // Read the headers from the chunks and check for the status code. If it fails we
   // clean up the socket and return an error. Otherwise we establish the tunnel.
-  let buffer = '';
+  let buffer;
   function onProxyData(chunk) {
-    const str = chunk.toString();
-    debug('onProxyData', str);
-    buffer += str;
+    debug('onProxyData', chunk.length);
+    buffer = buffer === undefined ? chunk :
+      Buffer.concat([buffer, chunk], buffer.length + chunk.length);
     const headerEndIndex = buffer.indexOf('\r\n\r\n');
-    if (headerEndIndex === -1) return headerEndIndex;
-    const statusLine = buffer.substring(0, buffer.indexOf('\r\n'));
+    const headerLength = headerEndIndex === -1 ?
+      buffer.length : headerEndIndex + 4;
+    if (headerLength > maxHeaderSize) {
+      debug(`Proxy response headers exceed ${maxHeaderSize} bytes, cleaning up`);
+      cleanup();
+      const err = new ERR_PROXY_TUNNEL(
+        `Proxy response headers exceeded ${maxHeaderSize} bytes`);
+      afterSocket(err, socket);
+      return true;
+    }
+    if (headerEndIndex === -1) return false;
+    const statusLineEndIndex = buffer.indexOf('\r\n');
+    const statusLine = buffer.subarray(0, statusLineEndIndex).toString();
     const statusCode = statusLine.split(' ')[1];
     if (statusCode !== '200') {
       debug(`onProxyData receives ${statusCode}, cleaning up`);
@@ -292,7 +305,7 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
       });
       tunneldSocket.on('error', onTLSHandshakeError);
     }
-    return headerEndIndex;
+    return true;
   }
 
   function onProxyEnd() {
diff --git a/lib/internal/abort_controller.js b/lib/internal/abort_controller.js
index 09b160e9fe5a..5672b6b80f6c 100644
--- a/lib/internal/abort_controller.js
+++ b/lib/internal/abort_controller.js
@@ -149,8 +149,8 @@ function refreshCompositeSignal(signal) {
       continue;
     }
 
-    if (sourceSignal.aborted) {
-      abortSignal(signal, sourceSignal.reason);
+    if (sourceSignal[kAborted]) {
+      abortSignal(signal, sourceSignal[kReason]);
       return;
     }
   }
@@ -170,8 +170,8 @@ function followCompositeSignal(signal) {
       continue;
     }
 
-    if (sourceSignal.aborted) {
-      abortSignal(signal, sourceSignal.reason);
+    if (sourceSignal[kAborted]) {
+      abortSignal(signal, sourceSignal[kReason]);
       return;
     }
 
@@ -217,6 +217,14 @@ function setWeakAbortSignalTimeout(weakRef, delay) {
 }
 
 class AbortSignal extends EventTarget {
+  #brand;
+
+  static {
+    converters.AbortSignal = createInterfaceConverter(
+      'AbortSignal',
+      (value) => typeof value === 'object' && value !== null && #brand in value,
+    );
+  }
 
   /**
    * @param {symbol | undefined} dontThrowSymbol
@@ -337,8 +345,9 @@ class AbortSignal extends EventTarget {
         gcPersistentSignals.add(signal);
       }
 
-      if (signal.aborted) {
-        abortSignal(resultSignal, signal.reason);
+      refreshCompositeSignal(signal);
+      if (signal[kAborted]) {
+        abortSignal(resultSignal, signal[kReason]);
         return resultSignal;
       }
 
@@ -348,11 +357,6 @@ class AbortSignal extends EventTarget {
       } else if (!signal[kSourceSignals]) {
         continue;
       } else {
-        refreshCompositeSignal(signal);
-        if (signal.aborted) {
-          abortSignal(resultSignal, signal.reason);
-          return resultSignal;
-        }
         for (const sourceSignalWeakRef of signal[kSourceSignals]) {
           const sourceSignal = sourceSignalWeakRef.deref();
           if (!sourceSignal) {
@@ -360,8 +364,8 @@ class AbortSignal extends EventTarget {
           }
           assert(!sourceSignal[kComposite]);
 
-          if (sourceSignal.aborted) {
-            abortSignal(resultSignal, sourceSignal.reason);
+          if (sourceSignal[kAborted]) {
+            abortSignal(resultSignal, sourceSignal[kReason]);
             return resultSignal;
           }
 
@@ -377,6 +381,10 @@ class AbortSignal extends EventTarget {
       resultSignal[kTimeout] = true;
     }
 
+    // Preserve abort state even if sources are collected before this signal is
+    // observed. Following uses weak references so unused signals can be collected.
+    followCompositeSignal(resultSignal);
+
     return resultSignal;
   }
 
@@ -466,7 +474,6 @@ class AbortSignal extends EventTarget {
   }
 }
 
-converters.AbortSignal = createInterfaceConverter('AbortSignal', AbortSignal.prototype);
 converters['sequence<AbortSignal>'] = createSequenceConverter(converters.AbortSignal);
 
 function ClonedAbortSignal() {
diff --git a/lib/internal/async_context_frame.js b/lib/internal/async_context_frame.js
index cac193e33188..cd03eafe6fa6 100644
--- a/lib/internal/async_context_frame.js
+++ b/lib/internal/async_context_frame.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  ObjectSetPrototypeOf,
   SafeMap,
 } = primordials;
 
@@ -10,45 +9,22 @@ const {
   setContinuationPreservedEmbedderData,
 } = internalBinding('async_context_frame');
 
-let enabled_;
-
-class ActiveAsyncContextFrame extends SafeMap {
-  static get enabled() {
-    return true;
-  }
-
-  static current() {
-    return getContinuationPreservedEmbedderData();
-  }
-
-  static set(frame) {
-    setContinuationPreservedEmbedderData(frame);
-  }
-
-  static exchange(frame) {
-    const prior = this.current();
-    this.set(frame);
-    return prior;
-  }
-
-  static disable(store) {
-    const frame = this.current();
-    frame?.disable(store);
-  }
+function activeCurrent() {
+  return getContinuationPreservedEmbedderData();
 }
 
-function checkEnabled() {
-  const enabled = require('internal/options')
-    .getOptionValue('--async-context-frame');
+function activeSet(frame) {
+  setContinuationPreservedEmbedderData(frame);
+}
 
-  // If enabled, swap to active prototype so we don't need to check status
-  // on every interaction with the async context frame.
-  if (enabled) {
-    // eslint-disable-next-line no-use-before-define
-    ObjectSetPrototypeOf(AsyncContextFrame, ActiveAsyncContextFrame);
-  }
+function activeExchange(frame) {
+  const prior = getContinuationPreservedEmbedderData();
+  setContinuationPreservedEmbedderData(frame);
+  return prior;
+}
 
-  return enabled;
+function activeDisable(store) {
+  getContinuationPreservedEmbedderData()?.disable(store);
 }
 
 class InactiveAsyncContextFrame extends SafeMap {
@@ -74,4 +50,22 @@ class AsyncContextFrame extends InactiveAsyncContextFrame {
   }
 }
 
+let enabled_;
+
+function checkEnabled() {
+  const enabled = require('internal/options')
+    .getOptionValue('--async-context-frame');
+
+  // If enabled, install the active implementations directly. We use props
+  // rather than a prototype replacement to preserve V8 optimizations.
+  if (enabled) {
+    AsyncContextFrame.current = activeCurrent;
+    AsyncContextFrame.set = activeSet;
+    AsyncContextFrame.exchange = activeExchange;
+    AsyncContextFrame.disable = activeDisable;
+  }
+
+  return enabled;
+}
+
 module.exports = AsyncContextFrame;
diff --git a/lib/internal/blob.js b/lib/internal/blob.js
index fa8da1a5d0ed..6d0ec01f2ae5 100644
--- a/lib/internal/blob.js
+++ b/lib/internal/blob.js
@@ -576,9 +576,7 @@ async function* createBlobReaderIterable(reader, options = {}) {
   const { getReadError } = options;
   let wakeup = PromiseWithResolvers();
   let immediate;
-  let fin = false;
-  reader.setWakeup((setfin) => {
-    fin ||= setfin;
+  reader.setWakeup(() => {
     immediate ??= setImmediate(() => {
       immediate = undefined;
       wakeup.resolve?.();
@@ -630,12 +628,6 @@ async function* createBlobReaderIterable(reader, options = {}) {
       if (blocked) {
         await wakeup.promise;
         wakeup = PromiseWithResolvers();
-        // If the wakeup was triggered by FIN (EndReadable), the DataQueue
-        // is capped. Continue the loop to pull again -- the next pull will
-        // return EOS. Without this, a race between the data notification
-        // and the FIN notification can leave the iterator waiting for a
-        // wakeup that will never come.
-        if (fin) continue;
       }
     }
   } finally {
diff --git a/lib/internal/blocklist.js b/lib/internal/blocklist.js
index f290c7ada405..9436078eaa2c 100644
--- a/lib/internal/blocklist.js
+++ b/lib/internal/blocklist.js
@@ -46,7 +46,7 @@ const {
   ERR_INVALID_ARG_TYPE,
 } = require('internal/errors').codes;
 
-const { validateInt32, validateString } = require('internal/validators');
+const { validateArray, validateInt32, validateString } = require('internal/validators');
 
 function parseCIDR(cidr) {
   validateString(cidr, 'cidr');
@@ -131,9 +131,7 @@ class BlockList {
    * @param {string} [family]
    */
   addAddresses(addresses, family = 'ipv4') {
-    if (!ArrayIsArray(addresses)) {
-      throw new ERR_INVALID_ARG_TYPE('addresses', 'Array', addresses);
-    }
+    validateArray(addresses, 'addresses');
     validateString(family, 'family');
     const handles = [];
     for (let i = 0; i < addresses.length; i++) {
@@ -215,9 +213,7 @@ class BlockList {
    * @param {string[]} cidrs
    */
   addCIDRs(cidrs) {
-    if (!ArrayIsArray(cidrs)) {
-      throw new ERR_INVALID_ARG_TYPE('cidrs', 'Array', cidrs);
-    }
+    validateArray(cidrs, 'cidrs');
     // Validate and parse all entries first so that an exception mid-array
     // does not leave the blocklist half-modified.
     const parsed = [];
@@ -387,7 +383,7 @@ class BlockList {
         // - 2001:db8:85a3::8a2e:370:7334/64 (compressed)
         // - 2001:db8:85a3::192.0.2.128/64 (mixed)
         const ipv6SubnetMatch = item.match(
-          /Subnet: IPv6 ([0-9a-fA-F:]{1,39})\/([0-9]{1,3})/i,
+          /Subnet: IPv6 ([0-9a-fA-F:.]{1,45})\/([0-9]{1,3})/i,
         );
         if (ipv6SubnetMatch) {
           const { 1: network, 2: prefix } = ipv6SubnetMatch;
@@ -400,7 +396,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334 (full)
         // - 2001:db8:85a3::8a2e:370:7334 (compressed)
         // - 2001:db8:85a3::192.0.2.128 (mixed)
-        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:]{1,39})/i);
+        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:.]{1,45})/i);
         if (ipv6AddressMatch) {
           const { 1: address } = ipv6AddressMatch;
           this.addAddress(address, 'ipv6');
@@ -412,7 +408,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334-2001:0db8:85a3:0000:0000:8a2e:0370:7335 (full)
         // - 2001:db8:85a3::8a2e:370:7334-2001:db8:85a3::8a2e:370:7335 (compressed)
         // - 2001:db8:85a3::192.0.2.128-2001:db8:85a3::192.0.2.129 (mixed)
-        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:]{1,39})-([0-9a-fA-F:]{1,39})/i);
+        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:.]{1,45})-([0-9a-fA-F:.]{1,45})/i);
         if (ipv6RangeMatch) {
           const { 1: start, 2: end } = ipv6RangeMatch;
           this.addRange(start, end, 'ipv6');
diff --git a/lib/internal/child_process.js b/lib/internal/child_process.js
index 5e9c727f04e1..0b914acf7387 100644
--- a/lib/internal/child_process.js
+++ b/lib/internal/child_process.js
@@ -55,6 +55,10 @@ const { TCP } = internalBinding('tcp_wrap');
 const { TTY } = internalBinding('tty_wrap');
 const { UDP } = internalBinding('udp_wrap');
 const SocketList = require('internal/socket_list');
+const {
+  kDeserialize,
+  kTransfer,
+} = require('internal/worker/js_transferable');
 const { owner_symbol } = require('internal/async_hooks').symbols;
 const { convertToValidSignal, deprecate } = require('internal/util');
 const { isArrayBufferView } = require('internal/util/types');
@@ -87,6 +91,24 @@ const kChannelHandle = Symbol('kChannelHandle');
 const kIsUsedAsStdio = Symbol('kIsUsedAsStdio');
 const kPendingMessages = Symbol('kPendingMessages');
 
+// Store the handle after successfully sending it, so it can be closed when
+// the NODE_HANDLE_ACK is received. If the handle could not be sent, just
+// close it.
+function closeHandleAfterAck(message, handle, options, callback, target) {
+  if (handle && !options.keepOpen) {
+    if (target) {
+      // There can only be one _pendingMessage as passing handles are
+      // processed one at a time: handles are stored in _handleQueue while
+      // waiting for the NODE_HANDLE_ACK of the current passing handle.
+      assert(!target._pendingMessage);
+      target._pendingMessage =
+          { callback, message, handle, options, retransmissions: 0 };
+    } else {
+      handle.close();
+    }
+  }
+}
+
 // This object contain function to convert TCP objects to native handle objects
 // and back again.
 const handleConversion = {
@@ -117,6 +139,29 @@ const handleConversion = {
     },
   },
 
+  'net.BoundSocket': {
+    simultaneousAccepts: true,
+
+    send(message, boundSocket, options) {
+      // Pipe (path) binds cannot be sent over the IPC channel.
+      if (boundSocket.isPipe)
+        throw new ERR_INVALID_HANDLE_TYPE();
+
+      // Reuse the worker_threads transfer protocol: detaches the handle,
+      // leaving the source in the adopted state, and throws if the bound
+      // socket is not in a transferable state.
+      return boundSocket[kTransfer]().data.handle;
+    },
+
+    postSend: closeHandleAfterAck,
+
+    got(message, handle, emit) {
+      const boundSocket = new net._TransferredBoundSocket();
+      boundSocket[kDeserialize]({ handle });
+      emit(boundSocket);
+    },
+  },
+
   'net.Socket': {
     send(message, socket, options) {
       if (!socket._handle)
@@ -166,23 +211,7 @@ const handleConversion = {
       return handle;
     },
 
-    postSend(message, handle, options, callback, target) {
-      // Store the handle after successfully sending it, so it can be closed
-      // when the NODE_HANDLE_ACK is received. If the handle could not be sent,
-      // just close it.
-      if (handle && !options.keepOpen) {
-        if (target) {
-          // There can only be one _pendingMessage as passing handles are
-          // processed one at a time: handles are stored in _handleQueue while
-          // waiting for the NODE_HANDLE_ACK of the current passing handle.
-          assert(!target._pendingMessage);
-          target._pendingMessage =
-              { callback, message, handle, options, retransmissions: 0 };
-        } else {
-          handle.close();
-        }
-      }
-    },
+    postSend: closeHandleAfterAck,
 
     got(message, handle, emit) {
       const socket = new net.Socket({
@@ -838,6 +867,8 @@ function setupChannel(target, channel, serializationMode) {
         message.type = 'net.Socket';
       } else if (handle instanceof net.Server) {
         message.type = 'net.Server';
+      } else if (handle instanceof net.BoundSocket) {
+        message.type = 'net.BoundSocket';
       } else if (handle instanceof TCP || handle instanceof Pipe) {
         message.type = 'net.Native';
       } else if (handle instanceof dgram.Socket) {
diff --git a/lib/internal/cli_table.js b/lib/internal/cli_table.js
index be0bd44bbc36..13b3c86c5e40 100644
--- a/lib/internal/cli_table.js
+++ b/lib/internal/cli_table.js
@@ -81,8 +81,10 @@ const table = (head, columns) => {
                ArrayPrototypeJoin(divider, tableChars.rowMiddle) +
                tableChars.rightMiddle + '\n';
 
-  for (const row of rows)
+  for (let i = 0; i < rows.length; i++) {
+    const row = rows[i];
     result += `${renderRow(row, columnWidths)}\n`;
+  }
 
   result += tableChars.bottomLeft +
             ArrayPrototypeJoin(divider, tableChars.bottomMiddle) +
diff --git a/lib/internal/crypto/cfrg.js b/lib/internal/crypto/cfrg.js
index c85ee6315ff0..026fa925a95a 100644
--- a/lib/internal/crypto/cfrg.js
+++ b/lib/internal/crypto/cfrg.js
@@ -18,11 +18,7 @@ const {
   kWebCryptoKeyFormatPKCS8,
   kWebCryptoKeyFormatRaw,
   kWebCryptoKeyFormatSPKI,
-  NidKeyPairGenJob,
-  EVP_PKEY_ED25519,
-  EVP_PKEY_ED448,
-  EVP_PKEY_X25519,
-  EVP_PKEY_X448,
+  NamedKeyPairGenJob,
 } = internalBinding('crypto');
 
 const {
@@ -69,21 +65,14 @@ function cfrgGenerateKey(algorithm, extractable, usages) {
   const { name } = algorithm;
   const allowedUsages = kUsages[name];
   const usagesSet = validateKeyUsages(usages, allowedUsages.keygen, name);
-  const nid = {
-    '__proto__': null,
-    'Ed25519': EVP_PKEY_ED25519,
-    'Ed448': EVP_PKEY_ED448,
-    'X25519': EVP_PKEY_X25519,
-    'X448': EVP_PKEY_X448,
-  }[name];
 
   const keyAlgorithm = { name };
   const keyUsages = getKeyPairUsages(usagesSet, allowedUsages);
   validateUsagesNotEmpty(keyUsages.private);
 
-  return jobPromise(() => new NidKeyPairGenJob(
+  return jobPromise(() => new NamedKeyPairGenJob(
     kCryptoJobWebCrypto,
-    nid,
+    name,
     keyAlgorithm,
     getUsagesMask(keyUsages.public),
     getUsagesMask(keyUsages.private),
@@ -148,6 +137,12 @@ function cfrgImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = (name === 'X25519' || name === 'X448') ? 'enc' : 'sig';
       validateJwk(keyData, 'OKP', extractable, usagesSet, expectedUse);
 
@@ -161,11 +156,6 @@ function cfrgImportKey(
             'JWK "alg" does not match the requested algorithm', 'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
 
       if (!isPublic) {
@@ -177,7 +167,7 @@ function cfrgImportKey(
     }
     case 'raw': {
       verifyAcceptableKeyUse(name, usagesSet, allowedUsages.public);
-      handle = importRawKey(true, keyData, kKeyFormatRawPublic, name);
+      handle = importRawKey(true, keyData, kKeyFormatRawPublic, StringPrototypeToLowerCase(name));
       break;
     }
     default:
diff --git a/lib/internal/crypto/cipher.js b/lib/internal/crypto/cipher.js
index dc74ddb21bc9..8ad733de316d 100644
--- a/lib/internal/crypto/cipher.js
+++ b/lib/internal/crypto/cipher.js
@@ -34,6 +34,7 @@ const {
 const {
   validateEncoding,
   validateInt32,
+  validateOneOf,
   validateObject,
   validateString,
 } = require('internal/validators');
@@ -60,6 +61,9 @@ const { normalizeEncoding } = require('internal/util');
 
 const { StringDecoder } = require('string_decoder');
 
+const kCtsModes = ['CS1', 'CS2', 'CS3'];
+const kXtsStandards = ['GB', 'IEEE'];
+
 function rsaFunctionFor(method, defaultPadding, keyType) {
   const keyName = keyType === 'private' ? 'privateKey' : undefined;
   return (key, buffer) => {
@@ -68,15 +72,17 @@ function rsaFunctionFor(method, defaultPadding, keyType) {
         preparePrivateKey(key, keyName) :
         preparePublicOrPrivateKey(key, keyName);
     const padding = key.padding || defaultPadding;
-    const { oaepHash, encoding } = key;
+    const { oaepHash, mgf1Hash, encoding } = key;
     let { oaepLabel } = key;
     if (oaepHash !== undefined)
       validateString(oaepHash, 'key.oaepHash');
+    if (mgf1Hash !== undefined)
+      validateString(mgf1Hash, 'key.mgf1Hash');
     if (oaepLabel !== undefined)
       oaepLabel = getArrayBufferOrView(oaepLabel, 'key.oaepLabel', encoding);
     buffer = getArrayBufferOrView(buffer, 'buffer', encoding);
     return method(data, format, type, passphrase, namedCurve, buffer,
-                  padding, oaepHash, oaepLabel);
+                  padding, oaepHash, oaepLabel, mgf1Hash);
   };
 }
 
@@ -117,8 +123,32 @@ function getUIntOption(options, key) {
 }
 
 function createCipherBase(cipher, credential, options, isEncrypt, iv) {
-  const authTagLength = getUIntOption(options, 'authTagLength');
-  this[kHandle] = new CipherBase(isEncrypt, cipher, credential, iv, authTagLength);
+  let authTagLength = -1;
+  let ctsMode;
+  let xtsStandard;
+  if (options != null) {
+    authTagLength = getUIntOption(options, 'authTagLength');
+    ctsMode = getStringOption(options, 'ctsMode') ?? undefined;
+    xtsStandard = getStringOption(options, 'xtsStandard') ?? undefined;
+    if (ctsMode !== undefined)
+      validateOneOf(ctsMode, 'options.ctsMode', kCtsModes);
+    if (xtsStandard !== undefined)
+      validateOneOf(xtsStandard, 'options.xtsStandard', kXtsStandards);
+  }
+
+  if (ctsMode === undefined && xtsStandard === undefined) {
+    this[kHandle] = new CipherBase(
+      isEncrypt, cipher, credential, iv, authTagLength);
+  } else {
+    this[kHandle] = new CipherBase(
+      isEncrypt,
+      cipher,
+      credential,
+      iv,
+      authTagLength,
+      ctsMode,
+      xtsStandard);
+  }
   this._decoder = null;
 
   FunctionPrototypeCall(LazyTransform, this, options);
diff --git a/lib/internal/crypto/ec.js b/lib/internal/crypto/ec.js
index cbd89dd11c7e..0f1e0555202d 100644
--- a/lib/internal/crypto/ec.js
+++ b/lib/internal/crypto/ec.js
@@ -164,6 +164,12 @@ function ecImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = name === 'ECDH' ? 'enc' : 'sig';
       validateJwk(keyData, 'EC', extractable, usagesSet, expectedUse);
 
@@ -185,11 +191,6 @@ function ecImportKey(
             'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
diff --git a/lib/internal/crypto/hash.js b/lib/internal/crypto/hash.js
index 3a478f2a28a1..62bec9660607 100644
--- a/lib/internal/crypto/hash.js
+++ b/lib/internal/crypto/hash.js
@@ -7,6 +7,7 @@ const {
   StringPrototypeToLowerCase,
   Symbol,
   TypedArrayPrototypeGetBuffer,
+  TypedArrayPrototypeIncludes,
 } = primordials;
 
 const {
@@ -31,6 +32,8 @@ const {
   kHandle,
   getCachedHashId,
   getHashCache,
+  getArrayBufferOrView,
+  getBufferSourceBytes,
   getOptionalByteLength,
 } = require('internal/crypto/util');
 
@@ -95,6 +98,17 @@ const maybeEmitDeprecationWarning = getDeprecationWarningEmitter(
   },
 );
 
+function normalizeCShakeParameter(value, name) {
+  if (value === undefined) return undefined;
+
+  value = getArrayBufferOrView(value, name);
+  if (TypedArrayPrototypeIncludes(getBufferSourceBytes(value), 0)) {
+    throw new ERR_INVALID_ARG_VALUE(
+      name, value, 'must not contain NUL bytes');
+  }
+  return value;
+}
+
 function Hash(algorithm, options) {
   if (!new.target)
     return new Hash(algorithm, options);
@@ -108,10 +122,36 @@ function Hash(algorithm, options) {
     // Coerce -0 to +0.
     xofLen += 0;
   }
+  let functionName;
+  let customization;
+  if (!isCopy && options !== undefined && options !== null) {
+    const functionNameOption = options.functionName;
+    if (functionNameOption !== undefined) {
+      functionName = normalizeCShakeParameter(
+        functionNameOption, 'options.functionName');
+    }
+    const customizationOption = options.customization;
+    if (customizationOption !== undefined) {
+      customization = normalizeCShakeParameter(
+        customizationOption, 'options.customization');
+    }
+  }
   // Lookup the cached ID from JS land because it's faster than decoding
   // the string in C++ land.
   const algorithmId = isCopy ? -1 : getCachedHashId(algorithm);
-  this[kHandle] = new _Hash(algorithm, xofLen, algorithmId, getHashCache());
+  if (functionName === undefined && customization === undefined) {
+    this[kHandle] = new _Hash(
+      algorithm, xofLen, algorithmId, getHashCache());
+  } else {
+    this[kHandle] = new _Hash(
+      algorithm,
+      xofLen,
+      algorithmId,
+      getHashCache(),
+      functionName,
+      customization,
+    );
+  }
   this[kState] = {
     [kFinalized]: false,
   };
@@ -207,7 +247,12 @@ Hmac.prototype.digest = function digest(outputEncoding) {
   return ret;
 };
 
-Hmac.prototype._flush = Hash.prototype._flush;
+Hmac.prototype._flush = function _flush(callback) {
+  this.push(this[kHandle].digest());
+  this[kState][kFinalized] = true; // This diverges from Hash.prototype._flush:
+  // Hash instances are still usable after a flush, Hmac are not, see DEP0206.
+  callback();
+};
 Hmac.prototype._transform = Hash.prototype._transform;
 
 // Implementation for WebCrypto subtle.digest()
@@ -296,8 +341,15 @@ function hash(algorithm, input, options) {
   if (typeof input !== 'string' && !isArrayBufferView(input)) {
     throw new ERR_INVALID_ARG_TYPE('input', ['Buffer', 'TypedArray', 'DataView', 'string'], input);
   }
+  if (options === undefined) {
+    maybeEmitDeprecationWarning(algorithm);
+    return oneShotDigest(algorithm, getCachedHashId(algorithm), getHashCache(),
+                         input, 'hex', encodingsMap.hex, undefined);
+  }
   let outputEncoding;
   let outputLength;
+  let functionName;
+  let customization;
 
   if (typeof options === 'string') {
     outputEncoding = options;
@@ -305,6 +357,16 @@ function hash(algorithm, input, options) {
     validateObject(options, 'options');
     outputLength = options.outputLength;
     outputEncoding = options.outputEncoding;
+    const functionNameOption = options.functionName;
+    if (functionNameOption !== undefined) {
+      functionName = normalizeCShakeParameter(
+        functionNameOption, 'options.functionName');
+    }
+    const customizationOption = options.customization;
+    if (customizationOption !== undefined) {
+      customization = normalizeCShakeParameter(
+        customizationOption, 'options.customization');
+    }
   }
 
   outputEncoding ??= 'hex';
@@ -335,8 +397,13 @@ function hash(algorithm, input, options) {
     maybeEmitDeprecationWarning(algorithm);
   }
 
+  if (functionName === undefined && customization === undefined) {
+    return oneShotDigest(algorithm, getCachedHashId(algorithm), getHashCache(),
+                         input, normalized, encodingsMap[normalized], outputLength);
+  }
   return oneShotDigest(algorithm, getCachedHashId(algorithm), getHashCache(),
-                       input, normalized, encodingsMap[normalized], outputLength);
+                       input, normalized, encodingsMap[normalized], outputLength,
+                       functionName, customization);
 }
 
 module.exports = {
diff --git a/lib/internal/crypto/hkdf.js b/lib/internal/crypto/hkdf.js
index c9b868e23af4..8673f9b46817 100644
--- a/lib/internal/crypto/hkdf.js
+++ b/lib/internal/crypto/hkdf.js
@@ -4,6 +4,8 @@ const {
   ArrayBuffer,
   FunctionPrototypeCall,
   PromiseResolve,
+  TypedArrayPrototypeGetByteLength,
+  Uint8Array,
 } = primordials;
 
 const {
@@ -22,6 +24,7 @@ const {
 const { kMaxLength } = require('buffer');
 
 const {
+  getBufferSourceByteLength,
   jobPromise,
   normalizeHashName,
   toBuf,
@@ -41,6 +44,7 @@ const {
 const {
   isAnyArrayBuffer,
   isArrayBufferView,
+  isSharedArrayBuffer,
 } = require('internal/util/types');
 
 const {
@@ -51,6 +55,13 @@ const {
   hideStackFrames,
 } = require('internal/errors');
 
+function getByteSourceByteLength(source) {
+  if (isSharedArrayBuffer(source)) {
+    return TypedArrayPrototypeGetByteLength(new Uint8Array(source));
+  }
+  return getBufferSourceByteLength(source);
+}
+
 const validateParameters = hideStackFrames((hash, key, salt, info, length) => {
   validateString.withoutStackTrace(hash, 'digest');
   key = prepareKey(key);
@@ -61,11 +72,12 @@ const validateParameters = hideStackFrames((hash, key, salt, info, length) => {
   // Coerce -0 to +0.
   length += 0;
 
-  if (info.byteLength > 1024) {
+  const infoByteLength = getByteSourceByteLength(info);
+  if (infoByteLength > 1024) {
     throw new ERR_OUT_OF_RANGE.HideStackFramesError(
       'info',
       'must not contain more than 1024 bytes',
-      info.byteLength);
+      infoByteLength);
   }
 
   return {
@@ -103,18 +115,20 @@ function prepareKey(key) {
   return key;
 }
 
-function hkdf(hash, key, salt, info, length, callback) {
-  ({
-    hash,
-    key,
-    salt,
-    info,
-    length,
-  } = validateParameters(hash, key, salt, info, length));
+function createHkdfJob(mode, params) {
+  return new HKDFJob(
+    mode,
+    params.hash,
+    params.key,
+    params.salt,
+    params.info,
+    params.length);
+}
 
+function hkdf(hash, key, salt, info, length, callback) {
+  const params = validateParameters(hash, key, salt, info, length);
   validateFunction(callback, 'callback');
-
-  const job = new HKDFJob(kCryptoJobAsync, hash, key, salt, info, length);
+  const job = createHkdfJob(kCryptoJobAsync, params);
 
   job.ondone = (error, bits) => {
     if (error) return FunctionPrototypeCall(callback, job, error);
@@ -125,15 +139,8 @@ function hkdf(hash, key, salt, info, length, callback) {
 }
 
 function hkdfSync(hash, key, salt, info, length) {
-  ({
-    hash,
-    key,
-    salt,
-    info,
-    length,
-  } = validateParameters(hash, key, salt, info, length));
-
-  const job = new HKDFJob(kCryptoJobSync, hash, key, salt, info, length);
+  const params = validateParameters(hash, key, salt, info, length);
+  const job = createHkdfJob(kCryptoJobSync, params);
   const { 0: err, 1: bits } = job.run();
   if (err !== undefined)
     throw err;
@@ -141,7 +148,23 @@ function hkdfSync(hash, key, salt, info, length) {
   return bits;
 }
 
-function validateHkdfDeriveBitsLength(length) {
+function getDigestSizeInBytes(name) {
+  switch (name) {
+    case 'SHA-1':
+      return 20;
+    case 'SHA-256': // Fall through
+    case 'SHA3-256':
+      return 32;
+    case 'SHA-384': // Fall through
+    case 'SHA3-384':
+      return 48;
+    case 'SHA-512': // Fall through
+    case 'SHA3-512':
+      return 64;
+  }
+}
+
+function validateHkdfDeriveBitsLength(length, hash) {
   if (length === null)
     throw lazyDOMException('length cannot be null', 'OperationError');
   if (length % 8) {
@@ -149,11 +172,16 @@ function validateHkdfDeriveBitsLength(length) {
       'length must be a multiple of 8',
       'OperationError');
   }
+  if (length > 255 * getDigestSizeInBytes(hash.name) * 8) {
+    throw lazyDOMException(
+      'length exceeds the maximum derived bit length',
+      'OperationError');
+  }
 }
 
 function hkdfDeriveBits(algorithm, baseKey, length) {
-  validateHkdfDeriveBitsLength(length);
   const { hash, salt, info } = algorithm;
+  validateHkdfDeriveBitsLength(length, hash);
 
   if (length === 0)
     return PromiseResolve(new ArrayBuffer(0));
diff --git a/lib/internal/crypto/kem_hybrids.js b/lib/internal/crypto/kem_hybrids.js
new file mode 100644
index 000000000000..58fcb6e8fd1a
--- /dev/null
+++ b/lib/internal/crypto/kem_hybrids.js
@@ -0,0 +1,1174 @@
+'use strict';
+
+const {
+  ArrayPrototypeSlice,
+  BigInt,
+  PromiseWithResolvers,
+  SafeSet,
+  StringPrototypeToLowerCase,
+  TypedArrayOf,
+  TypedArrayPrototypeGetBuffer,
+  TypedArrayPrototypeGetByteLength,
+  TypedArrayPrototypeGetLength,
+  TypedArrayPrototypeSet,
+  TypedArrayPrototypeSubarray,
+  Uint8Array,
+} = primordials;
+
+const { Buffer } = require('buffer');
+
+const {
+  getCryptoKeyExtractable,
+  getCryptoKeyAlgorithm,
+  getCryptoKeyHandle,
+  getCryptoKeySeedData,
+  getCryptoKeySecondaryHandle,
+  getCryptoKeyType,
+  getCryptoKeyUsages,
+  InternalCryptoKey,
+} = require('internal/crypto/keys');
+
+const {
+  DHBitsJob,
+  KEMDecapsulateJob,
+  KEMEncapsulateJob,
+  KeyObjectHandle,
+  kCryptoJobWebCrypto,
+  kKeyFormatRawPrivate,
+  kKeyFormatRawPublic,
+  kKeyFormatRawSeed,
+  kKeyTypePrivate,
+  kKeyTypePublic,
+  timingSafeEqual,
+} = internalBinding('crypto');
+
+const {
+  crypto: {
+    POINT_CONVERSION_UNCOMPRESSED,
+  },
+} = internalBinding('constants');
+
+const {
+  getBufferSourceBytes,
+  getUsagesMask,
+  jobPromise,
+  jobPromiseThen,
+  resolveWebCryptoResult,
+} = require('internal/crypto/util');
+
+const {
+  lazyDOMException,
+  setOwnProperty,
+} = require('internal/util');
+
+const {
+  hash,
+} = require('internal/crypto/hash');
+
+const {
+  randomBytes,
+} = require('internal/crypto/random');
+
+const {
+  createKeyUsages,
+  getKeyPairUsages,
+  validateJwk,
+  validateKeyUsages,
+  validateUsagesNotEmpty,
+  verifyAcceptableKeyUse,
+} = require('internal/crypto/webcrypto_util');
+
+// Concrete PQ/T Hybrid KEM instances:
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-4
+// CG framework used by those instances:
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-hybrid-kems-12.html#section-5.5
+
+const kKemPqSeedLength = 64;
+const kSeedLength = 32;
+const kX25519KeyLength = 32;
+const kP256KeyLength = 32;
+const kP384KeyLength = 48;
+const kEcPointPrefixLength = 1;
+const kEcUncompressedPointPrefix = 0x04;
+const kKemPq768EncapsulationKeyLength = 1184;
+const kKemPq768CiphertextLength = 1088;
+const kKemPq1024EncapsulationKeyLength = 1568;
+const kKemPq1024CiphertextLength = 1568;
+const kKemPq768KeyType = 'ml-kem-768';
+const kKemPq1024KeyType = 'ml-kem-1024';
+const kX25519Name = 'X25519';
+const kEcdhName = 'ECDH';
+const kEcKeyType = 'ec';
+const kP256Name = 'P-256';
+const kP384Name = 'P-384';
+// P-256 and P-384 group order constants are used by RandomScalar.
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-3.1.1
+// https://www.rfc-editor.org/rfc/rfc8017#section-4.2
+const kP256Order = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
+const kP384Order = 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973n;
+
+const kEncapsulationUsages = ['encapsulateKey', 'encapsulateBits'];
+const kDecapsulationUsages = ['decapsulateKey', 'decapsulateBits'];
+const kUsages = createKeyUsages(kEncapsulationUsages, kDecapsulationUsages);
+
+/**
+ * Adds lengths that are the concatenation of the PQ KEM component and the
+ * traditional group component.
+ * @param {object} config
+ * @returns {object}
+ */
+function withHybridLengths(config) {
+  return {
+    __proto__: null,
+    ...config,
+    encapsulationKeyLength:
+      config.kemPqEncapsulationKeyLength + config.groupElementLength,
+    ciphertextLength:
+      config.kemPqCiphertextLength + config.groupElementLength,
+  };
+}
+
+const kAlgorithms = {
+  '__proto__': null,
+  'MLKEM768-P256': withHybridLengths({
+    name: 'MLKEM768-P256',
+    kemPqKeyType: kKemPq768KeyType,
+    kemPqEncapsulationKeyLength: kKemPq768EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq768CiphertextLength,
+    groupName: kEcdhName,
+    groupKeyType: kEcKeyType,
+    namedCurve: kP256Name,
+    groupElementLength: kEcPointPrefixLength + 2 * kP256KeyLength,
+    groupScalarLength: kP256KeyLength,
+    groupSeedLength: 4 * kP256KeyLength,
+    groupOrder: kP256Order,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x37, 0x36,
+      0x38, 0x2d, 0x50, 0x32, 0x35, 0x36, // "MLKEM768-P256"
+    ),
+  }),
+  'MLKEM768-X25519': withHybridLengths({
+    name: 'MLKEM768-X25519',
+    kemPqKeyType: kKemPq768KeyType,
+    kemPqEncapsulationKeyLength: kKemPq768EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq768CiphertextLength,
+    groupName: kX25519Name,
+    groupKeyType: StringPrototypeToLowerCase(kX25519Name),
+    // Curve25519 RandomScalar is identity and Exp is X25519.
+    // https://www.rfc-editor.org/rfc/rfc7748#section-5
+    groupElementLength: kX25519KeyLength,
+    groupScalarLength: kX25519KeyLength,
+    groupSeedLength: kX25519KeyLength,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x5c, 0x2e, 0x2f, 0x2f, 0x5e, 0x5c, // "\\.//^\\"
+    ),
+  }),
+  'MLKEM1024-P384': withHybridLengths({
+    name: 'MLKEM1024-P384',
+    kemPqKeyType: kKemPq1024KeyType,
+    kemPqEncapsulationKeyLength: kKemPq1024EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq1024CiphertextLength,
+    groupName: kEcdhName,
+    groupKeyType: kEcKeyType,
+    namedCurve: kP384Name,
+    groupElementLength: kEcPointPrefixLength + 2 * kP384KeyLength,
+    groupScalarLength: kP384KeyLength,
+    groupSeedLength: kP384KeyLength,
+    groupOrder: kP384Order,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x31, 0x30,
+      0x32, 0x34, 0x2d, 0x50, 0x33, 0x38, 0x34, // "MLKEM1024-P384"
+    ),
+  }),
+};
+
+/**
+ * Wraps native or lower-level failures as WebCrypto OperationError failures.
+ * @param {unknown} [cause]
+ * @returns {DOMException}
+ */
+function operationFailure(cause) {
+  return lazyDOMException(
+    'The operation failed for an operation-specific reason',
+    { name: 'OperationError', cause });
+}
+
+/**
+ * Wraps native or lower-level failures as WebCrypto DataError failures.
+ * @param {unknown} [cause]
+ * @returns {DOMException}
+ */
+function dataFailure(cause) {
+  return lazyDOMException('Invalid keyData', { name: 'DataError', cause });
+}
+
+/**
+ * Copies supported BufferSource-like data into a new Uint8Array.
+ * @param {ArrayBuffer | ArrayBufferView} data
+ * @returns {Uint8Array}
+ */
+function copyBytes(data) {
+  return new Uint8Array(getBufferSourceBytes(data));
+}
+
+/**
+ * Concatenates byte arrays into a new Uint8Array of the expected length.
+ * @param {Uint8Array[]} chunks
+ * @param {number} length
+ * @returns {Uint8Array}
+ */
+function concatBytes(chunks, length) {
+  const output = new Uint8Array(length);
+  let offset = 0;
+  for (let n = 0; n < chunks.length; n++) {
+    const chunk = chunks[n];
+    TypedArrayPrototypeSet(output, chunk, offset);
+    offset += TypedArrayPrototypeGetByteLength(chunk);
+  }
+  return output;
+}
+
+/**
+ * Compares byte arrays by value.
+ * @param {Uint8Array} a
+ * @param {Uint8Array} b
+ * @returns {boolean}
+ */
+function bytesEqual(a, b) {
+  return TypedArrayPrototypeGetByteLength(a) === TypedArrayPrototypeGetByteLength(b) &&
+    timingSafeEqual(a, b);
+}
+
+/**
+ * Decodes a JWK base64url member.
+ * @param {string} input
+ * @returns {Uint8Array}
+ */
+function decodeJwkBase64Url(input) {
+  return Buffer.from(input, 'base64url');
+}
+
+/**
+ * Encodes JWK key material as unpadded base64url.
+ * @param {Uint8Array} input
+ * @returns {string}
+ */
+function base64urlEncode(input) {
+  return Buffer.from(input).toString('base64url');
+}
+
+/**
+ * Copies a Uint8Array's represented bytes into an ArrayBuffer result.
+ * @param {Uint8Array} data
+ * @returns {ArrayBuffer}
+ */
+function toArrayBuffer(data) {
+  return TypedArrayPrototypeGetBuffer(copyBytes(data));
+}
+
+/**
+ * Validates fixed-size key material.
+ * @param {Uint8Array} data
+ * @param {number} length
+ */
+function validateLength(data, length) {
+  if (TypedArrayPrototypeGetByteLength(data) !== length) {
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  }
+}
+
+/**
+ * Splits bytes into the PQ KEM and traditional group portions.
+ * @param {Uint8Array} data
+ * @param {number} offset
+ * @returns {{ head: Uint8Array, tail: Uint8Array }}
+ */
+function splitAt(data, offset) {
+  return {
+    __proto__: null,
+    head: TypedArrayPrototypeSubarray(data, 0, offset),
+    tail: TypedArrayPrototypeSubarray(data, offset),
+  };
+}
+
+/**
+ * Splits a Hybrid KEM raw-public key into its PQ and group public-key parts.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {{ kemPq: Uint8Array, group: Uint8Array }}
+ */
+function splitEncapsulationKey(rawEncapsulationKey, config) {
+  validateLength(rawEncapsulationKey, config.encapsulationKeyLength);
+  const { head, tail } = splitAt(
+    rawEncapsulationKey,
+    config.kemPqEncapsulationKeyLength);
+  return { __proto__: null, kemPq: head, group: tail };
+}
+
+/**
+ * Copies and splits a Hybrid KEM ciphertext into its PQ and group parts.
+ * @param {ArrayBuffer | ArrayBufferView} ciphertext
+ * @param {object} config
+ * @returns {{ kemPq: Uint8Array, group: Uint8Array }}
+ */
+function splitCiphertext(ciphertext, config) {
+  const ciphertextBuffer = copyBytes(ciphertext);
+  if (TypedArrayPrototypeGetByteLength(ciphertextBuffer) !==
+      config.ciphertextLength) {
+    throw operationFailure();
+  }
+  const { head, tail } = splitAt(
+    ciphertextBuffer,
+    config.kemPqCiphertextLength);
+  return { __proto__: null, kemPq: head, group: copyBytes(tail) };
+}
+
+/**
+ * Converts an octet string to a non-negative integer.
+ * @param {Uint8Array} data
+ * @returns {bigint}
+ */
+function os2ip(data) {
+  let value = 0n;
+  for (let n = 0; n < TypedArrayPrototypeGetLength(data); n++)
+    value = (value << 8n) | BigInt(data[n]);
+  return value;
+}
+
+/**
+ * Derives a valid traditional group scalar from expanded seed bytes.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function randomScalar(seed, config) {
+  if (config.groupOrder === undefined)
+    return copyBytes(seed);
+
+  const { groupOrder, groupScalarLength } = config;
+  for (let offset = 0;
+    offset + groupScalarLength <= TypedArrayPrototypeGetLength(seed);
+    offset += groupScalarLength) {
+    const scalar = copyBytes(
+      TypedArrayPrototypeSubarray(seed, offset, offset + groupScalarLength));
+    const value = os2ip(scalar);
+    if (value !== 0n && value < groupOrder)
+      return scalar;
+  }
+
+  throw operationFailure();
+}
+
+/**
+ * Imports raw key material into a native KeyObjectHandle.
+ * @param {number} keyType
+ * @param {Uint8Array} keyData
+ * @param {number} format
+ * @param {string} asymmetricKeyType
+ * @param {string} [namedCurve]
+ * @returns {KeyObjectHandle}
+ */
+function importRawKeyHandle(
+  keyType,
+  keyData,
+  format,
+  asymmetricKeyType,
+  namedCurve) {
+  const handle = new KeyObjectHandle();
+  handle.init(
+    keyType,
+    keyData,
+    format,
+    asymmetricKeyType,
+    null,
+    namedCurve ?? null);
+  if (asymmetricKeyType === kEcKeyType && !handle.checkEcKeyData())
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  return handle;
+}
+
+/**
+ * Imports the PQ KEM decapsulation seed.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importKemPqDecapsulationHandle(seed, config) {
+  return importRawKeyHandle(
+    kKeyTypePrivate,
+    seed,
+    kKeyFormatRawSeed,
+    config.kemPqKeyType);
+}
+
+/**
+ * Imports the PQ KEM encapsulation key.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importKemPqEncapsulationHandle(rawEncapsulationKey, config) {
+  return importRawKeyHandle(
+    kKeyTypePublic,
+    rawEncapsulationKey,
+    kKeyFormatRawPublic,
+    config.kemPqKeyType);
+}
+
+/**
+ * Imports the traditional group private scalar.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importGroupPrivateHandle(seed, config) {
+  return importRawKeyHandle(
+    kKeyTypePrivate,
+    seed,
+    kKeyFormatRawPrivate,
+    config.groupKeyType,
+    config.namedCurve);
+}
+
+/**
+ * Imports the traditional group public element.
+ * @param {Uint8Array} groupElement
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importGroupElementHandle(groupElement, config) {
+  if (config.groupKeyType === kEcKeyType &&
+      groupElement[0] !== kEcUncompressedPointPrefix) {
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  }
+  return importRawKeyHandle(
+    kKeyTypePublic,
+    groupElement,
+    kKeyFormatRawPublic,
+    config.groupKeyType,
+    config.namedCurve);
+}
+
+/**
+ * Exports the raw public key bytes from the PQ KEM handle.
+ * @param {KeyObjectHandle} handle
+ * @returns {Uint8Array}
+ */
+function rawKemPqEncapsulationKey(handle) {
+  return copyBytes(handle.rawPublicKey());
+}
+
+/**
+ * Exports the raw public element from the traditional group handle.
+ * @param {KeyObjectHandle} handle
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function rawGroupElement(handle, config) {
+  if (config.groupKeyType === kEcKeyType) {
+    return copyBytes(
+      handle.exportECPublicRaw(POINT_CONVERSION_UNCOMPRESSED));
+  }
+  return copyBytes(handle.rawPublicKey());
+}
+
+/**
+ * Builds the Hybrid KEM raw-public key from component public handles.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config) {
+  return concatBytes([
+    rawKemPqEncapsulationKey(kemPqHandle),
+    rawGroupElement(groupHandle, config),
+  ], config.encapsulationKeyLength);
+}
+
+/**
+ * Imports both components of a Hybrid KEM public key.
+ * @param {Uint8Array} kemPq
+ * @param {Uint8Array} group
+ * @param {object} config
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function importPublicKeyHandles(kemPq, group, config) {
+  try {
+    return {
+      __proto__: null,
+      kemPqHandle: importKemPqEncapsulationHandle(kemPq, config),
+      groupHandle: importGroupElementHandle(group, config),
+    };
+  } catch (err) {
+    throw dataFailure(err);
+  }
+}
+
+/**
+ * Imports both components of a Hybrid KEM private key.
+ * @param {Uint8Array} seedPq
+ * @param {Uint8Array} groupSeed
+ * @param {object} config
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function importPrivateKeyHandles(seedPq, groupSeed, config) {
+  try {
+    return {
+      __proto__: null,
+      kemPqHandle: importKemPqDecapsulationHandle(seedPq, config),
+      groupHandle: importGroupPrivateHandle(groupSeed, config),
+    };
+  } catch (err) {
+    throw operationFailure(err);
+  }
+}
+
+/**
+ * Creates a Hybrid KEM public CryptoKey from imported component handles.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPublicKeyFromComponents(
+  kemPqHandle,
+  groupHandle,
+  config,
+  extractable,
+  keyUsages) {
+  const usagesSet = new SafeSet(keyUsages);
+  return new InternalCryptoKey(
+    kemPqHandle,
+    { name: config.name },
+    getUsagesMask(usagesSet),
+    extractable,
+    groupHandle);
+}
+
+/**
+ * Creates a Hybrid KEM private CryptoKey from imported component handles and seed.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPrivateKeyFromComponents(
+  kemPqHandle,
+  groupHandle,
+  seed,
+  config,
+  extractable,
+  keyUsages) {
+  const usagesSet = new SafeSet(keyUsages);
+  return new InternalCryptoKey(
+    kemPqHandle,
+    { name: config.name },
+    getUsagesMask(usagesSet),
+    extractable,
+    groupHandle,
+    seed);
+}
+
+/**
+ * Creates a Hybrid KEM public CryptoKey from concatenated raw-public bytes.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPublicKeyFromRaw(
+  rawEncapsulationKey,
+  config,
+  extractable,
+  keyUsages) {
+  const { kemPq, group } = splitEncapsulationKey(rawEncapsulationKey, config);
+  const { kemPqHandle, groupHandle } =
+    importPublicKeyHandles(kemPq, group, config);
+
+  return createPublicKeyFromComponents(
+    kemPqHandle,
+    groupHandle,
+    config,
+    extractable,
+    keyUsages);
+}
+
+/**
+ * Expands the 32-byte Hybrid KEM seed into PQ KEM seed and group seed material.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {{ seedPq: Uint8Array, groupSeed: Uint8Array }}
+ */
+function expandSeed(seed, config) {
+  validateLength(seed, kSeedLength);
+
+  // DeriveKeyPair(seed) expands seed into seed_PQ and seed_T.
+  // https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-4.1
+  const expanded = copyBytes(hash('shake256', seed, {
+    outputEncoding: 'buffer',
+    outputLength: kKemPqSeedLength + config.groupSeedLength,
+  }));
+
+  const { head, tail } = splitAt(expanded, kKemPqSeedLength);
+  return {
+    __proto__: null,
+    seedPq: copyBytes(head),
+    groupSeed: randomScalar(tail, config),
+  };
+}
+
+/**
+ * Derives the Hybrid KEM private key and, when requested, the matching public key.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} decapsulationKeyUsages
+ * @param {Set<string> | string[]} [encapsulationKeyUsages]
+ * @returns {{ privateKey: InternalCryptoKey, publicKey?: InternalCryptoKey }}
+ */
+function deriveKeyPair(
+  seed,
+  config,
+  extractable,
+  decapsulationKeyUsages,
+  encapsulationKeyUsages) {
+  const { seedPq, groupSeed } = expandSeed(seed, config);
+  const { kemPqHandle, groupHandle } =
+    importPrivateKeyHandles(seedPq, groupSeed, config);
+
+  const privateKey = createPrivateKeyFromComponents(
+    kemPqHandle,
+    groupHandle,
+    seed,
+    config,
+    extractable,
+    decapsulationKeyUsages);
+
+  if (encapsulationKeyUsages === undefined)
+    return { __proto__: null, privateKey };
+
+  const publicKey = createPublicKeyFromRaw(
+    rawEncapsulationKeyFromHandles(
+      kemPqHandle,
+      groupHandle,
+      config),
+    config,
+    true,
+    encapsulationKeyUsages);
+  return { __proto__: null, privateKey, publicKey };
+}
+
+/**
+ * Extracts both component handles stored in a Hybrid KEM CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function getHybridKeyHandles(key) {
+  const kemPqHandle = getCryptoKeyHandle(key);
+  const groupHandle = getCryptoKeySecondaryHandle(key);
+  if (groupHandle === undefined) {
+    throw operationFailure();
+  }
+  return { __proto__: null, kemPqHandle, groupHandle };
+}
+
+/**
+ * Extracts and copies the stored 32-byte Hybrid KEM seed from a private key.
+ * @param {CryptoKey} key
+ * @returns {Uint8Array}
+ */
+function getHybridSeed(key) {
+  const seed = getCryptoKeySeedData(key);
+  if (seed === undefined) {
+    throw operationFailure();
+  }
+  return copyBytes(seed);
+}
+
+/**
+ * Returns the algorithm config and component handles for a Hybrid KEM CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {object}
+ */
+function getHybridKeyContext(key) {
+  const config = kAlgorithms[getCryptoKeyAlgorithm(key).name];
+  const { kemPqHandle, groupHandle } = getHybridKeyHandles(key);
+  return { __proto__: null, config, kemPqHandle, groupHandle };
+}
+
+/**
+ * Validates the CryptoKey type and returns its Hybrid KEM key context.
+ * @param {CryptoKey} key
+ * @param {'public' | 'private'} type
+ * @param {string} message
+ * @returns {object}
+ */
+function requireHybridKeyContext(key, type, message) {
+  if (getCryptoKeyType(key) !== type)
+    throw lazyDOMException(message, 'InvalidAccessError');
+  return getHybridKeyContext(key);
+}
+
+/**
+ * Runs ECDH/X25519 over the traditional group component.
+ * @param {KeyObjectHandle} publicHandle
+ * @param {KeyObjectHandle} privateHandle
+ * @returns {Promise<Uint8Array>}
+ */
+function deriveGroupBits(publicHandle, privateHandle) {
+  const bits = jobPromise(() => new DHBitsJob(
+    kCryptoJobWebCrypto,
+    publicHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    privateHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined));
+  return jobPromiseThen(
+    bits,
+    (bits) => copyBytes(bits),
+    (err) => { throw operationFailure(err); });
+}
+
+/**
+ * Applies the C2PRI combiner to the PQ and traditional shared secrets.
+ * @param {Uint8Array} sharedSecretPq
+ * @param {Uint8Array} sharedSecretT
+ * @param {Uint8Array} ciphertextT
+ * @param {Uint8Array} encapsulationKey
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function combineSharedSecret(
+  sharedSecretPq,
+  sharedSecretT,
+  ciphertextT,
+  encapsulationKey,
+  config) {
+  // C2PRICombiner(ss_PQ, ss_T, ct_T, ek_T, Label).
+  // https://www.ietf.org/archive/id/draft-irtf-cfrg-hybrid-kems-12.html#section-5.1.3
+  const encapsulationKeyT = TypedArrayPrototypeSubarray(
+    encapsulationKey,
+    config.kemPqEncapsulationKeyLength);
+  const inputLength =
+    TypedArrayPrototypeGetByteLength(sharedSecretPq) +
+    TypedArrayPrototypeGetByteLength(sharedSecretT) +
+    TypedArrayPrototypeGetByteLength(ciphertextT) +
+    TypedArrayPrototypeGetByteLength(encapsulationKeyT) +
+    TypedArrayPrototypeGetByteLength(config.label);
+
+  const input = concatBytes([
+    sharedSecretPq,
+    sharedSecretT,
+    ciphertextT,
+    encapsulationKeyT,
+    config.label,
+  ], inputLength);
+
+  return copyBytes(hash('sha3-256', input, {
+    outputEncoding: 'buffer',
+  }));
+}
+
+/**
+ * Splits requested Hybrid KEM key usages into private and public key usages.
+ * @param {string} name
+ * @param {string[]} keyUsages
+ * @returns {{ privateUsages: Set<string>, publicUsages: Set<string> }}
+ */
+function getGenerateKeyUsages(name, keyUsages) {
+  const usageSet = validateKeyUsages(keyUsages, kUsages.keygen, name);
+  const usages = getKeyPairUsages(usageSet, kUsages);
+  validateUsagesNotEmpty(usages.private);
+
+  return {
+    __proto__: null,
+    privateUsages: usages.private,
+    publicUsages: usages.public,
+  };
+}
+
+/**
+ * Imports a Hybrid KEM JWK, validating public/private consistency when `priv`
+ * is present.
+ * @param {object} input
+ * @param {string} name
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string>} usagesSet
+ * @returns {InternalCryptoKey}
+ */
+function importJwkKey(input, name, config, extractable, usagesSet) {
+  const isPublic = input.priv === undefined;
+  verifyAcceptableKeyUse(
+    name,
+    usagesSet,
+    isPublic ? kUsages.public : kUsages.private);
+  validateJwk(input, 'AKP', extractable, usagesSet, 'enc');
+  if (input.alg !== name) {
+    throw lazyDOMException(
+      'JWK "alg" Parameter and algorithm name mismatch',
+      'DataError');
+  }
+
+  const rawEncapsulationKey = decodeJwkBase64Url(input.pub);
+  validateLength(rawEncapsulationKey, config.encapsulationKeyLength);
+  if (isPublic) {
+    return createPublicKeyFromRaw(
+      rawEncapsulationKey,
+      config,
+      extractable,
+      usagesSet);
+  }
+
+  const { privateKey } = deriveKeyPair(
+    decodeJwkBase64Url(input.priv),
+    config,
+    extractable,
+    usagesSet);
+  const { kemPqHandle, groupHandle } = getHybridKeyHandles(privateKey);
+  const derivedRawEncapsulationKey =
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config);
+  if (!bytesEqual(derivedRawEncapsulationKey, rawEncapsulationKey))
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  return privateKey;
+}
+
+/**
+ * Exports a Hybrid KEM key as an AKP JWK.
+ * @param {CryptoKey} key
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {object}
+ */
+function exportJwkKey(key, rawEncapsulationKey, config) {
+  const jwk = {
+    kty: 'AKP',
+    alg: config.name,
+    pub: base64urlEncode(rawEncapsulationKey),
+    key_ops: ArrayPrototypeSlice(getCryptoKeyUsages(key), 0),
+    ext: getCryptoKeyExtractable(key),
+  };
+  if (getCryptoKeyType(key) === 'private')
+    setOwnProperty(jwk, 'priv', base64urlEncode(getHybridSeed(key)));
+  return jwk;
+}
+
+/**
+ * Implements generateKey for Hybrid KEM algorithms.
+ * @param {object} algorithm
+ * @param {boolean} extractable
+ * @param {string[]} keyUsages
+ * @returns {{ publicKey: InternalCryptoKey, privateKey: InternalCryptoKey }}
+ */
+function kemHybridGenerateKey(algorithm, extractable, keyUsages) {
+  const { name } = algorithm;
+  const config = kAlgorithms[name];
+  const { privateUsages, publicUsages } =
+    getGenerateKeyUsages(name, keyUsages);
+
+  const keyPair = deriveKeyPair(
+    copyBytes(randomBytes(kSeedLength)),
+    config,
+    extractable,
+    privateUsages,
+    publicUsages);
+  return { publicKey: keyPair.publicKey, privateKey: keyPair.privateKey };
+}
+
+/**
+ * Implements importKey for Hybrid KEM algorithms.
+ * @param {'raw-public' | 'raw-seed' | 'jwk'} format
+ * @param {ArrayBuffer | ArrayBufferView | object} input
+ * @param {object} algorithm
+ * @param {boolean} extractable
+ * @param {string[]} keyUsages
+ * @returns {InternalCryptoKey | undefined}
+ */
+function kemHybridImportKey(
+  format,
+  input,
+  algorithm,
+  extractable,
+  keyUsages) {
+
+  const { name } = algorithm;
+  const config = kAlgorithms[name];
+  const usagesSet = new SafeSet(keyUsages);
+
+  switch (format) {
+    case 'raw-public': {
+      verifyAcceptableKeyUse(name, usagesSet, kUsages.public);
+      return createPublicKeyFromRaw(
+        copyBytes(input),
+        config,
+        extractable,
+        usagesSet);
+    }
+    case 'raw-seed': {
+      verifyAcceptableKeyUse(name, usagesSet, kUsages.private);
+      return deriveKeyPair(
+        copyBytes(input),
+        config,
+        extractable,
+        usagesSet).privateKey;
+    }
+    case 'jwk':
+      return importJwkKey(input, name, config, extractable, usagesSet);
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * Implements exportKey for Hybrid KEM algorithms.
+ * @param {CryptoKey} key
+ * @param {'raw-public' | 'raw-seed' | 'jwk'} format
+ * @returns {ArrayBuffer | object | undefined}
+ */
+function kemHybridExportKey(key, format) {
+  const { config, kemPqHandle, groupHandle } = getHybridKeyContext(key);
+  const rawEncapsulationKey =
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config);
+  switch (format) {
+    case 'raw-public':
+      return toArrayBuffer(rawEncapsulationKey);
+    case 'raw-seed':
+      if (getCryptoKeyType(key) === 'private') {
+        return toArrayBuffer(getHybridSeed(key));
+      }
+      return undefined;
+    case 'jwk':
+      return exportJwkKey(key, rawEncapsulationKey, config);
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * Implements getPublicKey for Hybrid KEM private keys.
+ * @param {CryptoKey} privateKey
+ * @param {string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function kemHybridGetPublicKey(privateKey, keyUsages) {
+  const { config, kemPqHandle, groupHandle } =
+    getHybridKeyContext(privateKey);
+  const usageSet = new SafeSet(keyUsages);
+  verifyAcceptableKeyUse(config.name, usageSet, kUsages.public);
+  return createPublicKeyFromRaw(
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+    config,
+    true,
+    usageSet);
+}
+
+/**
+ * Generates the ephemeral traditional group private key for encapsulation.
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function generateEphemeralGroupScalar(config) {
+  const seed = randomScalar(
+    copyBytes(randomBytes(config.groupSeedLength)),
+    config);
+  return importGroupPrivateHandle(seed, config);
+}
+
+/**
+ * Continues a WebCrypto job promise and routes synchronous continuation
+ * failures to the provided reject callback.
+ * @param {Promise} promise
+ * @param {Function} reject
+ * @param {Function} onFulfilled
+ */
+function continueJob(promise, reject, onFulfilled) {
+  jobPromiseThen(promise, (value) => {
+    try {
+      onFulfilled(value);
+    } catch (err) {
+      reject(err);
+    }
+  }, reject);
+}
+
+/**
+ * Continues a WebCrypto job promise and resolves with WebCrypto result
+ * shielding for object results.
+ * @param {Promise} promise
+ * @param {Function} resolve
+ * @param {Function} reject
+ * @param {Function} onFulfilled
+ */
+function resolveJob(promise, resolve, reject, onFulfilled) {
+  continueJob(promise, reject, (value) => {
+    resolveWebCryptoResult(resolve, onFulfilled(value));
+  });
+}
+
+/**
+ * Prepares the traditional group side of encapsulation and starts its derive job.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @returns {object}
+ */
+function prepareEncapsulationGroup(kemPqHandle, groupHandle, config) {
+  const ephemeralGroupHandle = generateEphemeralGroupScalar(config);
+  const ciphertextT = rawGroupElement(ephemeralGroupHandle, config);
+  const sharedSecretT = deriveGroupBits(
+    groupHandle,
+    ephemeralGroupHandle);
+  return {
+    __proto__: null,
+    ciphertextT,
+    sharedSecretT,
+    rawEncapsulationKey:
+      rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+  };
+}
+
+/**
+ * Combines the PQ and traditional encapsulation outputs into WebCrypto's
+ * encapsulation result object.
+ * @param {object} encapsPq
+ * @param {Uint8Array} sharedSecretT
+ * @param {object} group
+ * @param {object} config
+ * @returns {{ sharedKey: ArrayBuffer, ciphertext: ArrayBuffer }}
+ */
+function hybridEncapsulationResult(encapsPq, sharedSecretT, group, config) {
+  const sharedKey = combineSharedSecret(
+    copyBytes(encapsPq.sharedKey),
+    sharedSecretT,
+    group.ciphertextT,
+    group.rawEncapsulationKey,
+    config);
+  const ciphertext = concatBytes([
+    copyBytes(encapsPq.ciphertext),
+    group.ciphertextT,
+  ], config.ciphertextLength);
+
+  return {
+    sharedKey: toArrayBuffer(sharedKey),
+    ciphertext: toArrayBuffer(ciphertext),
+  };
+}
+
+/**
+ * Imports the traditional group ciphertext component as a public key handle.
+ * @param {Uint8Array} ciphertextT
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importCiphertextGroupHandle(ciphertextT, config) {
+  try {
+    return importGroupElementHandle(ciphertextT, config);
+  } catch (err) {
+    throw operationFailure(err);
+  }
+}
+
+/**
+ * Implements encapsulateBits for Hybrid KEM algorithms.
+ * @param {CryptoKey} encapsulationKey
+ * @returns {Promise<{ sharedKey: ArrayBuffer, ciphertext: ArrayBuffer }>}
+ */
+function kemHybridEncaps(encapsulationKey) {
+  const { config, kemPqHandle, groupHandle } = requireHybridKeyContext(
+    encapsulationKey,
+    'public',
+    'Key must be a public key');
+  const encapsPq = jobPromise(() => new KEMEncapsulateJob(
+    kCryptoJobWebCrypto,
+    kemPqHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined));
+  const {
+    promise,
+    resolve,
+    reject,
+  } = PromiseWithResolvers();
+
+  continueJob(encapsPq, reject, (encapsPq) => {
+    const group = prepareEncapsulationGroup(
+      kemPqHandle,
+      groupHandle,
+      config);
+    resolveJob(group.sharedSecretT, resolve, reject, (sharedSecretT) =>
+      hybridEncapsulationResult(encapsPq, sharedSecretT, group, config));
+  });
+
+  return promise;
+}
+
+/**
+ * Implements decapsulateBits for Hybrid KEM algorithms.
+ * @param {CryptoKey} decapsulationKey
+ * @param {ArrayBuffer | ArrayBufferView} ciphertext
+ * @returns {Promise<ArrayBuffer>}
+ */
+function kemHybridDecaps(decapsulationKey, ciphertext) {
+  const { config, kemPqHandle, groupHandle } = requireHybridKeyContext(
+    decapsulationKey,
+    'private',
+    'Key must be a private key');
+  const { kemPq: ciphertextPq, group: ciphertextT } =
+    splitCiphertext(ciphertext, config);
+  const groupPublicHandle =
+    importCiphertextGroupHandle(ciphertextT, config);
+
+  const sharedSecretPq = jobPromise(() => new KEMDecapsulateJob(
+    kCryptoJobWebCrypto,
+    kemPqHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    ciphertextPq));
+  const {
+    promise,
+    resolve,
+    reject,
+  } = PromiseWithResolvers();
+
+  continueJob(sharedSecretPq, reject, (sharedSecretPq) => {
+    const sharedSecretT = deriveGroupBits(
+      groupPublicHandle,
+      groupHandle);
+    resolveJob(sharedSecretT, resolve, reject, (sharedSecretT) =>
+      toArrayBuffer(combineSharedSecret(
+        copyBytes(sharedSecretPq),
+        sharedSecretT,
+        ciphertextT,
+        rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+        config)));
+  });
+
+  return promise;
+}
+
+module.exports = {
+  kemHybridDecaps,
+  kemHybridEncaps,
+  kemHybridExportKey,
+  kemHybridGenerateKey,
+  kemHybridGetPublicKey,
+  kemHybridImportKey,
+};
diff --git a/lib/internal/crypto/keygen.js b/lib/internal/crypto/keygen.js
index fe1e87c94299..3f127a472ec1 100644
--- a/lib/internal/crypto/keygen.js
+++ b/lib/internal/crypto/keygen.js
@@ -4,41 +4,21 @@ const {
   FunctionPrototypeCall,
   ObjectDefineProperty,
   SafeArrayIterator,
+  StringPrototypeToLowerCase,
 } = primordials;
 
 const {
   DhKeyPairGenJob,
   DsaKeyPairGenJob,
   EcKeyPairGenJob,
-  NidKeyPairGenJob,
+  NamedKeyPairGenJob,
+  getPqcKeyTypes,
   RsaKeyPairGenJob,
   SecretKeyGenJob,
   kCryptoJobAsync,
   kCryptoJobSync,
   kKeyVariantRSA_PSS,
   kKeyVariantRSA_SSA_PKCS1_v1_5,
-  EVP_PKEY_ED25519,
-  EVP_PKEY_ED448,
-  EVP_PKEY_ML_DSA_44,
-  EVP_PKEY_ML_DSA_65,
-  EVP_PKEY_ML_DSA_87,
-  EVP_PKEY_ML_KEM_1024,
-  EVP_PKEY_ML_KEM_512,
-  EVP_PKEY_ML_KEM_768,
-  EVP_PKEY_SLH_DSA_SHA2_128F,
-  EVP_PKEY_SLH_DSA_SHA2_128S,
-  EVP_PKEY_SLH_DSA_SHA2_192F,
-  EVP_PKEY_SLH_DSA_SHA2_192S,
-  EVP_PKEY_SLH_DSA_SHA2_256F,
-  EVP_PKEY_SLH_DSA_SHA2_256S,
-  EVP_PKEY_SLH_DSA_SHAKE_128F,
-  EVP_PKEY_SLH_DSA_SHAKE_128S,
-  EVP_PKEY_SLH_DSA_SHAKE_192F,
-  EVP_PKEY_SLH_DSA_SHAKE_192S,
-  EVP_PKEY_SLH_DSA_SHAKE_256F,
-  EVP_PKEY_SLH_DSA_SHAKE_256S,
-  EVP_PKEY_X25519,
-  EVP_PKEY_X448,
   OPENSSL_EC_NAMED_CURVE,
   OPENSSL_EC_EXPLICIT_CURVE,
 } = internalBinding('crypto');
@@ -180,31 +160,16 @@ function parseKeyEncoding(keyType, options = kEmptyObject) {
   ];
 }
 
-const nidOnlyKeyPairs = {
+const namedKeyPairs = {
   '__proto__': null,
-  'ed25519': EVP_PKEY_ED25519,
-  'ed448': EVP_PKEY_ED448,
-  'x25519': EVP_PKEY_X25519,
-  'x448': EVP_PKEY_X448,
-  'ml-dsa-44': EVP_PKEY_ML_DSA_44,
-  'ml-dsa-65': EVP_PKEY_ML_DSA_65,
-  'ml-dsa-87': EVP_PKEY_ML_DSA_87,
-  'ml-kem-512': EVP_PKEY_ML_KEM_512,
-  'ml-kem-768': EVP_PKEY_ML_KEM_768,
-  'ml-kem-1024': EVP_PKEY_ML_KEM_1024,
-  'slh-dsa-sha2-128f': EVP_PKEY_SLH_DSA_SHA2_128F,
-  'slh-dsa-sha2-128s': EVP_PKEY_SLH_DSA_SHA2_128S,
-  'slh-dsa-sha2-192f': EVP_PKEY_SLH_DSA_SHA2_192F,
-  'slh-dsa-sha2-192s': EVP_PKEY_SLH_DSA_SHA2_192S,
-  'slh-dsa-sha2-256f': EVP_PKEY_SLH_DSA_SHA2_256F,
-  'slh-dsa-sha2-256s': EVP_PKEY_SLH_DSA_SHA2_256S,
-  'slh-dsa-shake-128f': EVP_PKEY_SLH_DSA_SHAKE_128F,
-  'slh-dsa-shake-128s': EVP_PKEY_SLH_DSA_SHAKE_128S,
-  'slh-dsa-shake-192f': EVP_PKEY_SLH_DSA_SHAKE_192F,
-  'slh-dsa-shake-192s': EVP_PKEY_SLH_DSA_SHAKE_192S,
-  'slh-dsa-shake-256f': EVP_PKEY_SLH_DSA_SHAKE_256F,
-  'slh-dsa-shake-256s': EVP_PKEY_SLH_DSA_SHAKE_256S,
+  'ed25519': 'Ed25519',
+  'ed448': 'Ed448',
+  'x25519': 'X25519',
+  'x448': 'X448',
 };
+for (const name of new SafeArrayIterator(getPqcKeyTypes())) {
+  namedKeyPairs[StringPrototypeToLowerCase(name)] = name;
+}
 
 function createJob(mode, type, options) {
   validateString(type, 'type');
@@ -375,10 +340,10 @@ function createJob(mode, type, options) {
         ...encoding);
     }
     default: {
-      if (nidOnlyKeyPairs[type] === undefined) {
+      if (namedKeyPairs[type] === undefined) {
         throw new ERR_INVALID_ARG_VALUE('type', type, 'must be a supported key type');
       }
-      return new NidKeyPairGenJob(mode, nidOnlyKeyPairs[type], ...encoding);
+      return new NamedKeyPairGenJob(mode, namedKeyPairs[type], ...encoding);
     }
   }
 }
diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index a7f3b4f47cfb..5ecadbab83ba 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const {
+  ArrayPrototypeMap,
   ArrayPrototypeSlice,
   ObjectDefineProperties,
   ObjectPrototypeHasOwnProperty,
@@ -8,17 +9,21 @@ const {
   StringPrototypeIncludes,
   StringPrototypeStartsWith,
   SymbolToStringTag,
+  TypedArrayPrototypeIncludes,
   Uint8Array,
 } = primordials;
 
+const { Buffer } = require('buffer');
 const {
   KeyObjectHandle,
   createNativeKeyObjectClass,
   // eslint-disable-next-line no-restricted-syntax -- intended here
   getKeyObjectSlots: nativeGetKeyObjectSlots,
+  isKeyObject: isNativeKeyObject,
   createCryptoKeyClass,
   // eslint-disable-next-line no-restricted-syntax -- intended here
   getCryptoKeySlots: nativeGetCryptoKeySlots,
+  isCryptoKey: isNativeCryptoKey,
   kKeyTypeSecret,
   kKeyTypePublic,
   kKeyTypePrivate,
@@ -33,6 +38,7 @@ const {
   kKeyEncodingPKCS8,
   kKeyEncodingSPKI,
   kKeyEncodingSEC1,
+  parsePKCS12: _parsePKCS12,
 } = internalBinding('crypto');
 
 const {
@@ -61,6 +67,7 @@ const {
 
 const {
   getArrayBufferOrView,
+  getBufferSourceBytes,
   bigIntArrayToUnsignedBigInt,
   normalizeAlgorithm,
   hasAnyNotIn,
@@ -115,11 +122,13 @@ for (const m of [[kKeyEncodingPKCS1, 'pkcs1'], [kKeyEncodingPKCS8, 'pkcs8'],
                  [kKeyEncodingSPKI, 'spki'], [kKeyEncodingSEC1, 'sec1']])
   encodingNames[m[0]] = m[1];
 
-// KeyObject state lives on the native NativeKeyObject base class. JS reads
-// the native type enum and a KeyObjectHandle in one call and caches that
-// slot tuple in a private field so no forgeable own Symbols are exposed on
-// public KeyObject instances.
+// KeyObject state lives on the native NativeKeyObject base class. JS caches
+// the constructor-known type enum in a private field, then replaces it with
+// the native type and KeyObjectHandle tuple when the handle is first needed.
+// No forgeable own Symbols are exposed on public KeyObject instances.
 let getKeyObjectSlots; // Populated by the createNativeKeyObjectClass callback.
+let isKeyObject;
+let getKeyObjectTypeValue;
 
 const kKeyObjectSlotType = 0;
 const kKeyObjectSlotHandle = 1;
@@ -159,12 +168,18 @@ const {
     #slots;
 
     constructor(type, handle) {
-      if (type !== 'secret' && type !== 'public' && type !== 'private')
-        throw new ERR_INVALID_ARG_VALUE('type', type);
+      let keyType;
+      switch (type) {
+        case 'secret': keyType = kKeyTypeSecret; break;
+        case 'public': keyType = kKeyTypePublic; break;
+        case 'private': keyType = kKeyTypePrivate; break;
+        default: throw new ERR_INVALID_ARG_VALUE('type', type);
+      }
       if (typeof handle !== 'object' || !(handle instanceof KeyObjectHandle))
         throw new ERR_INVALID_ARG_TYPE('handle', 'object', handle);
 
       super(handle);
+      this.#slots = keyType;
     }
 
     get type() {
@@ -201,6 +216,12 @@ const {
       if (!isCryptoKey(key))
         throw new ERR_INVALID_ARG_TYPE('key', 'CryptoKey', key);
       maybeEmitDEP0204(key);
+      if (getCryptoKeySecondaryHandle(key) !== undefined) {
+        throw new ERR_INVALID_ARG_VALUE(
+          'key',
+          key,
+          'cannot be represented by a single KeyObject');
+      }
       const handle = getCryptoKeyHandle(key);
       switch (getCryptoKeyType(key)) {
         /* eslint-disable no-use-before-define */
@@ -225,12 +246,27 @@ const {
     }
 
     static {
+      isKeyObject = (key) => {
+        if (key == null || typeof key !== 'object') return false;
+        return #slots in key || isNativeKeyObject(key);
+      };
+      getKeyObjectTypeValue = (key) => {
+        if (!key || typeof key !== 'object')
+          throw new ERR_INVALID_THIS('KeyObject');
+        if (#slots in key) {
+          const cached = key.#slots;
+          if (typeof cached === 'number') return cached;
+          if (cached !== undefined) return cached[kKeyObjectSlotType];
+        }
+        return getKeyObjectSlots(key)[kKeyObjectSlotType];
+      };
+
       getKeyObjectSlots = (key) => {
         if (!key || typeof key !== 'object')
           throw new ERR_INVALID_THIS('KeyObject');
         if (#slots in key) {
           const cached = key.#slots;
-          if (cached !== undefined) return cached;
+          if (cached !== undefined && typeof cached !== 'number') return cached;
         }
         const slots = nativeGetKeyObjectSlots(key);
         key.#slots = slots;
@@ -356,7 +392,7 @@ const {
   return [KeyObject, SecretKeyObject, PublicKeyObject, PrivateKeyObject];
 });
 
-function parseKeyFormat(formatStr, defaultFormat, optionName) {
+function parseKeyFormat(formatStr, defaultFormat, objName) {
   if (formatStr === undefined && defaultFormat !== undefined)
     return defaultFormat;
   else if (formatStr === 'pem')
@@ -371,10 +407,10 @@ function parseKeyFormat(formatStr, defaultFormat, optionName) {
     return kKeyFormatRawPrivate;
   else if (formatStr === 'raw-seed')
     return kKeyFormatRawSeed;
-  throw new ERR_INVALID_ARG_VALUE(optionName, formatStr);
+  throw new ERR_INVALID_ARG_VALUE(option('format', objName), formatStr);
 }
 
-function parseKeyType(typeStr, required, keyType, isPublic, optionName) {
+function parseKeyType(typeStr, required, keyType, isPublic, objName) {
   if (typeStr === undefined && !required) {
     return undefined;
   } else if (typeStr === 'pkcs1') {
@@ -395,7 +431,7 @@ function parseKeyType(typeStr, required, keyType, isPublic, optionName) {
     return kKeyEncodingSEC1;
   }
 
-  throw new ERR_INVALID_ARG_VALUE(optionName, typeStr);
+  throw new ERR_INVALID_ARG_VALUE(option('type', objName), typeStr);
 }
 
 function option(name, prefix) {
@@ -409,7 +445,7 @@ function parseKeyFormatAndType(enc, keyType, isPublic, objName) {
   const isInput = keyType === undefined;
   const format = parseKeyFormat(formatStr,
                                 isInput ? kKeyFormatPEM : undefined,
-                                option('format', objName));
+                                objName);
 
   if (format === kKeyFormatRawPublic) {
     if (isPublic === false) {
@@ -445,7 +481,7 @@ function parseKeyFormatAndType(enc, keyType, isPublic, objName) {
                             isRequired,
                             keyType,
                             isPublic,
-                            option('type', objName));
+                            objName);
   return { format, type };
 }
 
@@ -455,6 +491,10 @@ function isStringOrBuffer(val) {
          isAnyArrayBuffer(val);
 }
 
+function encodeKeyString(value, encoding) {
+  return Buffer.from(value, encoding === 'buffer' ? 'utf8' : encoding);
+}
+
 function parseKeyEncoding(enc, keyType, isPublic, objName) {
   validateObject(enc, 'options');
 
@@ -502,8 +542,8 @@ function parseKeyEncoding(enc, keyType, isPublic, objName) {
     }
   }
 
-  if (passphrase !== undefined)
-    passphrase = getArrayBufferOrView(passphrase, 'key.passphrase', encoding);
+  if (typeof passphrase === 'string')
+    passphrase = encodeKeyString(passphrase, encoding);
 
   return { format, type, cipher, passphrase };
 }
@@ -531,11 +571,11 @@ function validateAsymmetricKeyType(type, ctx, key) {
     );
   }
 
-  if (type !== 'private') {
+  if (type !== kKeyTypePrivate) {
     if (ctx === kConsumePrivate || ctx === kCreatePublic)
-      throw new ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE(type, 'private');
-    if (type !== 'public') {
-      throw new ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE(type,
+      throw new ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE(keyObjectTypeToString(type), 'private');
+    if (type !== kKeyTypePublic) {
+      throw new ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE(keyObjectTypeToString(type),
                                                    'private or public');
     }
   }
@@ -577,10 +617,9 @@ function prepareStorePrivateKey(url, name, passphrase, encoding, properties) {
     if (!isStringOrBuffer(passphrase)) {
       throw new ERR_INVALID_ARG_VALUE(option('passphrase', name), passphrase);
     }
-    passphrase = getArrayBufferOrView(
-      passphrase,
-      option('passphrase', name),
-      encoding);
+    if (typeof passphrase === 'string') {
+      passphrase = encodeKeyString(passphrase, encoding);
+    }
   }
 
   if (properties !== undefined) {
@@ -605,106 +644,125 @@ function prepareStorePrivateKey(url, name, passphrase, encoding, properties) {
 }
 
 function prepareAsymmetricKey(key, ctx, name = 'key') {
+  if (typeof key === 'string') {
+    return { format: kKeyFormatPEM, data: encodeKeyString(key) };
+  }
+  if (isArrayBufferView(key)) {
+    return { format: kKeyFormatPEM, data: key };
+  }
   const isPrivateKeyInput = ctx === kConsumePrivate || ctx === kCreatePrivate;
 
   if (isKeyObject(key)) {
     // Best case: A key object, as simple as that.
-    const type = getKeyObjectType(key);
-    validateAsymmetricKeyType(type, ctx, key);
-    return { data: getKeyObjectHandle(key) };
+    const slots = getKeyObjectSlots(key);
+    validateAsymmetricKeyType(slots[kKeyObjectSlotType], ctx, key);
+    return { data: slots[kKeyObjectSlotHandle] };
   }
   if (isCryptoKey(key)) {
     emitDEP0203();
-    validateAsymmetricKeyType(getCryptoKeyType(key), ctx, key);
-    return { data: getCryptoKeyHandle(key) };
+    const slots = getSlots(key);
+    validateAsymmetricKeyType(slots[kSlotType], ctx, key);
+    return { data: slots[kSlotHandle] };
   }
   if (isPrivateKeyInput && isURLInstance(key)) {
     // A private key referenced by a URI for an OpenSSL STORE loader.
     return prepareStorePrivateKey(key, name);
   }
-  if (isStringOrBuffer(key)) {
-    // Expect PEM by default, mostly for backward compatibility.
-    return { format: kKeyFormatPEM, data: getArrayBufferOrView(key, name) };
+  if (isAnyArrayBuffer(key)) {
+    return { format: kKeyFormatPEM, data: key };
   }
   if (typeof key === 'object') {
-    const { key: data, encoding, format, properties } = key;
-
-    // The 'key' property can be a KeyObject as well to allow specifying
-    // additional options such as padding along with the key.
-    if (isKeyObject(data)) {
-      const type = getKeyObjectType(data);
-      validateAsymmetricKeyType(type, ctx, data);
-      return { data: getKeyObjectHandle(data) };
-    }
-    if (isCryptoKey(data)) {
-      emitDEP0203();
-      validateAsymmetricKeyType(getCryptoKeyType(data), ctx, data);
-      return { data: getCryptoKeyHandle(data) };
-    }
-    if (isPrivateKeyInput && isURLInstance(data)) {
-      // A private key referenced by a URI for an OpenSSL STORE loader, with
-      // an optional passphrase/PIN.
-      return prepareStorePrivateKey(
-        data,
-        name,
-        key.passphrase,
-        encoding,
-        properties);
-    }
-    if (format === 'jwk') {
-      validateObject(data, `${name}.key`);
-      return { data, format: kKeyFormatJWK };
-    } else if (format === 'raw-public' || format === 'raw-private' ||
+    return prepareAsymmetricKeyOptions(key, ctx, name, isPrivateKeyInput);
+  }
+
+  throw new ERR_INVALID_ARG_TYPE(
+    name,
+    getKeyTypes({
+      allowKeyObject: ctx !== kCreatePrivate,
+      allowURL: isPrivateKeyInput,
+    }),
+    key);
+}
+
+function prepareAsymmetricKeyOptions(key, ctx, name, isPrivateKeyInput) {
+  const { key: data, encoding, format, properties } = key;
+  let isData = typeof data === 'string' || isArrayBufferView(data);
+
+  // The 'key' property can be a KeyObject as well to allow specifying
+  // additional options such as padding along with the key.
+  if (!isData && isKeyObject(data)) {
+    const slots = getKeyObjectSlots(data);
+    validateAsymmetricKeyType(slots[kKeyObjectSlotType], ctx, data);
+    return { data: slots[kKeyObjectSlotHandle] };
+  }
+  if (!isData && isCryptoKey(data)) {
+    emitDEP0203();
+    const slots = getSlots(data);
+    validateAsymmetricKeyType(slots[kSlotType], ctx, data);
+    return { data: slots[kSlotHandle] };
+  }
+  isData ||= isAnyArrayBuffer(data);
+  if (!isData && isPrivateKeyInput && isURLInstance(data)) {
+    // A private key referenced by a URI for an OpenSSL STORE loader, with
+    // an optional passphrase/PIN.
+    return prepareStorePrivateKey(
+      data,
+      name,
+      key.passphrase,
+      encoding,
+      properties);
+  }
+  if (format === 'jwk') {
+    validateObject(data, `${name}.key`);
+    return { data, format: kKeyFormatJWK };
+  }
+  if (format === 'raw-public' || format === 'raw-private' ||
                format === 'raw-seed') {
-      if ((ctx === kConsumePrivate || ctx === kCreatePrivate) &&
-          format === 'raw-public') {
-        throw new ERR_INVALID_ARG_VALUE(`${name}.format`, format);
-      }
-      if (!isArrayBufferView(data) && !isAnyArrayBuffer(data)) {
-        throw new ERR_INVALID_ARG_TYPE(
-          `${name}.key`,
-          ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView'],
-          data);
-      }
-      validateString(key.asymmetricKeyType, `${name}.asymmetricKeyType`);
-      if (key.asymmetricKeyType === 'ec') {
-        validateString(key.namedCurve, `${name}.namedCurve`);
-      }
-      const rawFormat = parseKeyFormat(format, undefined, `${name}.format`);
-      return {
-        data: getArrayBufferOrView(data, `${name}.key`),
-        format: rawFormat,
-        type: key.asymmetricKeyType,
-        namedCurve: key.namedCurve ?? null,
-      };
+    if (isPrivateKeyInput && format === 'raw-public') {
+      throw new ERR_INVALID_ARG_VALUE(`${name}.format`, format);
     }
-
-    // Either PEM or DER using PKCS#1 or SPKI.
-    if (!isStringOrBuffer(data)) {
+    if (!isData || typeof data === 'string') {
       throw new ERR_INVALID_ARG_TYPE(
         `${name}.key`,
-        getKeyTypes({
-          allowKeyObject: ctx !== kCreatePrivate,
-          allowURL: isPrivateKeyInput,
-        }),
+        ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView'],
         data);
     }
-
-    const isPublic =
-      (ctx === kConsumePrivate || ctx === kCreatePrivate) ? false : undefined;
+    validateString(key.asymmetricKeyType, `${name}.asymmetricKeyType`);
+    if (key.asymmetricKeyType === 'ec') {
+      validateString(key.namedCurve, `${name}.namedCurve`);
+    }
+    const rawFormat = format === 'raw-public' ? kKeyFormatRawPublic :
+      format === 'raw-private' ? kKeyFormatRawPrivate : kKeyFormatRawSeed;
     return {
-      data: getArrayBufferOrView(data, `${name}.key`, encoding),
-      ...parseKeyEncoding(key, undefined, isPublic, name),
+      data,
+      format: rawFormat,
+      type: key.asymmetricKeyType,
+      namedCurve: key.namedCurve ?? null,
     };
   }
 
-  throw new ERR_INVALID_ARG_TYPE(
-    name,
-    getKeyTypes({
-      allowKeyObject: ctx !== kCreatePrivate,
-      allowURL: isPrivateKeyInput,
-    }),
-    key);
+  // Either PEM or DER using PKCS#1 or SPKI.
+  if (!isData) {
+    throw new ERR_INVALID_ARG_TYPE(
+      `${name}.key`,
+      getKeyTypes({
+        allowKeyObject: ctx !== kCreatePrivate,
+        allowURL: isPrivateKeyInput,
+      }),
+      data);
+  }
+
+  const isPublic = isPrivateKeyInput ? false : undefined;
+  const keyData = typeof data === 'string' ?
+    encodeKeyString(data, encoding) : data;
+  const parsed = parseKeyEncoding(key, undefined, isPublic, name);
+  return {
+    data: keyData,
+    format: parsed.format,
+    type: parsed.type,
+    cipher: parsed.cipher,
+    passphrase: parsed.passphrase,
+  };
 }
 
 function preparePrivateKey(key, name) {
@@ -758,6 +816,65 @@ function createPublicKey(key) {
   return new PublicKeyObject(handle);
 }
 
+/**
+ * Parses a PKCS#12 (.p12 / .pfx) bundle. Returns an object holding the first
+ * private key as `privateKey`, the certificate associated with it as
+ * `certificate`, and every other certificate in the bundle as an array in
+ * `additionalCertificates`. `privateKey` and `certificate` are null when the
+ * bundle contains none.
+ * @param {ArrayBuffer|Buffer|TypedArray|DataView} bundle
+ * @param {object} [options]
+ * @returns {object}
+ */
+function parsePKCS12(bundle, options = kEmptyObject) {
+  if (!isArrayBufferView(bundle) && !isAnyArrayBuffer(bundle)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'bundle',
+      ['ArrayBuffer', 'TypedArray', 'DataView', 'Buffer'],
+      bundle);
+  }
+
+  validateObject(options, 'options');
+  const { passphrase } = options;
+
+  // `undefined` means no passphrase, '' a zero-length one. OpenSSL accepts
+  // either PKCS#12 password encoding for both, so they behave the same.
+  let passBuf;
+  if (passphrase !== undefined) {
+    passBuf = getArrayBufferOrView(passphrase, 'options.passphrase', 'utf8');
+    // OpenSSL takes the passphrase as a NUL-terminated C string, so one
+    // containing a NUL byte would be truncated there and the bundle opened
+    // with only the bytes before it. A PKCS#12 password cannot represent an
+    // embedded NUL anyway, so reject it outright.
+    if (TypedArrayPrototypeIncludes(getBufferSourceBytes(passBuf), 0)) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'options.passphrase', passphrase, 'must not contain null bytes');
+    }
+    // The binding reads the passphrase as a view; wrap a bare ArrayBuffer.
+    if (isAnyArrayBuffer(passBuf)) passBuf = Buffer.from(passBuf);
+  }
+
+  // Likewise, the binding reads the bundle as a view.
+  const bundleBuf = isAnyArrayBuffer(bundle) ? Buffer.from(bundle) : bundle;
+
+  const {
+    0: keyHandle,
+    1: certHandle,
+    2: otherHandles,
+  } = _parsePKCS12(bundleBuf, passBuf);
+
+  // Required lazily: internal/crypto/x509 depends on this module.
+  const { InternalX509Certificate } = require('internal/crypto/x509');
+
+  return {
+    privateKey: keyHandle === null ? null : new PrivateKeyObject(keyHandle),
+    certificate:
+      certHandle === null ? null : new InternalX509Certificate(certHandle),
+    additionalCertificates:
+      ArrayPrototypeMap(otherHandles, (h) => new InternalX509Certificate(h)),
+  };
+}
+
 /**
  * Converts a secret KeyObjectHandle to a CryptoKey by dispatching to the
  * algorithm-specific Web Crypto import path.
@@ -954,7 +1071,7 @@ function keyObjectTypeToString(type) {
  * @returns {'secret' | 'public' | 'private'}
  */
 function getKeyObjectType(key) {
-  return keyObjectTypeToString(getKeyObjectSlots(key)[kKeyObjectSlotType]);
+  return keyObjectTypeToString(getKeyObjectTypeValue(key));
 }
 
 /**
@@ -1044,21 +1161,11 @@ function getKeyObjectAsymmetricKeyDetails(key) {
   return cached;
 }
 
-function isKeyObject(obj) {
-  if (obj == null || typeof obj !== 'object')
-    return false;
-
-  try {
-    getKeyObjectSlots(obj);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 // CryptoKey is a plain JS class whose prototype's [[Prototype]] is
 // Object.prototype, as Web Crypto requires. Instance storage (type enum,
-// extractable, algorithm, usages mask, and the KeyObject handle) lives
+// extractable, algorithm, usages mask, the primary KeyObject handle, an
+// optional Hybrid KEM-only secondary KeyObject handle, and optional Hybrid
+// KEM-only seed data) lives
 // on a C++ class, NativeCryptoKey, created by createCryptoKeyClass.
 // InternalCryptoKey is the only constructor we expose to internal
 // code; it extends NativeCryptoKey to get that storage and then has
@@ -1067,12 +1174,12 @@ function isKeyObject(obj) {
 //            -> CryptoKey.prototype
 //            -> Object.prototype
 //
-// All five internal slots are read from C++ in a single call via
-// `getCryptoKeySlots`. The resulting array is cached in a private
-// class field on `InternalCryptoKey` so that it is invisible to
-// reflection (`Object.getOwnPropertySymbols` etc.) and leaves each
-// CryptoKey's hidden class pristine. The `getCryptoKey{Type,
-// Extractable,Algorithm,Usages,Handle}` helpers index into that
+// Normal construction caches all native internal slots in a private class
+// field on `InternalCryptoKey`. Partially initialized transferred keys read
+// them from C++ in a single `getCryptoKeySlots` call on first access. The
+// cache is invisible to reflection (`Object.getOwnPropertySymbols` etc.) and
+// CryptoKey's hidden class pristine. The `getCryptoKey{Type,Extractable,
+// Algorithm,Usages,Handle,SecondaryHandle,SeedData}` helpers index into that
 // array and convert native enums/masks back to Web Crypto strings.
 // The internal algorithm object is stored as a null-prototype clone
 // so it cannot observe polluted Object.prototype properties.
@@ -1081,15 +1188,18 @@ function isKeyObject(obj) {
 // requires repeat reads to return the same object so a consumer's
 // mutation is visible next time).
 let getSlots; // Populated by the createCryptoKeyClass callback below.
+let isCryptoKey;
 
 const kSlotType = 0;
 const kSlotExtractable = 1;
 const kSlotAlgorithm = 2;
 const kSlotUsagesMask = 3;
 const kSlotHandle = 4;
-const kSlotClonedAlgorithm = 5;
-const kSlotClonedUsages = 6;
-const kSlotUsages = 7;
+const kSlotSecondaryHandle = 5;
+const kSlotSeedData = 6;
+const kSlotClonedAlgorithm = 7;
+const kSlotClonedUsages = 8;
+const kSlotUsages = 9;
 
 function cloneAlgorithm(raw) {
   const cloned = { ...raw };
@@ -1130,6 +1240,9 @@ const {
       if (depth < 0)
         return this;
 
+      if (!isCryptoKey(this))
+        throw new ERR_INVALID_THIS('CryptoKey');
+
       const opts = {
         ...options,
         depth: options.depth == null ? null : options.depth - 1,
@@ -1144,14 +1257,20 @@ const {
     }
 
     get type() {
+      if (!isCryptoKey(this))
+        throw new ERR_INVALID_THIS('CryptoKey');
       return getCryptoKeyType(this);
     }
 
     get extractable() {
+      if (!isCryptoKey(this))
+        throw new ERR_INVALID_THIS('CryptoKey');
       return getCryptoKeyExtractable(this);
     }
 
     get algorithm() {
+      if (!isCryptoKey(this))
+        throw new ERR_INVALID_THIS('CryptoKey');
       const slots = getSlots(this);
       let cached = slots[kSlotClonedAlgorithm];
       if (cached === undefined) {
@@ -1162,6 +1281,8 @@ const {
     }
 
     get usages() {
+      if (!isCryptoKey(this))
+        throw new ERR_INVALID_THIS('CryptoKey');
       const slots = getSlots(this);
       let cached = slots[kSlotClonedUsages];
       if (cached === undefined) {
@@ -1175,22 +1296,49 @@ const {
   class InternalCryptoKey extends NativeCryptoKey {
     #slots;
 
-    constructor(handle, algorithm, usagesMask, extractable) {
+    constructor(
+      handle,
+      algorithm,
+      usagesMask,
+      extractable,
+      secondaryHandle,
+      seedData) {
       if (algorithm !== undefined)
         algorithm = cloneInternalAlgorithm(algorithm);
-      super(handle, algorithm, usagesMask, extractable);
+      if (seedData !== undefined)
+        seedData = new Uint8Array(seedData);
+      super(
+        handle,
+        algorithm,
+        usagesMask,
+        extractable,
+        secondaryHandle,
+        seedData);
+      if (algorithm !== undefined) {
+        this.#slots = [
+          handle.getKeyType(),
+          extractable,
+          algorithm,
+          usagesMask,
+          handle,
+          secondaryHandle,
+          seedData,
+        ];
+      }
     }
 
     static {
+      isCryptoKey = (key) => {
+        if (key == null || typeof key !== 'object') return false;
+        return #slots in key || isNativeCryptoKey(key);
+      };
       getSlots = (key) => {
-        if (!key || typeof key !== 'object')
-          throw new ERR_INVALID_THIS('CryptoKey');
-        if (#slots in key) {
-          const cached = key.#slots;
-          if (cached !== undefined) return cached;
-        }
+        const cached = key.#slots;
+        if (cached !== undefined) return cached;
         const slots = nativeGetCryptoKeySlots(key);
         slots[kSlotAlgorithm] = cloneInternalAlgorithm(slots[kSlotAlgorithm]);
+        if (slots[kSlotSeedData] !== undefined)
+          slots[kSlotSeedData] = new Uint8Array(slots[kSlotSeedData]);
         key.#slots = slots;
         return slots;
       };
@@ -1215,12 +1363,10 @@ const {
   return [CryptoKey, InternalCryptoKey];
 });
 
-// The helpers below return a CryptoKey's internal slot value,
-// populating the per-instance cache on first access via a single
-// native call. The public `type` getter converts the native enum to
-// the Web Crypto string. The `usages` helper converts the native usage
-// mask to Web Crypto strings. The public `algorithm` / `usages` getters
-// on `CryptoKey.prototype` cache their returned objects.
+// The helpers below return a CryptoKey's internal slot value. The public
+// `type` getter converts the native enum to the Web Crypto string. The
+// `usages` helper converts the native usage mask to Web Crypto strings. The
+// public `algorithm` / `usages` getters cache their returned objects.
 
 /**
  * Returns the value of a CryptoKey's `[[type]]` internal slot.
@@ -1313,16 +1459,23 @@ function getCryptoKeyHandle(key) {
   return getSlots(key)[kSlotHandle];
 }
 
-function isCryptoKey(obj) {
-  if (obj == null || typeof obj !== 'object')
-    return false;
+/**
+ * Returns the optional Hybrid KEM-only secondary KeyObjectHandle wrapping a
+ * CryptoKey's other underlying key material.
+ * @param {CryptoKey} key
+ * @returns {KeyObjectHandle | undefined}
+ */
+function getCryptoKeySecondaryHandle(key) {
+  return getSlots(key)[kSlotSecondaryHandle];
+}
 
-  try {
-    getSlots(obj);
-    return true;
-  } catch {
-    return false;
-  }
+/**
+ * Returns the optional Hybrid KEM-only seed data stored with a CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {Uint8Array | undefined}
+ */
+function getCryptoKeySeedData(key) {
+  return getSlots(key)[kSlotSeedData];
 }
 
 function importGenericSecretKey(
@@ -1371,6 +1524,7 @@ module.exports = {
   createSecretKey,
   createPublicKey,
   createPrivateKey,
+  parsePKCS12,
   KeyObject,
   CryptoKey,
   InternalCryptoKey,
@@ -1380,6 +1534,11 @@ module.exports = {
   parsePrivateKeyEncoding,
   parseKeyEncoding,
   toPublicCryptoKey,
+  prepareAsymmetricKey,
+  kConsumePublic,
+  kConsumePrivate,
+  kCreatePublic,
+  kCreatePrivate,
   preparePrivateKey,
   preparePublicOrPrivateKey,
   prepareSecretKey,
@@ -1400,5 +1559,7 @@ module.exports = {
   getCryptoKeyUsagesMask,
   hasCryptoKeyUsage,
   getCryptoKeyHandle,
+  getCryptoKeySecondaryHandle,
+  getCryptoKeySeedData,
   importGenericSecretKey,
 };
diff --git a/lib/internal/crypto/mac.js b/lib/internal/crypto/mac.js
index f6f82238b549..3297297abd59 100644
--- a/lib/internal/crypto/mac.js
+++ b/lib/internal/crypto/mac.js
@@ -20,6 +20,7 @@ const {
   normalizeHashName,
   numBitsToBytes,
   truncateToBitLength,
+  validateKmacKeyLength,
 } = require('internal/crypto/util');
 
 const {
@@ -60,6 +61,9 @@ function normalizeKeyLength(handle, algorithm) {
     length = algorithm.length;
   }
 
+  if (algorithm.name === 'KMAC128' || algorithm.name === 'KMAC256')
+    validateKmacKeyLength(length);
+
   return { handle, length };
 }
 
diff --git a/lib/internal/crypto/ml_dsa.js b/lib/internal/crypto/ml_dsa.js
index bc2d78dbd5a5..3a566b369d88 100644
--- a/lib/internal/crypto/ml_dsa.js
+++ b/lib/internal/crypto/ml_dsa.js
@@ -21,10 +21,7 @@ const {
   kWebCryptoKeyFormatRaw,
   kWebCryptoKeyFormatPKCS8,
   kWebCryptoKeyFormatSPKI,
-  NidKeyPairGenJob,
-  EVP_PKEY_ML_DSA_44,
-  EVP_PKEY_ML_DSA_65,
-  EVP_PKEY_ML_DSA_87,
+  NamedKeyPairGenJob,
 } = internalBinding('crypto');
 
 const {
@@ -63,20 +60,13 @@ function mlDsaGenerateKey(algorithm, extractable, usages) {
   const { name } = algorithm;
   const usagesSet = validateKeyUsages(usages, kUsages.keygen, name);
 
-  const nid = {
-    '__proto__': null,
-    'ML-DSA-44': EVP_PKEY_ML_DSA_44,
-    'ML-DSA-65': EVP_PKEY_ML_DSA_65,
-    'ML-DSA-87': EVP_PKEY_ML_DSA_87,
-  }[name];
-
   const keyAlgorithm = { name };
   const keyUsages = getKeyPairUsages(usagesSet, kUsages);
   validateUsagesNotEmpty(keyUsages.private);
 
-  return jobPromise(() => new NidKeyPairGenJob(
+  return jobPromise(() => new NamedKeyPairGenJob(
     kCryptoJobWebCrypto,
-    nid,
+    name,
     keyAlgorithm,
     getUsagesMask(keyUsages.public),
     getUsagesMask(keyUsages.private),
@@ -166,17 +156,18 @@ function mlDsaImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.priv === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? kUsages.public : kUsages.private);
+
       validateJwk(keyData, 'AKP', extractable, usagesSet, 'sig');
 
       if (keyData.alg !== name)
         throw lazyDOMException(
           'JWK "alg" Parameter and algorithm name mismatch', 'DataError');
 
-      const isPublic = keyData.priv === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? kUsages.public : kUsages.private);
       handle = importJwkKey(isPublic, keyData);
 
       if (!isPublic) {
@@ -193,7 +184,9 @@ function mlDsaImportKey(
         name,
         usagesSet,
         isPublic ? kUsages.public : kUsages.private);
-      handle = importRawKey(isPublic, keyData, isPublic ? kKeyFormatRawPublic : kKeyFormatRawSeed, name);
+      handle = importRawKey(isPublic, keyData,
+                            isPublic ? kKeyFormatRawPublic : kKeyFormatRawSeed,
+                            StringPrototypeToLowerCase(name));
       break;
     }
     default:
diff --git a/lib/internal/crypto/ml_kem.js b/lib/internal/crypto/ml_kem.js
index e7d2058801f8..8b38983c53c4 100644
--- a/lib/internal/crypto/ml_kem.js
+++ b/lib/internal/crypto/ml_kem.js
@@ -18,10 +18,7 @@ const {
   kWebCryptoKeyFormatPKCS8,
   kWebCryptoKeyFormatRaw,
   kWebCryptoKeyFormatSPKI,
-  NidKeyPairGenJob,
-  EVP_PKEY_ML_KEM_512,
-  EVP_PKEY_ML_KEM_768,
-  EVP_PKEY_ML_KEM_1024,
+  NamedKeyPairGenJob,
 } = internalBinding('crypto');
 
 const {
@@ -62,20 +59,13 @@ function mlKemGenerateKey(algorithm, extractable, usages) {
   const { name } = algorithm;
   const usagesSet = validateKeyUsages(usages, kUsages.keygen, name);
 
-  const nid = {
-    '__proto__': null,
-    'ML-KEM-512': EVP_PKEY_ML_KEM_512,
-    'ML-KEM-768': EVP_PKEY_ML_KEM_768,
-    'ML-KEM-1024': EVP_PKEY_ML_KEM_1024,
-  }[name];
-
   const keyAlgorithm = { name };
   const keyUsages = getKeyPairUsages(usagesSet, kUsages);
   validateUsagesNotEmpty(keyUsages.private);
 
-  return jobPromise(() => new NidKeyPairGenJob(
+  return jobPromise(() => new NamedKeyPairGenJob(
     kCryptoJobWebCrypto,
-    nid,
+    name,
     keyAlgorithm,
     getUsagesMask(keyUsages.public),
     getUsagesMask(keyUsages.private),
@@ -171,21 +161,24 @@ function mlKemImportKey(
         name,
         usagesSet,
         isPublic ? kUsages.public : kUsages.private);
-      handle = importRawKey(isPublic, keyData, isPublic ? kKeyFormatRawPublic : kKeyFormatRawSeed, name);
+      handle = importRawKey(isPublic, keyData,
+                            isPublic ? kKeyFormatRawPublic : kKeyFormatRawSeed,
+                            StringPrototypeToLowerCase(name));
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.priv === undefined;
+      verifyAcceptableKeyUse(
+        name,
+        usagesSet,
+        isPublic ? kUsages.public : kUsages.private);
+
       validateJwk(keyData, 'AKP', extractable, usagesSet, 'enc');
 
       if (keyData.alg !== name)
         throw lazyDOMException(
           'JWK "alg" Parameter and algorithm name mismatch', 'DataError');
 
-      const isPublic = keyData.priv === undefined;
-      verifyAcceptableKeyUse(
-        name,
-        usagesSet,
-        isPublic ? kUsages.public : kUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
diff --git a/lib/internal/crypto/provider_mac.js b/lib/internal/crypto/provider_mac.js
new file mode 100644
index 000000000000..f972ac00be21
--- /dev/null
+++ b/lib/internal/crypto/provider_mac.js
@@ -0,0 +1,262 @@
+'use strict';
+
+const {
+  FunctionPrototypeCall,
+  ObjectSetPrototypeOf,
+  StringPrototypeIncludes,
+  StringPrototypeToLowerCase,
+  Symbol,
+} = primordials;
+
+const {
+  Mac: _Mac,
+} = internalBinding('crypto');
+
+const {
+  getCachedMacId,
+  getMacCache,
+  kHandle,
+} = require('internal/crypto/util');
+
+const {
+  getKeyObjectHandle,
+  getKeyObjectType,
+  isKeyObject,
+} = require('internal/crypto/keys');
+
+const {
+  normalizeEncoding,
+} = require('internal/util');
+
+const {
+  codes: {
+    ERR_CRYPTO_MAC_FINALIZED,
+    ERR_CRYPTO_MAC_UPDATE_FAILED,
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+  },
+} = require('internal/errors');
+
+const {
+  validateEncoding,
+  validateObject,
+  validateString,
+  validateUint32,
+} = require('internal/validators');
+
+const {
+  isAnyArrayBuffer,
+  isArrayBufferView,
+} = require('internal/util/types');
+
+const LazyTransform = require('internal/streams/lazy_transform');
+
+const kState = Symbol('kState');
+const kFinalized = Symbol('kFinalized');
+
+function validateName(value, name) {
+  validateString(value, name);
+  if (value.length === 0 || StringPrototypeIncludes(value, '\0')) {
+    throw new ERR_INVALID_ARG_VALUE(
+      name, value, 'must be non-empty and contain no NUL bytes');
+  }
+  return value;
+}
+
+function normalizeBytes(value, name) {
+  if (!isArrayBufferView(value) && !isAnyArrayBuffer(value)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      name, ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView'], value);
+  }
+  return value;
+}
+
+function createHandle(algorithm, key, options) {
+  const name = validateName(algorithm, 'algorithm');
+  let digest;
+  let cipher;
+  let iv;
+  let customization;
+  let salt;
+  let outputLength;
+  let hasExtendedOptions = false;
+
+  if (options !== undefined) {
+    validateObject(options, 'options');
+
+    const digestOption = options.digest;
+    if (digestOption !== undefined) {
+      digest = validateName(digestOption, 'options.digest');
+    }
+    const cipherOption = options.cipher;
+    if (cipherOption !== undefined) {
+      cipher = validateName(cipherOption, 'options.cipher');
+      hasExtendedOptions = true;
+    }
+    const ivOption = options.iv;
+    if (ivOption !== undefined) {
+      iv = normalizeBytes(ivOption, 'options.iv');
+      hasExtendedOptions = true;
+    }
+    const customizationOption = options.customization;
+    if (customizationOption !== undefined) {
+      customization = normalizeBytes(
+        customizationOption, 'options.customization');
+      hasExtendedOptions = true;
+    }
+    const saltOption = options.salt;
+    if (saltOption !== undefined) {
+      salt = normalizeBytes(saltOption, 'options.salt');
+      hasExtendedOptions = true;
+    }
+    const outputLengthOption = options.outputLength;
+    if (outputLengthOption !== undefined) {
+      outputLength = outputLengthOption;
+      validateUint32(outputLength, 'options.outputLength');
+      outputLength += 0;
+      hasExtendedOptions = true;
+    }
+  }
+
+  key = normalizeKey(key);
+  const id = getCachedMacId(name);
+  const cache = getMacCache();
+  if (!hasExtendedOptions) {
+    return new _Mac(name, id, cache, key, digest);
+  }
+  return new _Mac(
+    name,
+    id,
+    cache,
+    key,
+    digest,
+    cipher,
+    iv,
+    customization,
+    salt,
+    outputLength,
+  );
+}
+
+function normalizeKey(key) {
+  if (isKeyObject(key)) {
+    if (getKeyObjectType(key) !== 'secret') {
+      throw new ERR_INVALID_ARG_TYPE(
+        'key', ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView', 'KeyObject'], key);
+    }
+    return getKeyObjectHandle(key);
+  }
+  if (!isArrayBufferView(key) && !isAnyArrayBuffer(key)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'key', ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView', 'KeyObject'], key);
+  }
+  return key;
+}
+
+function normalizeOutputEncoding(outputEncoding) {
+  if (outputEncoding === undefined) return 'buffer';
+  validateString(outputEncoding, 'outputEncoding');
+  if (StringPrototypeToLowerCase(outputEncoding) === 'buffer') return 'buffer';
+  const normalized = normalizeEncoding(outputEncoding);
+  if (normalized === undefined) {
+    throw new ERR_INVALID_ARG_VALUE('outputEncoding', outputEncoding);
+  }
+  return normalized;
+}
+
+function normalizeInputEncoding(data, inputEncoding) {
+  if (inputEncoding === undefined) return undefined;
+  validateString(inputEncoding, 'inputEncoding');
+  const normalized = normalizeEncoding(inputEncoding);
+  if (normalized === undefined) {
+    throw new ERR_INVALID_ARG_VALUE('inputEncoding', inputEncoding);
+  }
+  validateEncoding(data, normalized);
+  return normalized;
+}
+
+function updateHandle(mac, data, encoding) {
+  const state = mac[kState];
+  let updated;
+  try {
+    updated = mac[kHandle].update(data, encoding);
+  } catch (error) {
+    state[kFinalized] = true;
+    throw error;
+  }
+  if (!updated) {
+    state[kFinalized] = true;
+    throw new ERR_CRYPTO_MAC_UPDATE_FAILED();
+  }
+}
+
+function finalizeHandle(mac, outputEncoding) {
+  const state = mac[kState];
+  state[kFinalized] = true;
+  return mac[kHandle].final(outputEncoding);
+}
+
+function Mac(algorithm, key, options) {
+  if (!new.target) return new Mac(algorithm, key, options);
+  this[kHandle] = createHandle(algorithm, key, options);
+  this[kState] = {
+    [kFinalized]: false,
+  };
+  FunctionPrototypeCall(LazyTransform, this, options);
+}
+
+ObjectSetPrototypeOf(Mac.prototype, LazyTransform.prototype);
+ObjectSetPrototypeOf(Mac, LazyTransform);
+
+Mac.prototype._transform = function _transform(chunk, encoding, callback) {
+  if (this[kState][kFinalized]) {
+    callback(new ERR_CRYPTO_MAC_FINALIZED());
+    return;
+  }
+  try {
+    updateHandle(this, chunk, encoding);
+  } catch (error) {
+    callback(error);
+    return;
+  }
+  callback();
+};
+
+Mac.prototype._flush = function _flush(callback) {
+  if (this[kState][kFinalized]) {
+    callback(new ERR_CRYPTO_MAC_FINALIZED());
+    return;
+  }
+  try {
+    const result = finalizeHandle(this);
+    if (result.length !== 0) this.push(result);
+  } catch (error) {
+    callback(error);
+    return;
+  }
+  callback();
+};
+
+Mac.prototype.update = function update(data, encoding) {
+  if (this[kState][kFinalized]) throw new ERR_CRYPTO_MAC_FINALIZED();
+  if (typeof data === 'string') {
+    encoding = normalizeInputEncoding(data, encoding);
+  } else if (!isArrayBufferView(data)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'data', ['string', 'Buffer', 'TypedArray', 'DataView'], data);
+  }
+  updateHandle(this, data, encoding);
+  return this;
+};
+
+Mac.prototype.final = function final(outputEncoding) {
+  if (this[kState][kFinalized]) throw new ERR_CRYPTO_MAC_FINALIZED();
+  if (outputEncoding === undefined) return finalizeHandle(this);
+  outputEncoding = normalizeOutputEncoding(outputEncoding);
+  if (outputEncoding === 'buffer') return finalizeHandle(this);
+  return finalizeHandle(this, outputEncoding);
+};
+
+module.exports = {
+  Mac,
+};
diff --git a/lib/internal/crypto/rsa.js b/lib/internal/crypto/rsa.js
index d153ab664bd8..27b23087d563 100644
--- a/lib/internal/crypto/rsa.js
+++ b/lib/internal/crypto/rsa.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  MathCeil,
   TypedArrayPrototypeGetBuffer,
   Uint8Array,
 } = primordials;
@@ -24,12 +23,11 @@ const {
 } = internalBinding('crypto');
 
 const {
-  validateInt32,
+  isInt32,
 } = require('internal/validators');
 
 const {
   bigIntArrayToUnsignedInt,
-  getDigestSizeInBytes,
   getUsagesMask,
   jobPromise,
   normalizeHashName,
@@ -103,12 +101,6 @@ function rsaKeyGenerate(
   extractable,
   usages,
 ) {
-  const publicExponentConverted = bigIntArrayToUnsignedInt(algorithm.publicExponent);
-  if (publicExponentConverted === undefined) {
-    throw lazyDOMException(
-      'The publicExponent must be equivalent to an unsigned 32-bit value',
-      'OperationError');
-  }
   const {
     name,
     modulusLength,
@@ -118,6 +110,7 @@ function rsaKeyGenerate(
 
   const allowedUsages = kUsages[name];
   const usagesSet = validateKeyUsages(usages, allowedUsages.keygen, name);
+  const publicExponentConverted = bigIntArrayToUnsignedInt(publicExponent);
 
   const keyAlgorithm = {
     name,
@@ -126,12 +119,6 @@ function rsaKeyGenerate(
     hash,
   };
 
-  if (publicExponentConverted < 3 || publicExponentConverted % 2 === 0) {
-    throw lazyDOMException(
-      'The operation failed for an operation-specific reason',
-      'OperationError');
-  }
-
   const keyUsages = getKeyPairUsages(usagesSet, allowedUsages);
   validateUsagesNotEmpty(keyUsages.private);
 
@@ -199,6 +186,12 @@ function rsaImportKey(
       break;
     }
     case 'jwk': {
+      const isPublic = keyData.d === undefined;
+      verifyAcceptableKeyUse(
+        algorithm.name,
+        usagesSet,
+        isPublic ? allowedUsages.public : allowedUsages.private);
+
       const expectedUse = algorithm.name === 'RSA-OAEP' ? 'enc' : 'sig';
       validateJwk(keyData, 'RSA', extractable, usagesSet, expectedUse);
 
@@ -215,11 +208,6 @@ function rsaImportKey(
             'DataError');
       }
 
-      const isPublic = keyData.d === undefined;
-      verifyAcceptableKeyUse(
-        algorithm.name,
-        usagesSet,
-        isPublic ? allowedUsages.public : allowedUsages.private);
       handle = importJwkKey(isPublic, keyData);
       break;
     }
@@ -252,19 +240,16 @@ function rsaSignVerify(key, data, { saltLength }, signature) {
     throw lazyDOMException(`Key must be a ${type} key`, 'InvalidAccessError');
 
   const algorithm = getCryptoKeyAlgorithm(key);
-  if (algorithm.name === 'RSA-PSS') {
-    try {
-      validateInt32(
-        saltLength,
-        'algorithm.saltLength',
-        0,
-        MathCeil((algorithm.modulusLength - 1) / 8) -
-          getDigestSizeInBytes(algorithm.hash.name) - 2);
-    } catch (err) {
-      throw lazyDOMException(
-        'The operation failed for an operation-specific reason',
-        { name: 'OperationError', cause: err });
-    }
+  // RsaPssParams converts saltLength to an unsigned long, but SignJob only
+  // accepts int32 values.
+  if (algorithm.name === 'RSA-PSS' && !isInt32(saltLength)) {
+    // EMSA-PSS-VERIFY treats an impossible salt length as inconsistent.
+    if (mode === kSignJobModeVerify)
+      return false;
+
+    throw lazyDOMException(
+      'The operation failed for an operation-specific reason',
+      'OperationError');
   }
 
   return jobPromise(() => new SignJob(
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index 282ce9b35591..7fe6d488f57c 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -5,6 +5,7 @@ const {
   ArrayBufferPrototypeGetByteLength,
   ArrayPrototypeIncludes,
   ArrayPrototypePush,
+  ArrayPrototypeSlice,
   BigInt,
   DataViewPrototypeGetBuffer,
   DataViewPrototypeGetByteLength,
@@ -35,21 +36,22 @@ const {
   getCiphers: _getCiphers,
   getCurves: _getCurves,
   getHashes: _getHashes,
+  getMacs: _getMacs,
   setEngine: _setEngine,
   secureHeapUsed: _secureHeapUsed,
   getCachedAliases,
+  getCachedMacAliases,
   getOpenSSLSecLevelCrypto: getOpenSSLSecLevel,
-  EVP_PKEY_ML_DSA_44,
-  EVP_PKEY_ML_DSA_65,
-  EVP_PKEY_ML_DSA_87,
-  EVP_PKEY_ML_KEM_512,
-  EVP_PKEY_ML_KEM_768,
-  EVP_PKEY_ML_KEM_1024,
   kKeyVariantAES_OCB_128: hasAesOcbMode,
   Argon2Job,
+  getFipsCrypto,
+  getFipsCryptoGeneration,
   KmacJob,
+  getPqcKeyTypes,
 } = internalBinding('crypto');
 
+const isFips = getFipsCrypto() === 1;
+
 const { getOptionValue } = require('internal/options');
 
 const {
@@ -78,7 +80,6 @@ const {
 const { Buffer } = require('buffer');
 
 const {
-  cachedResult,
   emitExperimentalWarning,
   filterDuplicateStrings,
   lazyDOMException,
@@ -114,25 +115,84 @@ function toBuf(val, encoding) {
 }
 
 let _hashCache;
+let _macCache;
+if (isBuildingSnapshot()) {
+  addSerializeCallback(() => {
+    _hashCache = undefined;
+    _macCache = undefined;
+  });
+}
+
 function getHashCache() {
-  if (_hashCache === undefined) {
-    _hashCache = getCachedAliases();
-    if (isBuildingSnapshot()) {
-      // For dynamic linking, clear the map.
-      addSerializeCallback(() => { _hashCache = undefined; });
-    }
+  while (_hashCache === undefined) {
+    const generation = getFipsCryptoGeneration();
+    const cache = getCachedAliases();
+    if (generation !== getFipsCryptoGeneration()) continue;
+    _hashCache = cache;
   }
   return _hashCache;
 }
 
+function getMacCache() {
+  while (_macCache === undefined) {
+    const generation = getFipsCryptoGeneration();
+    const cache = getCachedMacAliases();
+    if (generation !== getFipsCryptoGeneration()) continue;
+    _macCache = cache;
+  }
+  return _macCache;
+}
+
+function cachedArrayByFipsGeneration(fn, onRefresh) {
+  let result;
+  let generation;
+  if (isBuildingSnapshot()) {
+    addSerializeCallback(() => {
+      result = undefined;
+      generation = undefined;
+    });
+  }
+
+  return () => {
+    while (true) {
+      const current = getFipsCryptoGeneration();
+      if (result === undefined || generation !== current) {
+        const next = fn();
+        if (current !== getFipsCryptoGeneration()) continue;
+        result = next;
+        generation = current;
+        if (onRefresh !== undefined) onRefresh();
+      }
+      return ArrayPrototypeSlice(result);
+    }
+  };
+}
+
 function getCachedHashId(algorithm) {
   const result = getHashCache()[algorithm];
   return result === undefined ? -1 : result;
 }
 
-const getCiphers = cachedResult(() => filterDuplicateStrings(_getCiphers()));
-const getHashes = cachedResult(() => filterDuplicateStrings(_getHashes()));
-const getCurves = cachedResult(() => filterDuplicateStrings(_getCurves()));
+function getCachedMacId(algorithm) {
+  const result = getMacCache()[algorithm];
+  return result === undefined ? -1 : result;
+}
+
+const getCiphers = cachedArrayByFipsGeneration(
+  () => filterDuplicateStrings(_getCiphers()));
+const getHashes = cachedArrayByFipsGeneration(
+  () => filterDuplicateStrings(_getHashes()),
+  () => {
+    _hashCache = undefined;
+  });
+const getMacs = cachedArrayByFipsGeneration(
+  () => filterDuplicateStrings(_getMacs(), true),
+  () => {
+    _macCache = undefined;
+  });
+
+const getCurves = cachedArrayByFipsGeneration(
+  () => filterDuplicateStrings(_getCurves()));
 
 function setEngine(id, flags) {
   validateString(id, 'id');
@@ -338,6 +398,7 @@ const kAlgorithmDefinitions = {
     'importKey': null,
     'encapsulate': null,
     'decapsulate': null,
+    'get shared key length': null,
   },
   'ML-KEM-768': {
     'generateKey': null,
@@ -345,6 +406,7 @@ const kAlgorithmDefinitions = {
     'importKey': null,
     'encapsulate': null,
     'decapsulate': null,
+    'get shared key length': null,
   },
   'ML-KEM-1024': {
     'generateKey': null,
@@ -352,6 +414,31 @@ const kAlgorithmDefinitions = {
     'importKey': null,
     'encapsulate': null,
     'decapsulate': null,
+    'get shared key length': null,
+  },
+  'MLKEM768-P256': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
+  'MLKEM768-X25519': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
+  'MLKEM1024-P384': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
   },
   'PBKDF2': {
     'importKey': null,
@@ -401,6 +488,8 @@ const kAlgorithmDefinitions = {
 };
 
 // Conditionally supported algorithms
+const pqcKeyTypes = getPqcKeyTypes();
+
 const conditionalAlgorithms = {
   'AES-OCB': !!hasAesOcbMode,
   'Argon2d': !!Argon2Job,
@@ -415,18 +504,34 @@ const conditionalAlgorithms = {
   'Ed448': !process.features.openssl_is_boringssl,
   'KMAC128': !!KmacJob,
   'KMAC256': !!KmacJob,
-  'ML-DSA-44': !!EVP_PKEY_ML_DSA_44,
-  'ML-DSA-65': !!EVP_PKEY_ML_DSA_65,
-  'ML-DSA-87': !!EVP_PKEY_ML_DSA_87,
-  'ML-KEM-512': !!EVP_PKEY_ML_KEM_512,
-  'ML-KEM-768': !!EVP_PKEY_ML_KEM_768,
-  'ML-KEM-1024': !!EVP_PKEY_ML_KEM_1024,
+  'KT128': !isFips,
+  'KT256': !isFips,
+  'ML-DSA-44': ArrayPrototypeIncludes(pqcKeyTypes, 'ML-DSA-44'),
+  'ML-DSA-65': ArrayPrototypeIncludes(pqcKeyTypes, 'ML-DSA-65'),
+  'ML-DSA-87': ArrayPrototypeIncludes(pqcKeyTypes, 'ML-DSA-87'),
+  'ML-KEM-512': ArrayPrototypeIncludes(pqcKeyTypes, 'ML-KEM-512'),
+  'ML-KEM-768': ArrayPrototypeIncludes(pqcKeyTypes, 'ML-KEM-768'),
+  'ML-KEM-1024': ArrayPrototypeIncludes(pqcKeyTypes, 'ML-KEM-1024'),
+  'MLKEM768-P256': !isFips && ArrayPrototypeIncludes(pqcKeyTypes, 'ML-KEM-768') &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
+  'MLKEM768-X25519': !isFips && ArrayPrototypeIncludes(pqcKeyTypes, 'ML-KEM-768') &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
+  'MLKEM1024-P384': !isFips && ArrayPrototypeIncludes(pqcKeyTypes, 'ML-KEM-1024') &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
   'SHA3-256': !process.features.openssl_is_boringssl ||
     ArrayPrototypeIncludes(getHashes(), 'sha3-256'),
   'SHA3-384': !process.features.openssl_is_boringssl ||
     ArrayPrototypeIncludes(getHashes(), 'sha3-384'),
   'SHA3-512': !process.features.openssl_is_boringssl ||
     ArrayPrototypeIncludes(getHashes(), 'sha3-512'),
+  'TurboSHAKE128': !isFips,
+  'TurboSHAKE256': !isFips,
   'X448': !process.features.openssl_is_boringssl,
 };
 
@@ -448,6 +553,9 @@ const experimentalAlgorithms = [
   'ML-KEM-512',
   'ML-KEM-768',
   'ML-KEM-1024',
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
   'SHA3-256',
   'SHA3-384',
   'SHA3-512',
@@ -571,6 +679,11 @@ function validateMaxBufferLength(data, name, max = kMaxBufferLength) {
   }
 }
 
+function validateKmacKeyLength(length) {
+  if ((length < 32 || length % 8) && isFips)
+    throw lazyDOMException('Invalid key length', 'NotSupportedError');
+}
+
 /**
  * Converts a bit length to the number of bytes needed to contain it.
  * Non-byte lengths are rounded up to the next byte.
@@ -874,15 +987,18 @@ function jobPromiseThen(promise, onFulfilled, onRejected) {
 // an unsigned int from a Buffer are not adequate. The implementation
 // here is adapted from the chromium implementation here:
 // https://github.com/chromium/chromium/blob/HEAD/third_party/blink/public/platform/web_crypto_algorithm_params.h, but ported to JavaScript
-// Returns undefined if the conversion was unsuccessful.
+// Throws an OperationError if the value does not fit in an unsigned 32-bit integer.
 function bigIntArrayToUnsignedInt(input) {
   let result = 0;
   const length = TypedArrayPrototypeGetLength(input);
 
   for (let n = 0; n < length; ++n) {
     const n_reversed = length - n - 1;
-    if (n_reversed >= 4 && input[n])
-      return;  // Too large
+    if (n_reversed >= 4 && input[n]) {
+      throw lazyDOMException(
+        'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+        'OperationError');
+    }
     result |= input[n] << 8 * n_reversed;
   }
 
@@ -1016,22 +1132,6 @@ function getBlockSize(name) {
   }
 }
 
-function getDigestSizeInBytes(name) {
-  switch (name) {
-    case 'SHA-1':
-      return 20;
-    case 'SHA-256': // Fall through
-    case 'SHA3-256':
-      return 32;
-    case 'SHA-384': // Fall through
-    case 'SHA3-384':
-      return 48;
-    case 'SHA-512': // Fall through
-    case 'SHA3-512':
-      return 64;
-  }
-}
-
 function validateKeyOps(keyOps, usagesSet) {
   if (keyOps === undefined) return;
   validateArray(keyOps, 'keyData.key_ops');
@@ -1081,6 +1181,7 @@ module.exports = {
   getCurves,
   getDataViewOrTypedArrayBuffer,
   getHashes,
+  getMacs,
   getOptionalByteLength,
   kHandle,
   setEngine,
@@ -1088,6 +1189,7 @@ module.exports = {
 
   kNamedCurveAliases,
   kSupportedAlgorithms,
+  isFips,
   normalizeAlgorithm,
   normalizeHashName,
   hasAnyNotIn,
@@ -1097,13 +1199,14 @@ module.exports = {
   jobPromiseThen,
   cleanupWebCryptoResult,
   prepareWebCryptoResult,
+  validateKmacKeyLength,
+  resolveWebCryptoResult,
   validateMaxBufferLength,
   numBitsToBytes,
   truncateToBitLength,
   bigIntArrayToUnsignedBigInt,
   bigIntArrayToUnsignedInt,
   getBlockSize,
-  getDigestSizeInBytes,
   getStringOption,
   getUsagesMask,
   getUsagesFromMask,
@@ -1112,5 +1215,7 @@ module.exports = {
   secureHeapUsed,
   getCachedHashId,
   getHashCache,
+  getCachedMacId,
+  getMacCache,
   getOpenSSLSecLevel,
 };
diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index 6424f0594a26..8969ebaf0dd8 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -240,6 +240,13 @@ function generateKeyImpl(
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemGenerateKey(normalizedAlgorithm, extractable, usages);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridGenerateKey(normalizedAlgorithm, extractable, usages);
     case 'KMAC128':
       // Fall through
     case 'KMAC256':
@@ -349,6 +356,60 @@ function getKeyLength({ name, length, hash }) {
   }
 }
 
+function getSharedKeyLength({ name }) {
+  switch (name) {
+    case 'ML-KEM-512':
+      // Fall through
+    case 'ML-KEM-768':
+      // Fall through
+    case 'ML-KEM-1024':
+      // Fall through
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return 256;
+    /* c8 ignore start */
+    default: {
+      const assert = require('internal/assert');
+      assert.fail('Unreachable code');
+    }
+    /* c8 ignore stop */
+  }
+}
+
+function canImportRawSecret(algorithm, sharedKeyLength) {
+  switch (algorithm.name) {
+    case 'AES-OCB':
+    case 'AES-KW':
+    case 'AES-GCM':
+    case 'AES-CTR':
+    case 'AES-CBC':
+      return sharedKeyLength === 128 ||
+             sharedKeyLength === 192 ||
+             sharedKeyLength === 256;
+    case 'ChaCha20-Poly1305':
+      return sharedKeyLength === 256;
+    case 'HKDF':
+    case 'PBKDF2':
+    case 'Argon2i':
+    case 'Argon2d':
+    case 'Argon2id':
+      return true;
+    case 'HMAC':
+      if (sharedKeyLength === 0)
+        return false;
+      // Fall through
+    case 'KMAC128':
+    case 'KMAC256':
+      return algorithm.length === undefined ||
+             numBitsToBytes(algorithm.length) * 8 === sharedKeyLength;
+    default:
+      return false;
+  }
+}
+
 function deriveKey(
   algorithm,
   baseKey,
@@ -435,19 +496,20 @@ function deriveKeyImpl(
 }
 
 function exportKeySpki(key) {
+  let exporter;
   switch (getCryptoKeyAlgorithm(key).name) {
     case 'RSASSA-PKCS1-v1_5':
       // Fall through
     case 'RSA-PSS':
       // Fall through
     case 'RSA-OAEP':
-      return require('internal/crypto/rsa')
-        .rsaExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/rsa').rsaExportKey;
+      break;
     case 'ECDSA':
       // Fall through
     case 'ECDH':
-      return require('internal/crypto/ec')
-        .ecExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/ec').ecExportKey;
+      break;
     case 'Ed25519':
       // Fall through
     case 'Ed448':
@@ -455,41 +517,47 @@ function exportKeySpki(key) {
     case 'X25519':
       // Fall through
     case 'X448':
-      return require('internal/crypto/cfrg')
-        .cfrgExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/cfrg').cfrgExportKey;
+      break;
     case 'ML-DSA-44':
       // Fall through
     case 'ML-DSA-65':
       // Fall through
     case 'ML-DSA-87':
-      return require('internal/crypto/ml_dsa')
-        .mlDsaExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/ml_dsa').mlDsaExportKey;
+      break;
     case 'ML-KEM-512':
       // Fall through
     case 'ML-KEM-768':
       // Fall through
     case 'ML-KEM-1024':
-      return require('internal/crypto/ml_kem')
-        .mlKemExportKey(key, kWebCryptoKeyFormatSPKI);
+      exporter = require('internal/crypto/ml_kem').mlKemExportKey;
+      break;
     default:
       return undefined;
   }
+
+  if (getCryptoKeyType(key) !== 'public')
+    throw lazyDOMException('Key must be a public key', 'InvalidAccessError');
+
+  return exporter(key, kWebCryptoKeyFormatSPKI);
 }
 
 function exportKeyPkcs8(key) {
+  let exporter;
   switch (getCryptoKeyAlgorithm(key).name) {
     case 'RSASSA-PKCS1-v1_5':
       // Fall through
     case 'RSA-PSS':
       // Fall through
     case 'RSA-OAEP':
-      return require('internal/crypto/rsa')
-        .rsaExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/rsa').rsaExportKey;
+      break;
     case 'ECDSA':
       // Fall through
     case 'ECDH':
-      return require('internal/crypto/ec')
-        .ecExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/ec').ecExportKey;
+      break;
     case 'Ed25519':
       // Fall through
     case 'Ed448':
@@ -497,25 +565,30 @@ function exportKeyPkcs8(key) {
     case 'X25519':
       // Fall through
     case 'X448':
-      return require('internal/crypto/cfrg')
-        .cfrgExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/cfrg').cfrgExportKey;
+      break;
     case 'ML-DSA-44':
       // Fall through
     case 'ML-DSA-65':
       // Fall through
     case 'ML-DSA-87':
-      return require('internal/crypto/ml_dsa')
-        .mlDsaExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/ml_dsa').mlDsaExportKey;
+      break;
     case 'ML-KEM-512':
       // Fall through
     case 'ML-KEM-768':
       // Fall through
     case 'ML-KEM-1024':
-      return require('internal/crypto/ml_kem')
-        .mlKemExportKey(key, kWebCryptoKeyFormatPKCS8);
+      exporter = require('internal/crypto/ml_kem').mlKemExportKey;
+      break;
     default:
       return undefined;
   }
+
+  if (getCryptoKeyType(key) !== 'private')
+    throw lazyDOMException('Key must be a private key', 'InvalidAccessError');
+
+  return exporter(key, kWebCryptoKeyFormatPKCS8);
 }
 
 function exportKeyRawPublic(key, format) {
@@ -558,6 +631,17 @@ function exportKeyRawPublic(key, format) {
       return require('internal/crypto/ml_kem')
         .mlKemExportKey(key, kWebCryptoKeyFormatRaw);
     }
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384': {
+      if (format !== 'raw-public') {
+        return undefined;
+      }
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, format);
+    }
     default:
       return undefined;
   }
@@ -579,6 +663,13 @@ function exportKeyRawSeed(key) {
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemExportKey(key, kWebCryptoKeyFormatRaw);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, 'raw-seed');
     default:
       return undefined;
   }
@@ -654,6 +745,13 @@ function exportKeyJWK(key) {
       // Fall through
     case 'ML-KEM-1024':
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, 'jwk');
     case 'Ed25519':
       // Fall through
     case 'Ed448':
@@ -720,15 +818,11 @@ function exportKeySync(format, key) {
   let result;
   switch (format) {
     case 'spki': {
-      if (type === 'public') {
-        result = exportKeySpki(key);
-      }
+      result = exportKeySpki(key);
       break;
     }
     case 'pkcs8': {
-      if (type === 'private') {
-        result = exportKeyPkcs8(key);
-      }
+      result = exportKeyPkcs8(key);
       break;
     }
     case 'jwk': {
@@ -977,6 +1071,14 @@ function importKeySync(format, keyData, algorithm, extractable, usages) {
           extractable,
           usages);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      result = require('internal/crypto/kem_hybrids')
+        .kemHybridImportKey(format, keyData, algorithm, extractable, usages);
+      break;
   }
 
   if (!result) {
@@ -1357,6 +1459,14 @@ function getPublicKeyImpl(key, keyUsages) {
     throw lazyDOMException('key must be a private key',
                            type === 'secret' ? 'NotSupportedError' : 'InvalidAccessError');
 
+  switch (getCryptoKeyAlgorithm(key).name) {
+    case 'MLKEM768-P256':
+    case 'MLKEM768-X25519':
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridGetPublicKey(key, usages);
+  }
+
   return toPublicCryptoKey(key, usages);
 }
 
@@ -1396,6 +1506,13 @@ function encapsulateBitsImpl(encapsulationAlgorithm, encapsulationKey) {
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemEncapsulate(encapsulationKey);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridEncaps(encapsulationKey);
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1460,6 +1577,14 @@ function encapsulateKeyImpl(
       encapsulatedBits = require('internal/crypto/ml_kem')
         .mlKemEncapsulate(encapsulationKey);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      encapsulatedBits = require('internal/crypto/kem_hybrids')
+        .kemHybridEncaps(encapsulationKey);
+      break;
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1523,6 +1648,13 @@ function decapsulateBitsImpl(decapsulationAlgorithm, decapsulationKey, ciphertex
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemDecapsulate(decapsulationKey, ciphertext);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridDecaps(decapsulationKey, ciphertext);
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1590,6 +1722,14 @@ function decapsulateKeyImpl(
       decapsulatedBits = require('internal/crypto/ml_kem')
         .mlKemDecapsulate(decapsulationKey, ciphertext);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      decapsulatedBits = require('internal/crypto/kem_hybrids')
+        .kemHybridDecaps(decapsulationKey, ciphertext);
+      break;
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1618,6 +1758,7 @@ class SubtleCrypto {
   }
 
   // Implements https://wicg.github.io/webcrypto-modern-algos/#SubtleCrypto-method-supports
+  // TODO(panva): Make supports() account for the active FIPS state.
   static supports(operation, algorithm, lengthOrAdditionalAlgorithm = null) {
     emitExperimentalWarning('The supports Web Crypto API method');
     if (this !== SubtleCrypto) throw new ERR_INVALID_THIS('SubtleCrypto constructor');
@@ -1741,37 +1882,19 @@ class SubtleCrypto {
         },
       );
 
+      let sharedKeyLength;
       let normalizedAdditionalAlgorithm;
       try {
+        const normalizedAlgorithm =
+          normalizeAlgorithm(algorithm, 'get shared key length');
+        sharedKeyLength = getSharedKeyLength(normalizedAlgorithm);
         normalizedAdditionalAlgorithm = normalizeAlgorithm(additionalAlgorithm, 'importKey');
       } catch {
         return false;
       }
 
-      switch (normalizedAdditionalAlgorithm.name) {
-        case 'AES-OCB':
-        case 'AES-KW':
-        case 'AES-GCM':
-        case 'AES-CTR':
-        case 'AES-CBC':
-        case 'ChaCha20-Poly1305':
-        case 'HKDF':
-        case 'PBKDF2':
-        case 'Argon2i':
-        case 'Argon2d':
-        case 'Argon2id':
-          break;
-        case 'HMAC':
-        case 'KMAC128':
-        case 'KMAC256':
-          if (normalizedAdditionalAlgorithm.length === undefined ||
-              numBitsToBytes(normalizedAdditionalAlgorithm.length) === 32) {
-            break;
-          }
-          return false;
-        default:
-          return false;
-      }
+      if (!canImportRawSecret(normalizedAdditionalAlgorithm, sharedKeyLength))
+        return false;
     }
 
     try {
@@ -1807,8 +1930,6 @@ function check(op, alg, length) {
   }
 
   switch (op) {
-    case 'decapsulate':
-    case 'decrypt':
     case 'digest': {
       if ((normalizedAlgorithm.name === 'cSHAKE128' ||
            normalizedAlgorithm.name === 'cSHAKE256') &&
@@ -1818,6 +1939,8 @@ function check(op, alg, length) {
       }
       return true;
     }
+    case 'decapsulate':
+    case 'decrypt':
     case 'encapsulate':
     case 'encrypt':
     case 'exportKey':
@@ -1829,7 +1952,8 @@ function check(op, alg, length) {
       return true;
     case 'deriveBits': {
       if (normalizedAlgorithm.name === 'HKDF') {
-        require('internal/crypto/hkdf').validateHkdfDeriveBitsLength(length);
+        require('internal/crypto/hkdf')
+          .validateHkdfDeriveBitsLength(length, normalizedAlgorithm.hash);
       }
 
       if (normalizedAlgorithm.name === 'PBKDF2') {
diff --git a/lib/internal/crypto/webidl.js b/lib/internal/crypto/webidl.js
index 5dc263120eae..dc8a1e6d72b3 100644
--- a/lib/internal/crypto/webidl.js
+++ b/lib/internal/crypto/webidl.js
@@ -9,7 +9,6 @@ const {
   StringPrototypeSplit,
   StringPrototypeStartsWith,
   StringPrototypeToLowerCase,
-  TypedArrayPrototypeGetLength,
 } = primordials;
 
 const {
@@ -17,19 +16,23 @@ const {
   kEmptyObject,
 } = require('internal/util');
 const {
+  isInt32,
   isUint32,
 } = require('internal/validators');
-const { CryptoKey } = require('internal/crypto/webcrypto');
 const {
   getCryptoKeyAlgorithm,
   getCryptoKeyType,
+  isCryptoKey,
 } = require('internal/crypto/keys');
 const {
+  bigIntArrayToUnsignedInt,
   validateMaxBufferLength,
   getBufferSourceByteLength,
   getBufferSourceBytes,
+  isFips,
   kNamedCurveAliases,
   numBitsToBytes,
+  validateKmacKeyLength,
 } = require('internal/crypto/util');
 const {
   converters: webidl,
@@ -41,6 +44,9 @@ const {
   type,
 } = require('internal/webidl');
 
+const { getFipsCrypto } = internalBinding('crypto');
+const kRsaKeyGenMinimumModulusLength = getFipsCrypto() === 1 ? 2048 : 512;
+
 function validateByteLength(buf, name, target) {
   if (getBufferSourceByteLength(buf) !== target) {
     throw lazyDOMException(
@@ -175,11 +181,33 @@ const dictRsaKeyGenParams = [
     key: 'modulusLength',
     converter: (V, opts) =>
       converters['unsigned long'](V, enforceRangeOptions(opts)),
+    validator: (modulusLength) => {
+      if (modulusLength < kRsaKeyGenMinimumModulusLength) {
+        throw lazyDOMException(
+          `algorithm.modulusLength must be at least ${kRsaKeyGenMinimumModulusLength}`,
+          'OperationError');
+      }
+    },
     required: true,
   },
   {
     key: 'publicExponent',
     converter: converters.BigInteger,
+    validator: (publicExponent) => {
+      const converted = bigIntArrayToUnsignedInt(publicExponent);
+
+      if (converted < 3) {
+        throw lazyDOMException(
+          'algorithm.publicExponent must be at least 3',
+          'OperationError');
+      }
+
+      if (converted % 2 === 0) {
+        throw lazyDOMException(
+          'algorithm.publicExponent must be odd',
+          'OperationError');
+      }
+    },
     required: true,
   },
 ];
@@ -276,23 +304,24 @@ function validateCShakeOutputLength(V) {
   }
 }
 
-function bufferSourceEqualsAscii(V, string) {
-  if (getBufferSourceByteLength(V) !== string.length) return false;
-
-  const bytes = getBufferSourceBytes(V);
-  const length = TypedArrayPrototypeGetLength(bytes);
-  for (let i = 0; i < length; i++) {
-    if (bytes[i] !== StringPrototypeCharCodeAt(string, i)) return false;
-  }
-  return true;
-}
+const kCShakeFunctionNames = ['KMAC', 'TupleHash', 'ParallelHash'];
 
 function validateCShakeFunctionName(V) {
-  if (getBufferSourceByteLength(V) === 0 ||
-      bufferSourceEqualsAscii(V, 'KMAC') ||
-      bufferSourceEqualsAscii(V, 'TupleHash') ||
-      bufferSourceEqualsAscii(V, 'ParallelHash')) {
-    return;
+  const length = getBufferSourceByteLength(V);
+  if (length === 0) return;
+
+  if (!isFips) {
+    const bytes = getBufferSourceBytes(V);
+    for (let i = 0; i < kCShakeFunctionNames.length; i++) {
+      const functionName = kCShakeFunctionNames[i];
+      if (length !== functionName.length) continue;
+
+      let j = 0;
+      for (; j < length; j++) {
+        if (bytes[j] !== StringPrototypeCharCodeAt(functionName, j)) break;
+      }
+      if (j === length) return;
+    }
   }
 
   throw lazyDOMException(
@@ -300,6 +329,14 @@ function validateCShakeFunctionName(V) {
     'NotSupportedError');
 }
 
+function validateCShakeCustomization(V) {
+  if (isFips && getBufferSourceByteLength(V) !== 0)
+    throw lazyDOMException(
+      'Unsupported CShakeParams customization',
+      'NotSupportedError');
+  validateMaxBufferLength(V, 'CShakeParams.customization', 512);
+}
+
 converters.RsaPssParams = createDictionaryConverter(
   'RsaPssParams', [
     dictAlgorithm,
@@ -457,7 +494,7 @@ converters.CShakeParams = createDictionaryConverter(
       {
         key: 'customization',
         converter: converters.BufferSource,
-        validator: (V, opts) => validateMaxBufferLength(V, 'CShakeParams.customization', 512),
+        validator: validateCShakeCustomization,
       },
     ],
   ]);
@@ -478,6 +515,11 @@ converters.Pbkdf2Params = createDictionaryConverter(
         validator: (V, dict) => {
           if (V === 0)
             throw lazyDOMException('iterations cannot be zero', 'OperationError');
+          if (!isInt32(V)) {
+            throw lazyDOMException(
+              'iterations exceeds the implementation limit',
+              'NotSupportedError');
+          }
         },
         required: true,
       },
@@ -607,7 +649,7 @@ converters.AesCtrParams = createDictionaryConverter(
   ]);
 
 converters.CryptoKey = createInterfaceConverter(
-  'CryptoKey', CryptoKey.prototype);
+  'CryptoKey', isCryptoKey);
 
 converters.EcdhKeyDeriveParams = createDictionaryConverter(
   'EcdhKeyDeriveParams', [
@@ -639,20 +681,27 @@ converters.ContextParams = createDictionaryConverter(
         key: 'context',
         converter: converters.BufferSource,
         validator(V, dict) {
+          const validateLength = (V) =>
+            validateMaxBufferLength(V, 'ContextParams.context', 255);
+
           if (process.features.openssl_is_boringssl) {
-            this.validator = undefined;
+            this.validator = validateLength;
           } else {
             let { 0: major, 1: minor } =
               StringPrototypeSplit(process.versions.openssl, '.');
             major = NumberParseInt(major, 10);
             minor = NumberParseInt(minor, 10);
             if (major > 3 || (major === 3 && minor >= 2)) {
-              this.validator = undefined;
+              this.validator = validateLength;
             } else {
-              this.validator = validateZeroLength('ContextParams.context');
-              this.validator(V, dict);
+              const validateEmpty = validateZeroLength('ContextParams.context');
+              this.validator = (V, dict) => {
+                validateLength(V);
+                validateEmpty(V, dict);
+              };
             }
           }
+          this.validator(V, dict);
         },
       },
     ],
@@ -743,6 +792,7 @@ for (let i = 0; i < kKmacDictionaries.length; i++) {
           key: 'length',
           converter: (V, opts) =>
             converters['unsigned long'](V, enforceRangeOptions(opts)),
+          validator: validateKmacKeyLength,
         },
       ],
     ]);
@@ -756,6 +806,12 @@ converters.KmacParams = createDictionaryConverter(
         key: 'outputLength',
         converter: (V, opts) =>
           converters['unsigned long'](V, enforceRangeOptions(opts)),
+        validator: (V) => {
+          if ((V === 0 || V % 8) && isFips)
+            throw lazyDOMException(
+              'Invalid KmacParams outputLength',
+              'NotSupportedError');
+        },
         required: true,
       },
       {
diff --git a/lib/internal/crypto/x509.js b/lib/internal/crypto/x509.js
index a75425ffcac8..cf1de4474756 100644
--- a/lib/internal/crypto/x509.js
+++ b/lib/internal/crypto/x509.js
@@ -1,13 +1,15 @@
 'use strict';
 
 const {
+  FunctionPrototypeCall,
+  ObjectGetPrototypeOf,
   ObjectSetPrototypeOf,
-  SafeMap,
-  Symbol,
+  SafeWeakMap,
 } = primordials;
 
 const {
-  parseX509,
+  createX509CertificateClass,
+  isX509Certificate: isNativeX509Certificate,
   X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT,
   X509_CHECK_FLAG_NEVER_CHECK_SUBJECT,
   X509_CHECK_FLAG_NO_WILDCARDS,
@@ -46,26 +48,13 @@ const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_THIS,
   },
 } = require('internal/errors');
 
-const {
-  markTransferMode,
-  kClone,
-  kDeserialize,
-} = require('internal/worker/js_transferable');
-
-const {
-  kHandle,
-} = require('internal/crypto/util');
-
 let lazyTranslatePeerCertificate;
 
-const kInternalState = Symbol('kInternalState');
-
-function isX509Certificate(value) {
-  return value[kInternalState] !== undefined;
-}
+let isX509Certificate;
 
 function getFlags(options = kEmptyObject) {
   validateObject(options, 'options');
@@ -96,312 +85,347 @@ function getFlags(options = kEmptyObject) {
   return flags;
 }
 
-class InternalX509Certificate {
-  [kInternalState] = new SafeMap();
-
-  constructor(handle) {
-    markTransferMode(this, true, false);
-    this[kHandle] = handle;
-  }
+const crossRealmState = new SafeWeakMap();
+
+const kSlotSubject = 0;
+const kSlotSubjectAltName = 1;
+const kSlotIssuer = 2;
+const kSlotIssuerCertificate = 3;
+const kSlotInfoAccess = 4;
+const kSlotValidFrom = 5;
+const kSlotValidTo = 6;
+const kSlotValidFromDate = 7;
+const kSlotValidToDate = 8;
+const kSlotFingerprint = 9;
+const kSlotFingerprint256 = 10;
+const kSlotFingerprint512 = 11;
+const kSlotKeyUsage = 12;
+const kSlotSerialNumber = 13;
+const kSlotSignatureAlgorithm = 14;
+const kSlotSignatureAlgorithmOid = 15;
+const kSlotRaw = 16;
+const kSlotPublicKey = 17;
+const kSlotPem = 18;
+const kSlotCA = 19;
+const kStateCacheMask = 20;
+
+function createState() {
+  const state = [];
+  state[kStateCacheMask] = 0;
+  return state;
 }
 
-class X509Certificate {
-  [kInternalState] = new SafeMap();
-
-  constructor(buffer) {
-    if (typeof buffer === 'string')
-      buffer = Buffer.from(buffer);
-    if (!isArrayBufferView(buffer)) {
-      throw new ERR_INVALID_ARG_TYPE(
-        'buffer',
-        ['string', 'Buffer', 'TypedArray', 'DataView'],
-        buffer);
+let InternalX509Certificate;
+
+const {
+  0: X509Certificate,
+  1: InternalX509CertificateConstructor,
+} = createX509CertificateClass((NativeX509Certificate) => {
+  const {
+    checkCA: nativeCheckCA,
+    checkEmail: nativeCheckEmail,
+    checkHost: nativeCheckHost,
+    checkIP: nativeCheckIP,
+    checkIssued: nativeCheckIssued,
+    checkPrivateKey: nativeCheckPrivateKey,
+    fingerprint: nativeFingerprint,
+    fingerprint256: nativeFingerprint256,
+    fingerprint512: nativeFingerprint512,
+    getIssuerCert: nativeGetIssuerCert,
+    infoAccess: nativeInfoAccess,
+    issuer: nativeIssuer,
+    keyUsage: nativeKeyUsage,
+    pem: nativePem,
+    publicKey: nativePublicKey,
+    raw: nativeRaw,
+    serialNumber: nativeSerialNumber,
+    signatureAlgorithm: nativeSignatureAlgorithm,
+    signatureAlgorithmOid: nativeSignatureAlgorithmOid,
+    subject: nativeSubject,
+    subjectAltName: nativeSubjectAltName,
+    toLegacy: nativeToLegacy,
+    validFrom: nativeValidFrom,
+    validFromDate: nativeValidFromDate,
+    validTo: nativeValidTo,
+    validToDate: nativeValidToDate,
+    verify: nativeVerify,
+  } = NativeX509Certificate.prototype;
+
+  let getState;
+
+  function getCachedValue(cert, index, getter) {
+    const state = getState(cert);
+    const bit = 1 << index;
+    if ((state[kStateCacheMask] & bit) === 0) {
+      state[index] = FunctionPrototypeCall(getter, cert);
+      state[kStateCacheMask] |= bit;
+    }
+    return state[index];
+  }
+
+  class X509Certificate {
+    constructor(buffer) {
+      if (typeof buffer === 'string')
+        buffer = Buffer.from(buffer);
+      if (!isArrayBufferView(buffer)) {
+        throw new ERR_INVALID_ARG_TYPE(
+          'buffer',
+          ['string', 'Buffer', 'TypedArray', 'DataView'],
+          buffer);
+      }
+      const prototype = ObjectGetPrototypeOf(this);
+      const certificate = new InternalX509Certificate(buffer);
+      ObjectSetPrototypeOf(certificate, prototype);
+      // eslint-disable-next-line no-constructor-return
+      return certificate;
     }
-    markTransferMode(this, true, false);
-    this[kHandle] = parseX509(buffer);
-  }
 
-  [kInspect](depth, options) {
-    if (depth < 0)
-      return this;
-
-    const opts = {
-      ...options,
-      depth: options.depth == null ? null : options.depth - 1,
-    };
-
-    return `X509Certificate ${inspect({
-      subject: this.subject,
-      subjectAltName: this.subjectAltName,
-      issuer: this.issuer,
-      infoAccess: this.infoAccess,
-      validFrom: this.validFrom,
-      validTo: this.validTo,
-      validFromDate: this.validFromDate,
-      validToDate: this.validToDate,
-      fingerprint: this.fingerprint,
-      fingerprint256: this.fingerprint256,
-      fingerprint512: this.fingerprint512,
-      keyUsage: this.keyUsage,
-      serialNumber: this.serialNumber,
-      signatureAlgorithm: this.signatureAlgorithm,
-      signatureAlgorithmOid: this.signatureAlgorithmOid,
-    }, opts)}`;
-  }
+    [kInspect](depth, options) {
+      if (depth < 0)
+        return this;
+
+      const opts = {
+        ...options,
+        depth: options.depth == null ? null : options.depth - 1,
+      };
+
+      return `X509Certificate ${inspect({
+        subject: getCachedValue(this, kSlotSubject, nativeSubject),
+        subjectAltName:
+          getCachedValue(this, kSlotSubjectAltName, nativeSubjectAltName),
+        issuer: getCachedValue(this, kSlotIssuer, nativeIssuer),
+        infoAccess: getCachedValue(this, kSlotInfoAccess, nativeInfoAccess),
+        validFrom: getCachedValue(this, kSlotValidFrom, nativeValidFrom),
+        validTo: getCachedValue(this, kSlotValidTo, nativeValidTo),
+        validFromDate:
+          getCachedValue(this, kSlotValidFromDate, nativeValidFromDate),
+        validToDate:
+          getCachedValue(this, kSlotValidToDate, nativeValidToDate),
+        fingerprint:
+          getCachedValue(this, kSlotFingerprint, nativeFingerprint),
+        fingerprint256:
+          getCachedValue(this, kSlotFingerprint256, nativeFingerprint256),
+        fingerprint512:
+          getCachedValue(this, kSlotFingerprint512, nativeFingerprint512),
+        keyUsage: getCachedValue(this, kSlotKeyUsage, nativeKeyUsage),
+        serialNumber:
+          getCachedValue(this, kSlotSerialNumber, nativeSerialNumber),
+        signatureAlgorithm:
+          getCachedValue(
+            this, kSlotSignatureAlgorithm, nativeSignatureAlgorithm),
+        signatureAlgorithmOid:
+          getCachedValue(
+            this, kSlotSignatureAlgorithmOid, nativeSignatureAlgorithmOid),
+      }, opts)}`;
+    }
 
-  [kClone]() {
-    const handle = this[kHandle];
-    return {
-      data: { handle },
-      deserializeInfo: 'internal/crypto/x509:InternalX509Certificate',
-    };
-  }
+    get subject() {
+      return getCachedValue(this, kSlotSubject, nativeSubject);
+    }
 
-  [kDeserialize]({ handle }) {
-    this[kHandle] = handle;
-  }
+    get subjectAltName() {
+      return getCachedValue(
+        this, kSlotSubjectAltName, nativeSubjectAltName);
+    }
 
-  get subject() {
-    let value = this[kInternalState].get('subject');
-    if (value === undefined) {
-      value = this[kHandle].subject();
-      this[kInternalState].set('subject', value);
+    get issuer() {
+      return getCachedValue(this, kSlotIssuer, nativeIssuer);
     }
-    return value;
-  }
 
-  get subjectAltName() {
-    let value = this[kInternalState].get('subjectAltName');
-    if (value === undefined) {
-      value = this[kHandle].subjectAltName();
-      this[kInternalState].set('subjectAltName', value);
+    get issuerCertificate() {
+      const state = getState(this);
+      const bit = 1 << kSlotIssuerCertificate;
+      if ((state[kStateCacheMask] & bit) === 0) {
+        const cert = FunctionPrototypeCall(nativeGetIssuerCert, this);
+        state[kSlotIssuerCertificate] = cert ?
+          new InternalX509Certificate(cert) : undefined;
+        state[kStateCacheMask] |= bit;
+      }
+      return state[kSlotIssuerCertificate];
     }
-    return value;
-  }
 
-  get issuer() {
-    let value = this[kInternalState].get('issuer');
-    if (value === undefined) {
-      value = this[kHandle].issuer();
-      this[kInternalState].set('issuer', value);
+    get infoAccess() {
+      return getCachedValue(this, kSlotInfoAccess, nativeInfoAccess);
     }
-    return value;
-  }
 
-  get issuerCertificate() {
-    let value = this[kInternalState].get('issuerCertificate');
-    if (value === undefined) {
-      const cert = this[kHandle].getIssuerCert();
-      if (cert)
-        value = new InternalX509Certificate(cert);
-      this[kInternalState].set('issuerCertificate', value);
+    get validFrom() {
+      return getCachedValue(this, kSlotValidFrom, nativeValidFrom);
     }
-    return value;
-  }
 
-  get infoAccess() {
-    let value = this[kInternalState].get('infoAccess');
-    if (value === undefined) {
-      value = this[kHandle].infoAccess();
-      this[kInternalState].set('infoAccess', value);
+    get validTo() {
+      return getCachedValue(this, kSlotValidTo, nativeValidTo);
     }
-    return value;
-  }
 
-  get validFrom() {
-    let value = this[kInternalState].get('validFrom');
-    if (value === undefined) {
-      value = this[kHandle].validFrom();
-      this[kInternalState].set('validFrom', value);
+    get validFromDate() {
+      return getCachedValue(this, kSlotValidFromDate, nativeValidFromDate);
     }
-    return value;
-  }
 
-  get validTo() {
-    let value = this[kInternalState].get('validTo');
-    if (value === undefined) {
-      value = this[kHandle].validTo();
-      this[kInternalState].set('validTo', value);
+    get validToDate() {
+      return getCachedValue(this, kSlotValidToDate, nativeValidToDate);
     }
-    return value;
-  }
 
-  get validFromDate() {
-    let value = this[kInternalState].get('validFromDate');
-    if (value === undefined) {
-      value = this[kHandle].validFromDate();
-      this[kInternalState].set('validFromDate', value);
+    get fingerprint() {
+      return getCachedValue(this, kSlotFingerprint, nativeFingerprint);
     }
-    return value;
-  }
 
-  get validToDate() {
-    let value = this[kInternalState].get('validToDate');
-    if (value === undefined) {
-      value = this[kHandle].validToDate();
-      this[kInternalState].set('validToDate', value);
+    get fingerprint256() {
+      return getCachedValue(this, kSlotFingerprint256, nativeFingerprint256);
     }
-    return value;
-  }
 
-  get fingerprint() {
-    let value = this[kInternalState].get('fingerprint');
-    if (value === undefined) {
-      value = this[kHandle].fingerprint();
-      this[kInternalState].set('fingerprint', value);
+    get fingerprint512() {
+      return getCachedValue(this, kSlotFingerprint512, nativeFingerprint512);
     }
-    return value;
-  }
 
-  get fingerprint256() {
-    let value = this[kInternalState].get('fingerprint256');
-    if (value === undefined) {
-      value = this[kHandle].fingerprint256();
-      this[kInternalState].set('fingerprint256', value);
+    get keyUsage() {
+      return getCachedValue(this, kSlotKeyUsage, nativeKeyUsage);
     }
-    return value;
-  }
 
-  get fingerprint512() {
-    let value = this[kInternalState].get('fingerprint512');
-    if (value === undefined) {
-      value = this[kHandle].fingerprint512();
-      this[kInternalState].set('fingerprint512', value);
+    get serialNumber() {
+      return getCachedValue(this, kSlotSerialNumber, nativeSerialNumber);
     }
-    return value;
-  }
 
-  get keyUsage() {
-    let value = this[kInternalState].get('keyUsage');
-    if (value === undefined) {
-      value = this[kHandle].keyUsage();
-      this[kInternalState].set('keyUsage', value);
+    get signatureAlgorithm() {
+      return getCachedValue(
+        this, kSlotSignatureAlgorithm, nativeSignatureAlgorithm);
     }
-    return value;
-  }
 
-  get serialNumber() {
-    let value = this[kInternalState].get('serialNumber');
-    if (value === undefined) {
-      value = this[kHandle].serialNumber();
-      this[kInternalState].set('serialNumber', value);
+    get signatureAlgorithmOid() {
+      return getCachedValue(
+        this, kSlotSignatureAlgorithmOid, nativeSignatureAlgorithmOid);
     }
-    return value;
-  }
 
-  get signatureAlgorithm() {
-    let value = this[kInternalState].get('signatureAlgorithm');
-    if (value === undefined) {
-      value = this[kHandle].signatureAlgorithm();
-      this[kInternalState].set('signatureAlgorithm', value);
+    get raw() {
+      return getCachedValue(this, kSlotRaw, nativeRaw);
     }
-    return value;
-  }
 
-  get signatureAlgorithmOid() {
-    let value = this[kInternalState].get('signatureAlgorithmOid');
-    if (value === undefined) {
-      value = this[kHandle].signatureAlgorithmOid();
-      this[kInternalState].set('signatureAlgorithmOid', value);
+    get publicKey() {
+      const state = getState(this);
+      const bit = 1 << kSlotPublicKey;
+      if ((state[kStateCacheMask] & bit) === 0) {
+        state[kSlotPublicKey] = new PublicKeyObject(
+          FunctionPrototypeCall(nativePublicKey, this));
+        state[kStateCacheMask] |= bit;
+      }
+      return state[kSlotPublicKey];
     }
-    return value;
-  }
 
-  get raw() {
-    let value = this[kInternalState].get('raw');
-    if (value === undefined) {
-      value = this[kHandle].raw();
-      this[kInternalState].set('raw', value);
+    toString() {
+      return getCachedValue(this, kSlotPem, nativePem);
     }
-    return value;
-  }
 
-  get publicKey() {
-    let value = this[kInternalState].get('publicKey');
-    if (value === undefined) {
-      value = new PublicKeyObject(this[kHandle].publicKey());
-      this[kInternalState].set('publicKey', value);
+    // There's no standardized JSON encoding for X509 certs so we
+    // fallback to providing the PEM encoding as a string.
+    toJSON() { return getCachedValue(this, kSlotPem, nativePem); }
+
+    get ca() {
+      return getCachedValue(this, kSlotCA, nativeCheckCA);
     }
-    return value;
-  }
 
-  toString() {
-    let value = this[kInternalState].get('pem');
-    if (value === undefined) {
-      value = this[kHandle].pem();
-      this[kInternalState].set('pem', value);
+    checkHost(name, options) {
+      getState(this);
+      validateString(name, 'name');
+      return FunctionPrototypeCall(
+        nativeCheckHost, this, name, getFlags(options));
     }
-    return value;
-  }
 
-  // There's no standardized JSON encoding for X509 certs so we
-  // fallback to providing the PEM encoding as a string.
-  toJSON() { return this.toString(); }
+    checkEmail(email, options) {
+      getState(this);
+      validateString(email, 'email');
+      return FunctionPrototypeCall(
+        nativeCheckEmail, this, email, getFlags(options));
+    }
 
-  get ca() {
-    let value = this[kInternalState].get('ca');
-    if (value === undefined) {
-      value = this[kHandle].checkCA();
-      this[kInternalState].set('ca', value);
+    checkIP(ip, options) {
+      getState(this);
+      validateString(ip, 'ip');
+      // The options argument is currently undocumented since none of the
+      // options have any effect on the behavior of this function. However, we
+      // still parse the options argument in case OpenSSL adds flags in the
+      // future that do affect the behavior of X509_check_ip. This ensures that
+      // no invalid values are passed as the second argument in the meantime.
+      return FunctionPrototypeCall(
+        nativeCheckIP, this, ip, getFlags(options));
     }
-    return value;
-  }
 
-  checkHost(name, options) {
-    validateString(name, 'name');
-    return this[kHandle].checkHost(name, getFlags(options));
-  }
+    checkIssued(otherCert) {
+      getState(this);
+      if (!isX509Certificate(otherCert)) {
+        throw new ERR_INVALID_ARG_TYPE(
+          'otherCert', 'X509Certificate', otherCert);
+      }
+      return FunctionPrototypeCall(nativeCheckIssued, this, otherCert);
+    }
 
-  checkEmail(email, options) {
-    validateString(email, 'email');
-    return this[kHandle].checkEmail(email, getFlags(options));
-  }
+    checkPrivateKey(pkey) {
+      getState(this);
+      if (!isKeyObject(pkey))
+        throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
+      if (getKeyObjectType(pkey) !== 'private')
+        throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
+      return FunctionPrototypeCall(
+        nativeCheckPrivateKey, this, getKeyObjectHandle(pkey));
+    }
 
-  checkIP(ip, options) {
-    validateString(ip, 'ip');
-    // The options argument is currently undocumented since none of the options
-    // have any effect on the behavior of this function. However, we still parse
-    // the options argument in case OpenSSL adds flags in the future that do
-    // affect the behavior of X509_check_ip. This ensures that no invalid values
-    // are passed as the second argument in the meantime.
-    return this[kHandle].checkIP(ip, getFlags(options));
-  }
+    verify(pkey) {
+      getState(this);
+      if (!isKeyObject(pkey))
+        throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
+      if (getKeyObjectType(pkey) !== 'public')
+        throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
+      return FunctionPrototypeCall(
+        nativeVerify, this, getKeyObjectHandle(pkey));
+    }
 
-  checkIssued(otherCert) {
-    if (!isX509Certificate(otherCert))
-      throw new ERR_INVALID_ARG_TYPE('otherCert', 'X509Certificate', otherCert);
-    return this[kHandle].checkIssued(otherCert[kHandle]);
+    toLegacyObject() {
+      getState(this);
+      // TODO(tniessen): do not depend on translatePeerCertificate here, return
+      // the correct legacy representation from the binding
+      lazyTranslatePeerCertificate ??=
+        require('internal/tls/common').translatePeerCertificate;
+      return lazyTranslatePeerCertificate(
+        FunctionPrototypeCall(nativeToLegacy, this));
+    }
   }
 
-  checkPrivateKey(pkey) {
-    if (!isKeyObject(pkey))
-      throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
-    if (getKeyObjectType(pkey) !== 'private')
-      throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
-    return this[kHandle].checkPrivateKey(getKeyObjectHandle(pkey));
-  }
+  InternalX509Certificate = class InternalX509Certificate
+    extends NativeX509Certificate {
+    #state = createState();
+
+    static {
+      isX509Certificate = (value) => {
+        if (value == null || typeof value !== 'object') return false;
+        return #state in value || isNativeX509Certificate(value);
+      };
+
+      getState = (cert) => {
+        try {
+          return cert.#state;
+        } catch {
+          // Continue with the cross-realm native brand check.
+        }
+        if (!isNativeX509Certificate(cert)) {
+          throw new ERR_INVALID_THIS('X509Certificate');
+        }
+        let state = crossRealmState.get(cert);
+        if (state === undefined) {
+          state = createState();
+          crossRealmState.set(cert, state);
+        }
+        return state;
+      };
+    }
+  };
 
-  verify(pkey) {
-    if (!isKeyObject(pkey))
-      throw new ERR_INVALID_ARG_TYPE('pkey', 'KeyObject', pkey);
-    if (getKeyObjectType(pkey) !== 'public')
-      throw new ERR_INVALID_ARG_VALUE('pkey', pkey);
-    return this[kHandle].verify(getKeyObjectHandle(pkey));
-  }
+  InternalX509Certificate.prototype.constructor = X509Certificate;
+  ObjectSetPrototypeOf(
+    InternalX509Certificate.prototype,
+    X509Certificate.prototype);
 
-  toLegacyObject() {
-    // TODO(tniessen): do not depend on translatePeerCertificate here, return
-    // the correct legacy representation from the binding
-    lazyTranslatePeerCertificate ??=
-      require('internal/tls/common').translatePeerCertificate;
-    return lazyTranslatePeerCertificate(this[kHandle].toLegacy());
-  }
-}
+  return [X509Certificate, InternalX509Certificate];
+});
 
-InternalX509Certificate.prototype.constructor = X509Certificate;
-ObjectSetPrototypeOf(
-  InternalX509Certificate.prototype,
-  X509Certificate.prototype);
+// Keep the binding-returned constructor and the closure reference aligned.
+InternalX509Certificate = InternalX509CertificateConstructor;
 
 module.exports = {
   X509Certificate,
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index 01f05a55ae8f..4da012104f15 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -1022,11 +1022,16 @@ function determineSpecificType(value) {
       return `type symbol (${String(value)})`;
     case 'function':
       return `function ${value.name}`;
-    case 'object':
-      if (value.constructor && 'name' in value.constructor) {
-        return `an instance of ${value.constructor.name}`;
+    case 'object': {
+      // `constructor` may be user-controlled: it need not be an object, and
+      // its `name` need not be a non-empty string. Reading either can invoke
+      // an accessor, so read each one once.
+      const name = value.constructor?.name;
+      if (typeof name === 'string' && name !== '') {
+        return `an instance of ${name}`;
       }
       return `${lazyInternalUtilInspect().inspect(value, { depth: -1 })}`;
+    }
     case 'string':
       value.length > 28 && (value = `${StringPrototypeSlice(value, 0, 25)}...`);
       if (StringPrototypeIndexOf(value, "'") === -1) {
@@ -1173,8 +1178,12 @@ E('ERR_CRYPTO_INVALID_DIGEST', 'Invalid digest: %s', TypeError);
 E('ERR_CRYPTO_INVALID_JWK', 'Invalid JWK data', TypeError);
 E('ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE',
   'Invalid key object type %s, expected %s.', TypeError);
+E('ERR_CRYPTO_INVALID_MAC', 'Invalid MAC: %s', TypeError);
 E('ERR_CRYPTO_INVALID_STATE', 'Invalid state for operation %s', Error);
 E('ERR_CRYPTO_KEM_NOT_SUPPORTED', 'KEM is not supported', Error);
+E('ERR_CRYPTO_MAC_FINALIZED', 'MAC already finalized', Error);
+E('ERR_CRYPTO_MAC_NOT_SUPPORTED', 'MAC is not supported', Error);
+E('ERR_CRYPTO_MAC_UPDATE_FAILED', 'MAC update failed', Error);
 E('ERR_CRYPTO_PBKDF2_ERROR', 'PBKDF2 error', Error);
 E('ERR_CRYPTO_SCRYPT_NOT_SUPPORTED', 'Scrypt algorithm not supported', Error);
 // Switch to TypeError. The current implementation does not seem right.
@@ -1840,6 +1849,7 @@ E('ERR_TEST_FAILURE', function(error, failureType) {
   this.cause = error;
   return msg;
 }, Error);
+E('ERR_THROTTLED', 'The call was dropped by the throttled function', Error);
 E('ERR_TLS_ALPN_CALLBACK_INVALID_RESULT', (value, protocols) => {
   return `ALPN callback returned a value (${
     value
diff --git a/lib/internal/event_target.js b/lib/internal/event_target.js
index bfb948bb1ced..e5c7e2a13c94 100644
--- a/lib/internal/event_target.js
+++ b/lib/internal/event_target.js
@@ -14,6 +14,7 @@ const {
   ReflectApply,
   SafeFinalizationRegistry,
   SafeMap,
+  SafeSet,
   SafeWeakMap,
   SafeWeakRef,
   SafeWeakSet,
@@ -491,8 +492,17 @@ class Listener {
         listener: this,
         eventType,
       }, this);
-      // Make the retainer retain the listener in a WeakMap
-      weakListeners().map.set(weak, listener);
+      // Store only a WeakRef to the retainer here. Listener instances are
+      // Strongly reachable from the EventTarget's listener list for as long
+      // as they're registered, so a plain strong reference would keep the
+      // retainer (and listener) alive forever, defeating weak retention
+      this.weakKeyRef = new SafeWeakRef(weak);
+      let retained = weakListeners().map.get(weak);
+      if (retained === undefined) {
+        retained = new SafeSet();
+        weakListeners().map.set(weak, retained);
+      }
+      retained.add(listener);
       this.listener = this.callback;
     } else if (typeof listener === 'function') {
       this.callback = listener;
@@ -545,8 +555,19 @@ class Listener {
     if (this.next !== undefined)
       this.next.previous = this.previous;
     this.removed = true;
-    if (this.weak)
+    if (this.weak) {
       weakListeners().registry.unregister(this);
+      const weakKey = this.weakKeyRef?.deref();
+      const listener = this.callback?.deref();
+      if (weakKey !== undefined && listener !== undefined) {
+        const retained = weakListeners().map.get(weakKey);
+        if (retained !== undefined) {
+          retained.delete(listener);
+          if (retained.size === 0)
+            weakListeners().map.delete(weakKey);
+        }
+      }
+    }
   }
 }
 
diff --git a/lib/internal/fs/cp/cp-sync.js b/lib/internal/fs/cp/cp-sync.js
index f2b00f3f82bb..cdbec3e6796e 100644
--- a/lib/internal/fs/cp/cp-sync.js
+++ b/lib/internal/fs/cp/cp-sync.js
@@ -134,6 +134,15 @@ function setDestTimestamps(src, dest) {
 // TODO(@anonrig): Move this function to C++.
 function onDir(srcStat, destStat, src, dest, opts) {
   if (!destStat) return copyDir(src, dest, opts, true, srcStat.mode);
+  if (opts.errorOnExist && !opts.force) {
+    throw new ERR_FS_CP_EEXIST({
+      message: `${dest} already exists`,
+      path: dest,
+      syscall: 'cp',
+      errno: EEXIST,
+      code: 'EEXIST',
+    });
+  }
   return copyDir(src, dest, opts);
 }
 
@@ -179,6 +188,9 @@ function copyDir(src, dest, opts, mkDir, srcMode) {
   } finally {
     dir.closeSync();
 
+    if (opts.preserveTimestamps) {
+      setDestTimestamps(src, dest);
+    }
     if (srcMode !== undefined) {
       setDestMode(dest, srcMode);
     }
diff --git a/lib/internal/fs/cp/cp.js b/lib/internal/fs/cp/cp.js
index 2eb4f0ffdd83..35fcefb12d10 100644
--- a/lib/internal/fs/cp/cp.js
+++ b/lib/internal/fs/cp/cp.js
@@ -311,12 +311,18 @@ async function onDir(srcStat, destStat, src, dest, opts) {
       code: 'EEXIST',
     });
   }
-  return copyDir(src, dest, opts);
+  await copyDir(src, dest, opts);
+  if (opts.preserveTimestamps) {
+    await setDestTimestamps(src, dest);
+  }
 }
 
 async function mkDirAndCopy(srcMode, src, dest, opts) {
   await mkdir(dest);
   await copyDir(src, dest, opts);
+  if (opts.preserveTimestamps) {
+    await setDestTimestamps(src, dest);
+  }
   return setDestMode(dest, srcMode);
 }
 
diff --git a/lib/internal/fs/glob.js b/lib/internal/fs/glob.js
index efa590a55749..310253cd268e 100644
--- a/lib/internal/fs/glob.js
+++ b/lib/internal/fs/glob.js
@@ -354,7 +354,10 @@ class Glob {
         // consistent comparison before instantiating matchers.
         const matchers = exclude
           .map((pattern) => resolve(this.#root, pattern))
-          .map((pattern) => createMatcher(pattern));
+          // Exclude matching is a pure string comparison with no filesystem
+          // lookups, so unlike include patterns, literal patterns must also
+          // match case-insensitively on case-insensitive platforms.
+          .map((pattern) => createMatcher(pattern, { nocaseMagicOnly: false }));
         this.#isExcluded = (value) =>
           matchers.some((matcher) => matcher.match(value));
         this.#results.setup(this.#root, this.#isExcluded);
@@ -616,9 +619,9 @@ class Glob {
             subPatterns.add(index + 2);
           }
           if ((nextMatches || pattern.at(0) === '.') &&
-           (entryIsDirectory || entry.isSymbolicLink()) && !fromSymlink) {
+           entryIsDirectory && !fromSymlink) {
             // If pattern after ** matches, or pattern starts with "."
-            // and entry is a directory or symlink, add to potential patterns
+            // and entry is a directory, add to potential patterns
             subPatterns.add(nextIndex);
           }
 
@@ -834,9 +837,9 @@ class Glob {
             subPatterns.add(index + 2);
           }
           if ((nextMatches || pattern.at(0) === '.') &&
-           (entryIsDirectory || entry.isSymbolicLink()) && !fromSymlink) {
+           entryIsDirectory && !fromSymlink) {
             // If pattern after ** matches, or pattern starts with "."
-            // and entry is a directory or symlink, add to potential patterns
+            // and entry is a directory, add to potential patterns
             subPatterns.add(nextIndex);
           }
 
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index 860251e71c96..561b7ae5e8b4 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -363,7 +363,7 @@ class FileHandle extends EventEmitter {
 
       async pull(controller) {
         const view = controller.byobRequest.view;
-        const { bytesRead } = await readFn(view, view.byteOffset, view.byteLength);
+        const { bytesRead } = await readFn(view, 0, view.byteLength);
 
         if (bytesRead === 0) {
           controller.close();
@@ -1382,6 +1382,7 @@ async function read(handle, bufferOrParams, offset, length, position) {
   }
 
   length ??= buffer.byteLength - offset;
+  length |= 0;
 
   if (position == null) {
     position = -1;
@@ -1535,6 +1536,9 @@ async function rmdir(path, options) {
 }
 
 async function fdatasync(handle) {
+  if (permission.isEnabled()) {
+    throw new ERR_ACCESS_DENIED('fdatasync API is disabled when Permission Model is enabled.');
+  }
   return await PromisePrototypeThen(
     binding.fdatasync(handle.fd, kUsePromises),
     undefined,
@@ -1543,6 +1547,9 @@ async function fdatasync(handle) {
 }
 
 async function fsync(handle) {
+  if (permission.isEnabled()) {
+    throw new ERR_ACCESS_DENIED('fsync API is disabled when Permission Model is enabled.');
+  }
   return await PromisePrototypeThen(
     binding.fsync(handle.fd, kUsePromises),
     undefined,
diff --git a/lib/internal/fs/recursive_watch.js b/lib/internal/fs/recursive_watch.js
index 2f71aeda9f79..85d84f9dd8f3 100644
--- a/lib/internal/fs/recursive_watch.js
+++ b/lib/internal/fs/recursive_watch.js
@@ -17,7 +17,7 @@ const {
   },
 } = require('internal/errors');
 const { getValidatedPath } = require('internal/fs/utils');
-const { createIgnoreMatcher, kFSWatchStart, StatWatcher } = require('internal/fs/watchers');
+const { createIgnoreMatcher, kFSWatchStart } = require('internal/fs/watchers');
 const { kEmptyObject } = require('internal/util');
 const { validateBoolean, validateAbortSignal, validateIgnoreOption } = require('internal/validators');
 const {
@@ -37,14 +37,40 @@ function lazyLoadFsSync() {
 
 let kResistStopPropagation;
 
+const kIsAIX = process.platform === 'aix';
+
+function isPathMissingForWatch(error, file) {
+  if (error.code === 'ENOENT') {
+    return true;
+  }
+  // AIX reports ENODEV when the path disappears before fs.watch() starts.
+  // Check that it is actually gone so other ENODEV errors still propagate.
+  if (!kIsAIX || error.code !== 'ENODEV') {
+    return false;
+  }
+  try {
+    return lazyLoadFsSync().statSync(file, { throwIfNoEntry: false }) === undefined;
+  } catch {
+    return false;
+  }
+}
+
+// Inotify reports changes to a directory's entries, with their names, on the
+// directory's own watch, so one watcher per directory is enough on Linux.
+// kqueue and event ports only report that the directory itself changed, so
+// elsewhere every file keeps a watcher of its own as well.
+const kDirectoryWatchReportsEntries = process.platform === 'linux';
+
 class FSWatcher extends EventEmitter {
   #options = null;
   #closed = false;
-  #files = new SafeMap();
+  // Every path below the root that has been reported (or existed at start).
+  #entries = new SafeSet();
+  // One fs.watch() per directory and symbolic link (and per file where the
+  // directory watch does not report its entries).
   #watchers = new SafeMap();
-  #symbolicFiles = new SafeSet();
+  #symbolicLinks = new SafeSet();
   #rootPath = pathResolve();
-  #watchingFile = false;
   #ignoreMatcher = null;
 
   constructor(options = kEmptyObject) {
@@ -94,129 +120,199 @@ class FSWatcher extends EventEmitter {
 
     this.#closed = true;
 
-    for (const file of this.#files.keys()) {
-      this.#watchers.get(file)?.close();
-      this.#watchers.delete(file);
+    for (const watcher of this.#watchers.values()) {
+      watcher.close();
     }
-
-    this.#files.clear();
-    this.#symbolicFiles.clear();
+    this.#watchers.clear();
+    this.#entries.clear();
+    this.#symbolicLinks.clear();
     this.emit('close');
   }
 
-  #unwatchFiles(file) {
-    this.#symbolicFiles.delete(file);
+  #emit(eventType, file) {
+    this.emit('change', eventType, pathRelative(this.#rootPath, file));
+  }
+
+  #forget(file) {
+    const watcher = this.#watchers.get(file);
+    if (watcher !== undefined) {
+      watcher.close();
+      this.#watchers.delete(file);
+    }
+    this.#entries.delete(file);
+    this.#symbolicLinks.delete(file);
 
     const childPrefix = file + pathSep;
-    for (const filename of this.#files.keys()) {
-      if (filename === file ||
-          StringPrototypeStartsWith(filename, childPrefix)) {
-        this.#files.delete(filename);
-        this.#watchers.get(filename)?.close();
-        this.#watchers.delete(filename);
+    for (const entry of this.#entries) {
+      if (StringPrototypeStartsWith(entry, childPrefix)) {
+        this.#entries.delete(entry);
+        this.#symbolicLinks.delete(entry);
+        const childWatcher = this.#watchers.get(entry);
+        if (childWatcher !== undefined) {
+          childWatcher.close();
+          this.#watchers.delete(entry);
+        }
       }
     }
   }
 
-  #watchFolder(folder) {
-    const { readdirSync } = lazyLoadFsSync();
-
+  // Report an entry that vanished between being listed and being watched so
+  // the caller can discard its stale bookkeeping.
+  #watch(file, onChange) {
+    if (this.#closed) {
+      return false;
+    }
+    if (this.#watchers.has(file)) {
+      return true;
+    }
+    const { watch } = lazyLoadFsSync();
+    let watcher;
     try {
-      const files = readdirSync(folder, {
-        withFileTypes: true,
-      });
-
-      for (const file of files) {
-        if (this.#closed) {
-          break;
-        }
+      watcher = watch(file, { persistent: this.#options.persistent }, onChange);
+    } catch (err) {
+      if (isPathMissingForWatch(err, file) &&
+          (file !== this.#rootPath || !this.#options.throwIfNoEntry)) {
+        return false;
+      }
+      throw err;
+    }
+    this.#watchers.set(file, watcher);
+    return true;
+  }
 
-        const f = pathJoin(folder, file.name);
-        const relativePath = pathRelative(this.#rootPath, f);
+  // Arms one watcher for `folder`, then registers entries that are not known
+  // yet (emitting 'rename' for them unless this is the initial scan);
+  // #addEntry() descends into subdirectories.
+  #scanFolder(folder, initial) {
+    if (!this.#watch(folder, (eventType, filename) => this.#onFolderEvent(folder, filename))) {
+      this.#forget(folder);
+      return;
+    }
 
-        // Skip watching ignored paths entirely to avoid kernel resource pressure
-        if (this.#ignoreMatcher?.(relativePath)) {
-          continue;
+    const { readdirSync } = lazyLoadFsSync();
+    let entries;
+    try {
+      entries = readdirSync(folder, { withFileTypes: true });
+    } catch (error) {
+      if (error.code === 'ENOENT' || error.code === 'ENOTDIR') {
+        if (folder === this.#rootPath && initial &&
+            (error.code !== 'ENOENT' || this.#options.throwIfNoEntry)) {
+          throw error;
         }
-
-        if (!this.#files.has(f)) {
-          this.emit('change', 'rename', relativePath);
-
-          if (file.isSymbolicLink()) {
-            this.#symbolicFiles.add(f);
-          }
-
-          try {
-            this.#watchFile(f);
-            if (file.isDirectory() && !file.isSymbolicLink()) {
-              this.#watchFolder(f);
-            }
-          } catch (err) {
-            // Ignore ENOENT
-            if (err.code !== 'ENOENT') {
-              throw err;
-            }
-          }
+        if (!initial && !this.#closed) {
+          this.#emit('rename', folder);
         }
-      }
-    } catch (error) {
-      if (error.code !== 'ENOENT') {
+        this.#forget(folder);
+      } else {
         this.emit('error', error);
       }
+      return;
+    }
+
+    for (const entry of entries) {
+      if (this.#closed) {
+        break;
+      }
+      const file = pathJoin(folder, entry.name);
+      if (!this.#entries.has(file) && !this.#ignoreMatcher?.(pathRelative(this.#rootPath, file))) {
+        this.#addEntry(file, entry, initial);
+      }
+    }
+  }
+
+  // `entry` is the Dirent or the lstat() Stats of `file`.
+  #addEntry(file, entry, initial) {
+    this.#entries.add(file);
+    if (!initial) {
+      this.#emit('rename', file);
+    }
+    if (entry.isSymbolicLink()) {
+      // The link target is watched so that changes behind the link surface
+      // as a 'rename' of the link, as they always have on this code path.
+      this.#symbolicLinks.add(file);
+      if (!this.#watch(file, () => this.#emit('rename', file))) {
+        this.#forget(file);
+      }
+    } else if (entry.isDirectory()) {
+      this.#scanFolder(file, initial);
+    } else if (!kDirectoryWatchReportsEntries) {
+      if (!this.#watch(file, () => this.#onEntryEvent(file))) {
+        this.#forget(file);
+      }
     }
   }
 
-  #watchFile(file) {
+  #onFolderEvent(folder, filename) {
     if (this.#closed) {
       return;
     }
+    const { lstatSync, statSync } = lazyLoadFsSync();
+    if (!kDirectoryWatchReportsEntries || filename == null) {
+      // All that is known is that something about `folder` changed.
+      if (statSync(folder, { throwIfNoEntry: false }) === undefined) {
+        this.#emit('rename', folder);
+        this.#forget(folder);
+      } else {
+        this.#scanFolder(folder, false);
+      }
+      return;
+    }
+    // Events about the watched directory itself are reported under its own
+    // name; those take the "unknown entry" path and are resolved by the parent.
+    const file = pathJoin(folder, filename);
 
-    const { watch, statSync } = lazyLoadFsSync();
-
-    if (this.#files.has(file)) {
+    if (!this.#entries.has(file)) {
+      if (this.#ignoreMatcher?.(pathRelative(this.#rootPath, file))) {
+        return;
+      }
+      const entry = lstatSync(file, { throwIfNoEntry: false });
+      if (entry !== undefined) {
+        this.#addEntry(file, entry, false);
+      } else if (folder === this.#rootPath && statSync(folder, { throwIfNoEntry: false }) === undefined) {
+        this.#emit('rename', folder);
+        this.#forget(folder);
+      }
       return;
     }
 
-    {
-      const existingStat = statSync(file);
-      this.#files.set(file, existingStat);
+    this.#onEntryEvent(file);
+  }
+
+  // Something happened to a known entry: work out what from its current state.
+  #onEntryEvent(file) {
+    if (this.#closed) {
+      return;
+    }
+    const { statSync } = lazyLoadFsSync();
+    const stats = statSync(file, { throwIfNoEntry: false });
+    if (stats === undefined) {
+      this.#emit('rename', file);
+      this.#forget(file);
+    } else if (this.#symbolicLinks.has(file)) {
+      this.#emit('rename', file);
+    } else if (stats.isDirectory()) {
+      this.#scanFolder(file, false);
+    } else {
+      this.#emit('change', file);
     }
+  }
 
-    const watcher = watch(file, {
-      persistent: this.#options.persistent,
-    }, (eventType, filename) => {
-      const existingStat = this.#files.get(file);
-      let currentStats;
-
-      try {
-        currentStats = statSync(file);
-        this.#files.set(file, currentStats);
-      } catch {
-        // This happens if the file was removed
+  #watchRootFile(file) {
+    const { statSync } = lazyLoadFsSync();
+    this.#entries.add(file);
+    if (!this.#watch(file, () => {
+      if (this.#closed) {
+        return;
       }
-
-      if (currentStats === undefined || (currentStats.birthtimeMs === 0 && existingStat.birthtimeMs !== 0)) {
-        // The file is now deleted
-        this.#files.delete(file);
-        this.#watchers.delete(file);
-        watcher.close();
-        this.emit('change', 'rename', pathRelative(this.#rootPath, file));
-        this.#unwatchFiles(file);
-      } else if (file === this.#rootPath && this.#watchingFile) {
-        // This case will only be triggered when watching a file with fs.watch
-        this.emit('change', 'change', pathBasename(file));
-      } else if (this.#symbolicFiles.has(file)) {
-        // Stats from watchFile does not return correct value for currentStats.isSymbolicLink()
-        // Since it is only valid when using fs.lstat(). Therefore, check the existing symbolic files.
-        this.emit('change', 'rename', pathRelative(this.#rootPath, file));
-      } else if (currentStats.isDirectory()) {
-        this.#watchFolder(file);
+      if (statSync(file, { throwIfNoEntry: false }) === undefined) {
+        this.#emit('rename', file);
+        this.#forget(file);
       } else {
-        // Watching a directory will trigger a change event for child files)
-        this.emit('change', 'change', pathRelative(this.#rootPath, file));
+        this.emit('change', 'change', pathBasename(file));
       }
-    });
-    this.#watchers.set(file, watcher);
+    })) {
+      this.#forget(file);
+    }
   }
 
   [kFSWatchStart](filename) {
@@ -227,15 +323,16 @@ class FSWatcher extends EventEmitter {
 
       this.#rootPath = filename;
       this.#closed = false;
-      this.#watchingFile = file.isFile();
 
-      this.#watchFile(filename);
       if (file.isDirectory()) {
-        this.#watchFolder(filename);
+        this.#scanFolder(filename, true);
+      } else {
+        this.#watchRootFile(filename);
       }
     } catch (error) {
-      if (!this.#options.throwIfNoEntry && error.code === 'ENOENT') {
+      if (this.#options.throwIfNoEntry || error.code !== 'ENOENT') {
         error.filename = filename;
+        this.close();
         throw error;
       }
     }
@@ -243,19 +340,15 @@ class FSWatcher extends EventEmitter {
   }
 
   ref() {
-    this.#files.forEach((file) => {
-      if (file instanceof StatWatcher) {
-        file.ref();
-      }
-    });
+    for (const watcher of this.#watchers.values()) {
+      watcher.ref();
+    }
   }
 
   unref() {
-    this.#files.forEach((file) => {
-      if (file instanceof StatWatcher) {
-        file.unref();
-      }
-    });
+    for (const watcher of this.#watchers.values()) {
+      watcher.unref();
+    }
   }
 
   [SymbolAsyncIterator]() {
diff --git a/lib/internal/histogram.js b/lib/internal/histogram.js
index 952f6058019f..1cc787404fdc 100644
--- a/lib/internal/histogram.js
+++ b/lib/internal/histogram.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const {
-  ArrayIsArray,
+  BigInt,
   Float64Array,
   Map,
   MapPrototypeEntries,
@@ -13,6 +13,7 @@ const {
 
 const {
   Histogram: _Histogram,
+  SlidingWindowHistogram: _SlidingWindowHistogram,
 } = internalBinding('performance');
 
 const {
@@ -33,14 +34,26 @@ const {
 } = require('internal/errors');
 
 const {
+  validateArray,
+  validateBoolean,
   validateInteger,
   validateNumber,
   validateObject,
+  validateOneOf,
 } = require('internal/validators');
 
+const {
+  isUint8Array,
+} = require('internal/util/types');
+
 const kDestroy = Symbol('kDestroy');
 const kHandle = Symbol('kHandle');
 const kRecordable = Symbol('kRecordable');
+const kSlidingWindowHandle = Symbol('kSlidingWindowHandle');
+const kQrdeDequantizationModes = ['none', 'hdr', 'all'];
+const kMaxSlidingWindowHistogramChunks = 1024;
+const kMaxChunkDuration = 18_446_744_073_709;
+const kMaxInt64 = 9_223_372_036_854_775_807n;
 
 const {
   kClone,
@@ -193,6 +206,30 @@ class Histogram {
     return this[kHandle]?.mean();
   }
 
+  /**
+   * Returns a confidence interval for the mean using Student's t-distribution.
+   * @param {{ confidence?: number }} [options]
+   * @returns {{ mean: number, lower: number, upper: number }}
+   */
+  meanCI(options = kEmptyObject) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateObject(options, 'options');
+    const { confidence = 0.95 } = options;
+    validateNumber(confidence, 'options.confidence');
+    if (NumberIsNaN(confidence) || confidence <= 0 || confidence >= 1)
+      throw new ERR_OUT_OF_RANGE('options.confidence',
+                                 '> 0 && < 1', confidence);
+    const result = this[kHandle]?.meanCI(confidence);
+    if (result === undefined) return undefined;
+    return {
+      __proto__: null,
+      mean: result[0],
+      lower: result[1],
+      upper: result[2],
+    };
+  }
+
   /**
    * @readonly
    * @type {number}
@@ -213,6 +250,18 @@ class Histogram {
     return this[kHandle]?.exceedsBigInt();
   }
 
+  /**
+   * Serializes the histogram to a CBOR-encoded Uint8Array suitable for
+   * transmission or storage. The data can be reconstructed into a new
+   * histogram using `importHistogram()`.
+   * @returns {Uint8Array}
+   */
+  export() {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    return this[kHandle]?.export();
+  }
+
   /**
    * Returns the exponentially weighted moving average of recorded values.
    * Only active when the histogram was created with a `halfLife` option.
@@ -539,8 +588,7 @@ class Histogram {
   percentilesAt(percentiles) {
     if (!isHistogram(this))
       throw new ERR_INVALID_THIS('Histogram');
-    if (!ArrayIsArray(percentiles))
-      throw new ERR_INVALID_ARG_TYPE('percentiles', 'Array', percentiles);
+    validateArray(percentiles, 'percentiles');
     for (let i = 0; i < percentiles.length; i++) {
       validateNumber(percentiles[i], `percentiles[${i}]`);
       if (NumberIsNaN(percentiles[i]) ||
@@ -555,6 +603,73 @@ class Histogram {
     return map;
   }
 
+  /**
+   * Builds a quantile-respectful density estimate using Harrell-Davis
+   * quantiles. Values can be spread deterministically within their HDR
+   * equivalent-value ranges to reduce quantization artifacts.
+   * @param {{ bins?: number, probabilities?: number[],
+   *   dequantize?: 'none'|'hdr'|'all', cache?: boolean }} [options]
+   * @returns {Promise<{
+   *   probabilities: Float64Array,
+   *   quantiles: Float64Array,
+   *   densities: Float64Array,
+   *   count: bigint,
+   *   bucketCount: number,
+   *   corrections: number,
+   *   dequantize: 'none'|'hdr'|'all',
+   * }>}
+   */
+  qrde(options = kEmptyObject) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateObject(options, 'options');
+    const { bins, probabilities, dequantize = 'hdr', cache = false } = options;
+    if (bins !== undefined && probabilities !== undefined) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'options', options, '"bins" and "probabilities" are mutually exclusive');
+    }
+
+    let boundaries;
+    if (probabilities === undefined) {
+      const binCount = bins ?? 100;
+      validateInteger(binCount, 'options.bins', 1, 1000);
+      boundaries = new Float64Array(binCount + 1);
+      for (let i = 0; i <= binCount; i++) boundaries[i] = i / binCount;
+    } else {
+      validateArray(probabilities, 'options.probabilities', 2);
+      const length = probabilities.length;
+      if (length > 1001) {
+        throw new ERR_OUT_OF_RANGE(
+          'options.probabilities.length', '>= 2 && <= 1001', length);
+      }
+
+      boundaries = new Float64Array(length);
+      let previous = -1;
+      for (let i = 0; i < length; i++) {
+        const probability = probabilities[i];
+        validateNumber(probability, `options.probabilities[${i}]`, 0, 1);
+        if (probability <= previous) {
+          throw new ERR_INVALID_ARG_VALUE(
+            'options.probabilities', probabilities, 'must be strictly increasing');
+        }
+        boundaries[i] = probability;
+        previous = probability;
+      }
+      if (boundaries[0] !== 0 || boundaries[length - 1] !== 1) {
+        throw new ERR_INVALID_ARG_VALUE(
+          'options.probabilities', probabilities, 'must start with 0 and end with 1');
+      }
+    }
+
+    validateOneOf(dequantize,
+                  'options.dequantize', kQrdeDequantizationModes);
+    validateBoolean(cache, 'options.cache');
+    let mode = 0;
+    if (dequantize === 'hdr') mode = 1;
+    else if (dequantize === 'all') mode = 2;
+    return this[kHandle]?.qrde(boundaries, mode, cache);
+  }
+
   /**
    * @returns {void}
    */
@@ -692,6 +807,48 @@ class RecordableHistogram extends Histogram {
   }
 }
 
+class SlidingWindowHistogram {
+  constructor(skipThrowSymbol = undefined) {
+    if (skipThrowSymbol !== kSkipThrow) {
+      throw new ERR_ILLEGAL_CONSTRUCTOR();
+    }
+  }
+
+  /**
+   * @param {number|bigint} val
+   * @returns {void}
+   */
+  record(val) {
+    if (this[kSlidingWindowHandle] === undefined)
+      throw new ERR_INVALID_THIS('SlidingWindowHistogram');
+    if (typeof val === 'bigint') {
+      this[kSlidingWindowHandle].record(val);
+      return;
+    }
+
+    validateInteger(val, 'val', 1);
+    this[kSlidingWindowHandle].record(val);
+  }
+
+  /**
+   * @returns {Histogram}
+   */
+  snapshot() {
+    if (this[kSlidingWindowHandle] === undefined)
+      throw new ERR_INVALID_THIS('SlidingWindowHistogram');
+    return new ClonedHistogram(this[kSlidingWindowHandle].snapshot());
+  }
+
+  /**
+   * @returns {void}
+   */
+  reset() {
+    if (this[kSlidingWindowHandle] === undefined)
+      throw new ERR_INVALID_THIS('SlidingWindowHistogram');
+    this[kSlidingWindowHandle].reset();
+  }
+}
+
 function ClonedHistogram(handle) {
   const histogram = new Histogram(kSkipThrow);
   markTransferMode(histogram, true, false);
@@ -718,6 +875,32 @@ function createRecordableHistogram(handle) {
   return new ClonedRecordableHistogram(handle);
 }
 
+function validateHistogramOptions(lowest, highest, figures) {
+  if (typeof lowest !== 'bigint') {
+    validateInteger(lowest, 'options.lowest', 1, NumberMAX_SAFE_INTEGER);
+  } else if (lowest < 1n || lowest > kMaxInt64) {
+    throw new ERR_OUT_OF_RANGE(
+      'options.lowest', `>= 1n && <= ${kMaxInt64}n`, lowest);
+  }
+
+  if (typeof highest !== 'bigint') {
+    validateInteger(highest, 'options.highest', 1, NumberMAX_SAFE_INTEGER);
+  } else if (highest < 1n || highest > kMaxInt64) {
+    throw new ERR_OUT_OF_RANGE(
+      'options.highest', `>= 1n && <= ${kMaxInt64}n`, highest);
+  }
+
+  const minimumHighest = 2n *
+    (typeof lowest === 'bigint' ? lowest : BigInt(lowest));
+  const highestBigInt = typeof highest === 'bigint' ?
+    highest : BigInt(highest);
+  if (highestBigInt < minimumHighest) {
+    throw new ERR_OUT_OF_RANGE(
+      'options.highest', `>= 2 * options.lowest (${minimumHighest}n)`, highest);
+  }
+  validateInteger(figures, 'options.figures', 1, 5);
+}
+
 /**
  * @param {{
  *   lowest? : number,
@@ -737,15 +920,7 @@ function createHistogram(options = kEmptyObject) {
     halfLife = 0,
     threshold = 0,
   } = options;
-  if (typeof lowest !== 'bigint')
-    validateInteger(lowest, 'options.lowest', 1, NumberMAX_SAFE_INTEGER);
-  if (typeof highest !== 'bigint') {
-    validateInteger(highest, 'options.highest',
-                    2 * lowest, NumberMAX_SAFE_INTEGER);
-  } else if (highest < 2n * lowest) {
-    throw new ERR_INVALID_ARG_VALUE.RangeError('options.highest', highest);
-  }
-  validateInteger(figures, 'options.figures', 1, 5);
+  validateHistogramOptions(lowest, highest, figures);
   validateNumber(halfLife, 'options.halfLife');
   if (halfLife < 0)
     throw new ERR_OUT_OF_RANGE('options.halfLife', '>= 0', halfLife);
@@ -756,9 +931,73 @@ function createHistogram(options = kEmptyObject) {
     new _Histogram(lowest, highest, figures, halfLife, threshold));
 }
 
+/**
+ * @param {{
+ *   chunks: number,
+ *   chunkDuration? : number,
+ *   recordsPerChunk? : number,
+ *   lowest? : number|bigint,
+ *   highest? : number|bigint,
+ *   figures? : number,
+ * }} options
+ * @returns {SlidingWindowHistogram}
+ */
+function createSlidingWindowHistogram(options) {
+  validateObject(options, 'options');
+  const {
+    chunks,
+    chunkDuration,
+    recordsPerChunk,
+    lowest = 1,
+    highest = NumberMAX_SAFE_INTEGER,
+    figures = 3,
+  } = options;
+
+  validateInteger(
+    chunks, 'options.chunks', 1, kMaxSlidingWindowHistogramChunks);
+  validateHistogramOptions(lowest, highest, figures);
+
+  const timeBased = chunkDuration !== undefined;
+  if (timeBased === (recordsPerChunk !== undefined)) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'options', options,
+      'must specify exactly one of "chunkDuration" or "recordsPerChunk"');
+  }
+
+  let rotateAt;
+  if (timeBased) {
+    validateInteger(
+      chunkDuration, 'options.chunkDuration', 1, kMaxChunkDuration);
+    rotateAt = BigInt(chunkDuration) * 1_000_000n;
+  } else {
+    validateInteger(
+      recordsPerChunk, 'options.recordsPerChunk', 1, NumberMAX_SAFE_INTEGER);
+    rotateAt = BigInt(recordsPerChunk);
+  }
+
+  const histogram = new SlidingWindowHistogram(kSkipThrow);
+  markTransferMode(histogram, false, false);
+  histogram[kSlidingWindowHandle] = new _SlidingWindowHistogram(
+    lowest, highest, figures, chunks, timeBased, rotateAt);
+  return histogram;
+}
+
+/**
+ * Reconstructs a histogram from a CBOR-encoded Uint8Array previously
+ * produced by `histogram.export()`.
+ * @param {Uint8Array} data
+ * @returns {RecordableHistogram}
+ */
+function importHistogram(data) {
+  if (!isUint8Array(data))
+    throw new ERR_INVALID_ARG_TYPE('data', 'Uint8Array', data);
+  return createRecordableHistogram(_Histogram.import(data));
+}
+
 module.exports = {
   Histogram,
   RecordableHistogram,
+  SlidingWindowHistogram,
   ClonedHistogram,
   ClonedRecordableHistogram,
   isHistogram,
@@ -766,4 +1005,6 @@ module.exports = {
   kHandle,
   kSkipThrow,
   createHistogram,
+  createSlidingWindowHistogram,
+  importHistogram,
 };
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
index dc8b3a5558b3..ac4a72feef40 100644
--- a/lib/internal/http2/core.js
+++ b/lib/internal/http2/core.js
@@ -358,8 +358,15 @@ function emit(self, ...args) {
 // the block of headers on.
 function onSessionHeaders(handle, id, cat, flags, headers, sensitiveHeaders) {
   const session = this[kOwner];
-  if (session.destroyed)
+  // Session may have been destroyed mid-receive (e.g. session.destroy() from a
+  // 'stream' handler drained via nextTick inside MakeCallback while nghttp2 is
+  // still walking the receive buffer). Tear down the C++ stream so subsequent
+  // DATA frames do not call CallJSOnreadMethod with a missing onread.
+  if (session.destroyed) {
+    handle.rstStream(NGHTTP2_REFUSED_STREAM);
+    handle.destroy();
     return;
+  }
 
   const type = session[kType];
   session[kUpdateTimer]();
@@ -470,7 +477,11 @@ function onSessionHeaders(handle, id, cat, flags, headers, sensitiveHeaders) {
     }
   }
   if (endOfStream) {
-    stream.push(null);
+    const reqAsync = stream[kRequestAsyncResource];
+    if (reqAsync)
+      reqAsync.runInAsyncScope(() => stream.push(null));
+    else
+      stream.push(null);
   }
 }
 
@@ -591,7 +602,7 @@ function onPing(payload) {
 // point, close them. If there is an open fd for file send, close that also.
 // At this point the underlying node::http2:Http2Stream handle is no
 // longer usable so destroy it also.
-function onStreamClose(code) {
+function onStreamClose(code, peerReset) {
   const stream = this[kOwner];
   if (!stream || stream.destroyed)
     return false;
@@ -610,8 +621,9 @@ function onStreamClose(code) {
     // If errored or ended, we can destroy immediately.
     stream.destroy();
   } else {
-    // Wait for end to destroy.
-    stream.on('end', stream[kMaybeDestroy]);
+    // Preserve buffered reads after a clean reset, but do not wait for
+    // pending writes: the peer reset may prevent them from finishing.
+    stream.on('end', peerReset ? stream.destroy : stream[kMaybeDestroy]);
     // Push a null so the stream can end whenever the client consumes
     // it completely.
     stream.push(null);
@@ -2555,6 +2567,15 @@ class Http2Stream extends Duplex {
         });
       }
     }
+
+    // A write in flight may never get its native completion callback once the
+    // stream tears down; settle it so the Writable can clean up.
+    if (state.writeCb !== null) {
+      const writeCb = state.writeCb;
+      state.writeCb = null;
+      state.writePending = 0;
+      writeCb(err);
+    }
     callback(err);
   }
   // The Http2Stream can be destroyed if it has closed and if the readable
diff --git a/lib/internal/net.js b/lib/internal/net.js
index cea3dda23d61..2553449f0505 100644
--- a/lib/internal/net.js
+++ b/lib/internal/net.js
@@ -94,7 +94,9 @@ function isLoopback(host) {
     hostLower === 'localhost' ||
     hostLower.startsWith('127.') ||
     hostLower === '[::1]' ||
-    hostLower === '[0:0:0:0:0:0:0:1]'
+    hostLower === '::1' ||
+    hostLower === '[0:0:0:0:0:0:0:1]' ||
+    hostLower === '0:0:0:0:0:0:0:1'
   );
 }
 
diff --git a/lib/internal/perf/nodetiming.js b/lib/internal/perf/nodetiming.js
index a9e0c3f252ce..5de5e3e6644f 100644
--- a/lib/internal/perf/nodetiming.js
+++ b/lib/internal/perf/nodetiming.js
@@ -29,6 +29,7 @@ const {
   },
   loopIdleTime,
   uvMetricsInfo,
+  uvMetricsBuffer,
 } = internalBinding('performance');
 
 class PerformanceNodeTiming {
@@ -129,11 +130,11 @@ class PerformanceNodeTiming {
         enumerable: true,
         configurable: true,
         get: () => {
-          const metrics = uvMetricsInfo();
+          uvMetricsInfo();
           return {
-            loopCount: metrics[0],
-            events: metrics[1],
-            eventsWaiting: metrics[2],
+            loopCount: uvMetricsBuffer[0],
+            events: uvMetricsBuffer[1],
+            eventsWaiting: uvMetricsBuffer[2],
           };
         },
       },
diff --git a/lib/internal/perf/resource_timing.js b/lib/internal/perf/resource_timing.js
index f8459efa48e3..6b8f0d2aa524 100644
--- a/lib/internal/perf/resource_timing.js
+++ b/lib/internal/perf/resource_timing.js
@@ -17,6 +17,7 @@ const { enqueue, bufferResourceTiming } = require('internal/perf/observe');
 const { validateThisInternalField } = require('internal/validators');
 const { kEnumerableProperty } = require('internal/util');
 
+const kBodyInfo = Symbol('kBodyInfo');
 const kCacheMode = Symbol('kCacheMode');
 const kRequestedUrl = Symbol('kRequestedUrl');
 const kTimingInfo = Symbol('kTimingInfo');
@@ -110,11 +111,22 @@ class PerformanceResourceTiming extends PerformanceEntry {
     return this[kTimingInfo].finalNetworkRequestStartTime;
   }
 
-  get responseStart() {
+  get finalResponseHeadersStart() {
     validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
     return this[kTimingInfo].finalNetworkResponseStartTime;
   }
 
+  get firstInterimResponseStart() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].firstInterimNetworkResponseStartTime ?? 0;
+  }
+
+  get responseStart() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].firstInterimNetworkResponseStartTime ||
+      this[kTimingInfo].finalNetworkResponseStartTime;
+  }
+
   get responseEnd() {
     validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
     return this[kTimingInfo].endTime;
@@ -148,6 +160,22 @@ class PerformanceResourceTiming extends PerformanceEntry {
     return this[kResponseStatus];
   }
 
+  get renderBlockingStatus() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].renderBlocking === true ?
+      'blocking' : 'non-blocking';
+  }
+
+  get contentType() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kBodyInfo]?.contentType ?? '';
+  }
+
+  get contentEncoding() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kBodyInfo]?.contentEncoding ?? '';
+  }
+
   toJSON() {
     validateThisInternalField(this, kInitiatorType, 'PerformanceResourceTiming');
     return {
@@ -167,6 +195,8 @@ class PerformanceResourceTiming extends PerformanceEntry {
       connectEnd: this.connectEnd,
       secureConnectionStart: this.secureConnectionStart,
       requestStart: this.requestStart,
+      finalResponseHeadersStart: this.finalResponseHeadersStart,
+      firstInterimResponseStart: this.firstInterimResponseStart,
       responseStart: this.responseStart,
       responseEnd: this.responseEnd,
       transferSize: this.transferSize,
@@ -174,6 +204,9 @@ class PerformanceResourceTiming extends PerformanceEntry {
       decodedBodySize: this.decodedBodySize,
       deliveryType: this.deliveryType,
       responseStatus: this.responseStatus,
+      renderBlockingStatus: this.renderBlockingStatus,
+      contentType: this.contentType,
+      contentEncoding: this.contentEncoding,
     };
   }
 }
@@ -191,6 +224,8 @@ ObjectDefineProperties(PerformanceResourceTiming.prototype, {
   connectEnd: kEnumerableProperty,
   secureConnectionStart: kEnumerableProperty,
   requestStart: kEnumerableProperty,
+  finalResponseHeadersStart: kEnumerableProperty,
+  firstInterimResponseStart: kEnumerableProperty,
   responseStart: kEnumerableProperty,
   responseEnd: kEnumerableProperty,
   transferSize: kEnumerableProperty,
@@ -198,6 +233,9 @@ ObjectDefineProperties(PerformanceResourceTiming.prototype, {
   decodedBodySize: kEnumerableProperty,
   deliveryType: kEnumerableProperty,
   responseStatus: kEnumerableProperty,
+  renderBlockingStatus: kEnumerableProperty,
+  contentType: kEnumerableProperty,
+  contentEncoding: kEnumerableProperty,
   toJSON: kEnumerableProperty,
   [SymbolToStringTag]: {
     __proto__: null,
@@ -224,6 +262,7 @@ function createPerformanceResourceTiming(
   // The spec doesn't say to validate it in the class construction.
   resourceTiming[kTimingInfo] = timingInfo;
   resourceTiming[kCacheMode] = cacheMode;
+  resourceTiming[kBodyInfo] = bodyInfo;
   resourceTiming[kDeliveryType] = deliveryType;
   resourceTiming[kResponseStatus] = responseStatus;
 
diff --git a/lib/internal/process/per_thread.js b/lib/internal/process/per_thread.js
index 86a5e8080974..6f43502a0c6c 100644
--- a/lib/internal/process/per_thread.js
+++ b/lib/internal/process/per_thread.js
@@ -392,6 +392,9 @@ function buildAllowedFlags() {
 
   const allowedNodeEnvironmentFlags = [];
   for (const { 0: name, 1: info } of options) {
+    // Bracketed options are internal parser targets. They can be allowed in
+    // NODE_OPTIONS so aliases expand to them, but are not public flags.
+    if (name[0] === '[') continue;
     if (info.envVarSettings === kAllowedInEnvvar) {
       ArrayPrototypePush(allowedNodeEnvironmentFlags, name);
       if (info.type === kBoolean) {
diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
index a2790695e0b2..d17da5d9778a 100644
--- a/lib/internal/process/pre_execution.js
+++ b/lib/internal/process/pre_execution.js
@@ -125,7 +125,7 @@ function prepareExecution(options) {
   // Process initial diagnostic reporting configuration, if present.
   initializeReport();
 
-  setupDiagnosticsChannel();
+  setupDiagnosticsChannel(isMainThread);
 
   // Load permission system API
   initializePermission();
@@ -616,7 +616,7 @@ function initializeClusterIPC() {
   }
 }
 
-function setupDiagnosticsChannel() {
+function setupDiagnosticsChannel(isMainThread) {
   // Re-link native channels after snapshot deserialization since
   // JS references are cleared during serialization.
   // Keep this callback in sync with the initial registration in
@@ -631,6 +631,11 @@ function setupDiagnosticsChannel() {
       (channel._stores?.size || 0);
     return channel;
   });
+  if (isMainThread &&
+      process.versions.openssl !== undefined &&
+      getOptionValue('--enable-fips-indicator-events')) {
+    internalBinding('crypto').setupFipsIndicatorChannel();
+  }
 }
 
 function initializePermission() {
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index 111128237e8d..78d9777e6da1 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -962,9 +962,10 @@ setCallbacks({
     // Called when the stream C++ handle has been closed. The error is
     // either undefined (clean close) or a raw array [type, code, reason]
     // from QuicError::ToV8Value. Convert to a proper Node.js Error.
+    if (!this[kOwner]) return;
     if (error !== undefined) {
       error = convertQuicError(error);
-    } else if (this[kOwner] && !this[kOwner].destroyed) {
+    } else if (!this[kOwner].destroyed) {
       // The stream is closing cleanly, but it may have been reset by the
       // peer (ReceiveStreamReset) or locally (resetStream). The C++ side
       // records the reset code in state.resetCode. If set, surface the
diff --git a/lib/internal/source_map/source_map_cache.js b/lib/internal/source_map/source_map_cache.js
index 95b09090c473..e1fa55c5caba 100644
--- a/lib/internal/source_map/source_map_cache.js
+++ b/lib/internal/source_map/source_map_cache.js
@@ -9,6 +9,7 @@ const {
   RegExpPrototypeSymbolSplit,
   SafeMap,
   StringPrototypeCodePointAt,
+  StringPrototypeIndexOf,
   StringPrototypeSplit,
   StringPrototypeStartsWith,
 } = primordials;
@@ -176,16 +177,14 @@ function maybeCacheSourceMap(filename, content, moduleInstance, isGeneratedSourc
   // Normalize the sourceURL to a file URL if it is a path.
   sourceURL = normalizeReferrerURL(sourceURL);
 
-  const data = dataFromUrl(filename, sourceMapURL);
-  // `data` could be null if the source map is invalid.
-  // In this case, create a cache entry with null data with source url for test coverage.
-
+  // The payload is resolved on first use (see sourceMapData()), except under
+  // coverage, where it is serialized at exit when no more JS may run.
   const entry = {
     __proto__: null,
     lineLengths: lineLengths(content),
-    data,
-    // Save the source map url if it is not a data url.
-    sourceMapURL: data ? null : sourceMapURL,
+    data: process.env.NODE_V8_COVERAGE ? dataFromUrl(filename, sourceMapURL) : undefined,
+    filename,
+    sourceMapURL,
     sourceURL,
   };
 
@@ -254,20 +253,36 @@ function dataFromUrl(sourceURL, sourceMappingURL) {
   return sourceMapFromFile(mapURL);
 }
 
+const kUnicodeLineTerminators = /[\u2028\u2029]/;
+
 // Cache the length of each line in the file that a source map was extracted
 // from. This allows translation from byte offset V8 coverage reports,
 // to line/column offset Source Map V3.
 function lineLengths(content) {
+  if (RegExpPrototypeExec(kUnicodeLineTerminators, content) !== null) {
+    return lineLengthsWithUnicodeTerminators(content);
+  }
+  // We purposefully keep \r as part of the line-length calculation, in
+  // cases where there is a \r\n separator, so that this can be taken into
+  // account in coverage calculations.
+  const output = [];
+  let lineStart = 0;
+  let lineEnd;
+  while ((lineEnd = StringPrototypeIndexOf(content, '\n', lineStart)) !== -1) {
+    ArrayPrototypePush(output, lineEnd - lineStart);
+    lineStart = lineEnd + 1;
+  }
+  ArrayPrototypePush(output, content.length - lineStart);
+  return output;
+}
+
+function lineLengthsWithUnicodeTerminators(content) {
   const contentLength = content.length;
   const output = [];
   let lineLength = 0;
   for (let i = 0; i < contentLength; i++, lineLength++) {
     const codePoint = StringPrototypeCodePointAt(content, i);
-
-    // We purposefully keep \r as part of the line-length calculation, in
-    // cases where there is a \r\n separator, so that this can be taken into
-    // account in coverage calculations.
-    // codepoints for \n (new line), \u2028 (line separator) and \u2029 (paragraph separator)
+    // \n (new line), \u2028 (line separator) and \u2029 (paragraph separator)
     if (codePoint === 10 || codePoint === 0x2028 || codePoint === 0x2029) {
       ArrayPrototypePush(output, lineLength);
       lineLength = -1; // To not count the matched codePoint such as \n character
@@ -351,16 +366,31 @@ function sourceMapCacheToObject() {
 
   const obj = { __proto__: null };
   for (const { 0: k, 1: v } of moduleSourceMapCache) {
+    const data = v.data ?? null;
     obj[k] = {
       __proto__: null,
       lineLengths: v.lineLengths,
-      data: v.data,
-      url: v.sourceMapURL,
+      data,
+      // Save the source map url if it is not a data url.
+      url: data ? null : v.sourceMapURL,
     };
   }
   return obj;
 }
 
+/**
+ * Resolve and parse the payload of a cache entry the first time it is needed;
+ * `null` marks a source map that could not be loaded.
+ * @param {object} entry
+ * @returns {object|null}
+ */
+function sourceMapData(entry) {
+  if (entry.data === undefined) {
+    entry.data = dataFromUrl(entry.filename, entry.sourceMapURL);
+  }
+  return entry.data;
+}
+
 /**
  * Find a source map for a given actual source URL or path.
  *
@@ -390,7 +420,7 @@ function findSourceMap(sourceURL) {
       sourceURL = pathToFileURL(sourceURL).href;
     }
     const entry = getModuleSourceMapCache().get(sourceURL) ?? generatedSourceMapCache.get(sourceURL);
-    if (entry?.data == null) {
+    if (entry === undefined || sourceMapData(entry) === null) {
       return undefined;
     }
 
diff --git a/lib/internal/stream_base_commons.js b/lib/internal/stream_base_commons.js
index 6d144f8a0fa6..7bf3a2bab638 100644
--- a/lib/internal/stream_base_commons.js
+++ b/lib/internal/stream_base_commons.js
@@ -8,11 +8,10 @@ const {
 const { Buffer } = require('buffer');
 const { FastBuffer } = require('internal/buffer');
 const {
-  WriteWrap,
   kReadBytesOrError,
   kArrayBufferOffset,
   kBytesWritten,
-  kLastWriteWasAsync,
+  kLastWriteErr,
   streamBaseState,
 } = internalBinding('stream_wrap');
 const { UV_EOF } = internalBinding('uv');
@@ -43,41 +42,6 @@ const kBuffer = Symbol('kBuffer');
 const kBufferGen = Symbol('kBufferGen');
 const kBufferCb = Symbol('kBufferCb');
 
-function handleWriteReq(req, data, encoding) {
-  const { handle } = req;
-
-  switch (encoding) {
-    case 'buffer':
-    {
-      const ret = handle.writeBuffer(req, data);
-      if (streamBaseState[kLastWriteWasAsync])
-        req.buffer = data;
-      return ret;
-    }
-    case 'latin1':
-    case 'binary':
-      return handle.writeLatin1String(req, data);
-    case 'utf8':
-    case 'utf-8':
-      return handle.writeUtf8String(req, data);
-    case 'ascii':
-      return handle.writeAsciiString(req, data);
-    case 'ucs2':
-    case 'ucs-2':
-    case 'utf16le':
-    case 'utf-16le':
-      return handle.writeUcs2String(req, data);
-    default:
-    {
-      const buffer = Buffer.from(data, encoding);
-      const ret = handle.writeBuffer(req, buffer);
-      if (streamBaseState[kLastWriteWasAsync])
-        req.buffer = buffer;
-      return ret;
-    }
-  }
-}
-
 function onWriteComplete(status) {
   debug('onWriteComplete', status, this.error);
 
@@ -105,21 +69,8 @@ function onWriteComplete(status) {
     this.callback(null);
 }
 
-function createWriteWrap(handle, callback) {
-  const req = new WriteWrap();
-
-  req.handle = handle;
-  req.oncomplete = onWriteComplete;
-  req.async = false;
-  req.bytes = 0;
-  req.buffer = null;
-  req.callback = callback;
-
-  return req;
-}
-
 function writevGeneric(self, data, cb) {
-  const req = createWriteWrap(self[kHandle], cb);
+  const handle = self[kHandle];
   const allBuffers = data.allBuffers;
   let chunks;
   if (allBuffers) {
@@ -134,33 +85,87 @@ function writevGeneric(self, data, cb) {
       chunks[i * 2 + 1] = entry.encoding;
     }
   }
-  const err = req.handle.writev(req, chunks, allBuffers);
-
-  // Retain chunks
-  if (err === 0) req._chunks = chunks;
+  const ret = handle.writev(null, chunks, allBuffers);
 
-  afterWriteDispatched(req, err, cb);
-  return req;
+  return afterWriteDispatched(handle, ret, chunks, cb);
 }
 
 function writeGeneric(self, data, encoding, cb) {
-  const req = createWriteWrap(self[kHandle], cb);
-  const err = handleWriteReq(req, data, encoding);
+  const handle = self[kHandle];
+  let ret;
+  let buffer = null;
 
-  afterWriteDispatched(req, err, cb);
-  return req;
+  switch (encoding) {
+    case 'buffer':
+      buffer = data;
+      ret = handle.writeBuffer(null, data);
+      break;
+    case 'latin1':
+    case 'binary':
+      ret = handle.writeLatin1String(null, data);
+      break;
+    case 'utf8':
+    case 'utf-8':
+      ret = handle.writeUtf8String(null, data);
+      break;
+    case 'ascii':
+      ret = handle.writeAsciiString(null, data);
+      break;
+    case 'ucs2':
+    case 'ucs-2':
+    case 'utf16le':
+    case 'utf-16le':
+      ret = handle.writeUcs2String(null, data);
+      break;
+    default:
+      buffer = Buffer.from(data, encoding);
+      ret = handle.writeBuffer(null, buffer);
+      break;
+  }
+
+  return afterWriteDispatched(handle, ret, buffer, cb);
 }
 
-function afterWriteDispatched(req, err, cb) {
-  req.bytes = streamBaseState[kBytesWritten];
-  req.async = !!streamBaseState[kLastWriteWasAsync];
+// `ret` is either a numeric error code (when the write - or its failure -
+// completed synchronously and no write request was created) or the WriteWrap
+// object of a dispatched write.
+function afterWriteDispatched(handle, ret, buffer, cb) {
+  const bytes = streamBaseState[kBytesWritten];
+
+  if (typeof ret === 'number') {
+    // The write (or its failure) completed synchronously.
+    if (ret !== 0)
+      cb(new ErrnoException(ret, 'write'));
+    else if (typeof cb === 'function')
+      cb();
+    return { async: false, bytes };
+  }
 
-  if (err !== 0)
-    return cb(new ErrnoException(err, 'write', req.error));
+  const req = ret;
+  const err = streamBaseState[kLastWriteErr];
+  if (err !== 0) {
+    cb(new ErrnoException(err, 'write', req.error));
+    return { async: false, bytes };
+  }
 
-  if (!req.async && typeof req.callback === 'function') {
-    req.callback();
+  req.handle = handle;
+  req.oncomplete = onWriteComplete;
+  req.callback = cb;
+  req.async = true;
+  req.bytes = bytes;
+  // Retain the data (or chunks) being written until the write completes.
+  req.buffer = buffer;
+
+  // If the write completed synchronously inside the write call, before
+  // `oncomplete` could be attached, the completion status has been recorded;
+  // deliver it now.
+  const status = req.writeStatus;
+  if (status !== null) {
+    req.writeStatus = null;
+    req.oncomplete(status);
   }
+
+  return req;
 }
 
 function onStreamRead(arrayBuffer) {
diff --git a/lib/internal/streams/duplexify.js b/lib/internal/streams/duplexify.js
index 0c6701fa2711..76d12fdbc449 100644
--- a/lib/internal/streams/duplexify.js
+++ b/lib/internal/streams/duplexify.js
@@ -103,6 +103,8 @@ module.exports = function duplexify(body, name) {
     const then = value?.then;
     if (typeof then === 'function') {
       let d;
+      // Tracks whether writable final() has started.
+      let finalized = false;
 
       const promise = FunctionPrototypeCall(
         then,
@@ -111,6 +113,12 @@ module.exports = function duplexify(body, name) {
           if (val != null) {
             throw new ERR_INVALID_RETURN_VALUE('nully', 'body', val);
           }
+          // The async function returned without (fully) consuming the input.
+          // Destroy the duplex so that pipeline propagates destruction
+          // upstream. See https://github.com/nodejs/node/issues/55077.
+          if (!finalized) {
+            destroyer(d);
+          }
         },
         (err) => {
           destroyer(d, err);
@@ -123,6 +131,7 @@ module.exports = function duplexify(body, name) {
         readable: false,
         write,
         final(cb) {
+          finalized = true;
           final(async () => {
             try {
               await promise;
diff --git a/lib/internal/streams/fast-utf8-stream.js b/lib/internal/streams/fast-utf8-stream.js
index 00b038e79bfa..6ca12878fd40 100644
--- a/lib/internal/streams/fast-utf8-stream.js
+++ b/lib/internal/streams/fast-utf8-stream.js
@@ -499,7 +499,9 @@ class Utf8Stream extends EventEmitter {
       // start
       if ((!this.#writing && this.#len > this.#minLength) || this.#flushPending) {
         this.#actualWrite();
-      } else if (reopening) {
+      } else if (reopening && !this.#writing) {
+        // Do not emit 'drain' if a 'ready' listener started a write:
+        // #release() will emit the real 'drain' when that write completes.
         process.nextTick(() => this.emit('drain'));
       }
     };
diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 0674d4d57037..05930bbb4432 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -52,7 +52,7 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
-  pull: pullWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
@@ -157,12 +157,7 @@ class BroadcastImpl {
     // When no transforms, return rawConsumer directly (controller elided
     // per PULL-02 optimization -- no transforms means no signal recipient).
     if (transforms.length > 0 || signal) {
-      const pullArgs = [...transforms];
-      if (signal) {
-        ArrayPrototypePush(pullArgs,
-                           { __proto__: null, signal });
-      }
-      return pullWithTransforms(rawConsumer, ...pullArgs);
+      return pullWithConsumerCleanup(rawConsumer, transforms, signal);
     }
     return rawConsumer;
   }
@@ -431,6 +426,8 @@ class BroadcastImpl {
   }
 
   #tryTrimBuffer() {
+    // Retain buffered data for consumers that attach while none are active.
+    if (this.#consumers.size === 0) return;
     if (this.#cachedMinCursorConsumers === 0) {
       this.#recomputeMinCursor();
     }
diff --git a/lib/internal/streams/iter/consumers.js b/lib/internal/streams/iter/consumers.js
index e3bd7856dcd4..7968cce23e2d 100644
--- a/lib/internal/streams/iter/consumers.js
+++ b/lib/internal/streams/iter/consumers.js
@@ -18,6 +18,8 @@ const {
   Promise,
   PromisePrototypeThen,
   SafePromiseAllReturnVoid,
+  SafeSet,
+  Symbol,
   SymbolAsyncIterator,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
@@ -390,6 +392,8 @@ function ondrain(drainable) {
 // Merge Utility
 // =============================================================================
 
+const kNoMergeError = Symbol('kNoMergeError');
+
 /**
  * Merge multiple async iterables by yielding values in temporal order.
  * @param {...(AsyncIterable<Uint8Array[]>|object)} args
@@ -437,9 +441,11 @@ function merge(...args) {
       // async tick per batch. Each source has at most one pending .next()
       // at a time. Every batch from every source is preserved.
       const ready = [];
+      const pendingPulls = new SafeSet();
       let activeCount = normalized.length;
       let waitResolve = null;
       let onAbort;
+      let stopped = false;
 
       if (signal) {
         onAbort = () => {
@@ -457,11 +463,14 @@ function merge(...args) {
       // Called when a source's .next() settles. Pushes the result into
       // the ready queue and wakes the consumer if it's waiting.
       const onSettled = (iterator, result) => {
+        pendingPulls.delete(iterator);
+        if (stopped) return;
         if (result.done) {
           activeCount--;
         } else {
           ArrayPrototypePush(ready, {
             __proto__: null,
+            kind: 'value',
             iterator,
             value: result.value,
           });
@@ -472,25 +481,34 @@ function merge(...args) {
         }
       };
 
+      const onRejected = (iterator, reason) => {
+        pendingPulls.delete(iterator);
+        if (stopped) return;
+        ArrayPrototypePush(ready, {
+          __proto__: null,
+          kind: 'error',
+          reason,
+        });
+        if (waitResolve) {
+          waitResolve();
+          waitResolve = null;
+        }
+      };
+
       // Start one .next() per source
       const iterators = [];
       for (let i = 0; i < normalized.length; i++) {
         const iterator = normalized[i][SymbolAsyncIterator]();
         ArrayPrototypePush(iterators, iterator);
+        pendingPulls.add(iterator);
         PromisePrototypeThen(
           iterator.next(),
           (r) => onSettled(iterator, r),
-          (err) => {
-            ArrayPrototypePush(ready, { __proto__: null, error: err });
-            if (waitResolve) {
-              waitResolve();
-              waitResolve = null;
-            }
-          },
+          (reason) => onRejected(iterator, reason),
         );
       }
 
-      let primaryError;
+      let primaryError = kNoMergeError;
       try {
         while (activeCount > 0 || ready.length > 0) {
           signal?.throwIfAborted();
@@ -498,20 +516,15 @@ function merge(...args) {
           // Drain ready queue synchronously
           while (ready.length > 0) {
             const item = ArrayPrototypeShift(ready);
-            if (item?.error) {
-              throw item.error;
+            if (item.kind === 'error') {
+              throw item.reason;
             }
             yield item.value;
+            pendingPulls.add(item.iterator);
             PromisePrototypeThen(
               item.iterator.next(),
               (r) => onSettled(item.iterator, r),
-              (err) => {
-                ArrayPrototypePush(ready, { __proto__: null, error: err });
-                if (waitResolve) {
-                  waitResolve();
-                  waitResolve = null;
-                }
-              },
+              (reason) => onRejected(item.iterator, reason),
             );
           }
 
@@ -529,6 +542,7 @@ function merge(...args) {
       } catch (err) {
         primaryError = err;
       } finally {
+        stopped = true;
         if (onAbort !== undefined) {
           signal.removeEventListener('abort', onAbort);
         }
@@ -538,32 +552,32 @@ function merge(...args) {
         await cleanupIterators(
           iterators,
           primaryError,
-          signal?.aborted && primaryError === signal.reason,
+          pendingPulls,
         );
       }
     },
   };
 }
 
-async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
-  let cleanupError;
+async function cleanupIterators(iterators, primaryError, pendingPulls) {
+  let cleanupError = kNoMergeError;
   await SafePromiseAllReturnVoid(iterators, async (iterator) => {
     if (iterator.return) {
       try {
         const result = iterator.return();
-        if (skipAwaitCleanup) {
+        if (pendingPulls.has(iterator)) {
           markPromiseAsHandled(result);
         } else {
           await result;
         }
       } catch (err) {
         // Keep the first cleanup error encountered.
-        cleanupError ??= err;
+        if (cleanupError === kNoMergeError) cleanupError = err;
       }
     }
   });
-  if (cleanupError !== undefined) {
-    if (primaryError !== undefined) {
+  if (cleanupError !== kNoMergeError) {
+    if (primaryError !== kNoMergeError) {
       // Both a primary error and a cleanup error occurred.
       // Wrap in SuppressedError so neither is lost:
       // .error = primaryError, .suppressed = cleanupError.
@@ -573,7 +587,7 @@ async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
     // No primary error - the cleanup error is the only error.
     throw cleanupError;
   }
-  if (primaryError !== undefined) {
+  if (primaryError !== kNoMergeError) {
     throw primaryError;
   }
 }
diff --git a/lib/internal/streams/iter/duplex.js b/lib/internal/streams/iter/duplex.js
index b37b91279232..a60c510c4199 100644
--- a/lib/internal/streams/iter/duplex.js
+++ b/lib/internal/streams/iter/duplex.js
@@ -6,11 +6,13 @@
 // channel's writer appears in the other channel's readable.
 
 const {
+  SafePromiseAllReturnVoid,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
 } = primordials;
 
 const {
+  isConsumerReturnError,
   push,
 } = require('internal/streams/iter/push');
 const {
@@ -50,68 +52,8 @@ function duplex(options = { __proto__: null }) {
     backpressure: b?.backpressure ?? backpressure,
   });
 
-  let aClosed = false;
-  let bClosed = false;
-  // Track active iterators so close() can call .return() on them
-  let aReadableIterator = null;
-  let bReadableIterator = null;
-
-  const channelA = {
-    __proto__: null,
-    get writer() { return aWriter; },
-    // Wrap readable to track the iterator for cleanup on close()
-    get readable() {
-      return {
-        __proto__: null,
-        [SymbolAsyncIterator]() {
-          const iter = aReadable[SymbolAsyncIterator]();
-          aReadableIterator = iter;
-          return iter;
-        },
-      };
-    },
-    async close() {
-      if (aClosed) return;
-      aClosed = true;
-      // End the writer (signals end-of-stream to B's readable)
-      aWriter.endSync();
-      // Stop iteration of this channel's readable
-      if (aReadableIterator?.return) {
-        await aReadableIterator.return();
-        aReadableIterator = null;
-      }
-    },
-    [SymbolAsyncDispose]() {
-      return this.close();
-    },
-  };
-
-  const channelB = {
-    __proto__: null,
-    get writer() { return bWriter; },
-    get readable() {
-      return {
-        __proto__: null,
-        [SymbolAsyncIterator]() {
-          const iter = bReadable[SymbolAsyncIterator]();
-          bReadableIterator = iter;
-          return iter;
-        },
-      };
-    },
-    async close() {
-      if (bClosed) return;
-      bClosed = true;
-      bWriter.endSync();
-      if (bReadableIterator?.return) {
-        await bReadableIterator.return();
-        bReadableIterator = null;
-      }
-    },
-    [SymbolAsyncDispose]() {
-      return this.close();
-    },
-  };
+  const channelA = createDuplexChannel(aWriter, aReadable);
+  const channelB = createDuplexChannel(bWriter, bReadable);
 
   // Signal handler: fail both writers with the abort reason so consumers
   // see the error. This is an error-path shutdown, not a clean close.
@@ -132,6 +74,42 @@ function duplex(options = { __proto__: null }) {
   return [channelA, channelB];
 }
 
+function createDuplexChannel(writer, readable) {
+  // A push readable has one shared consumer state. Keeping an iterator from
+  // creation lets close() terminate that state even if no caller has iterated.
+  const closeIterator = readable[SymbolAsyncIterator]();
+  let closePromise;
+
+  return {
+    __proto__: null,
+    get writer() { return writer; },
+    get readable() { return readable; },
+    close() {
+      closePromise ??= closeDuplexChannel(writer, closeIterator);
+      return closePromise;
+    },
+    [SymbolAsyncDispose]() {
+      return this.close();
+    },
+  };
+}
+
+async function closeDuplexChannel(writer, closeIterator) {
+  const result = writer.endSync();
+  const endPromise = result < 0 ? writer.end() : undefined;
+  const returnPromise = closeIterator.return();
+
+  if (endPromise !== undefined) {
+    try {
+      await SafePromiseAllReturnVoid([endPromise, returnPromise]);
+    } catch (error) {
+      if (!isConsumerReturnError(error)) throw error;
+    }
+  } else {
+    await returnPromise;
+  }
+}
+
 module.exports = {
   duplex,
 };
diff --git a/lib/internal/streams/iter/from.js b/lib/internal/streams/iter/from.js
index 59ac6a15775b..7fe03511861f 100644
--- a/lib/internal/streams/iter/from.js
+++ b/lib/internal/streams/iter/from.js
@@ -15,6 +15,7 @@ const {
   DataViewPrototypeGetByteLength,
   DataViewPrototypeGetByteOffset,
   FunctionPrototypeCall,
+  PromisePrototypeThen,
   SymbolAsyncIterator,
   SymbolIterator,
   TypedArrayPrototypeGetBuffer,
@@ -23,6 +24,8 @@ const {
   Uint8Array,
 } = primordials;
 
+const { markPromiseAsHandled } = internalBinding('util');
+
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
@@ -360,9 +363,13 @@ async function* normalizeAsyncSource(source) {
         continue;
       }
       // Slow path: normalize the value
-      const batch = [];
+      let batch = [];
       for await (const chunk of normalizeAsyncValue(value)) {
         ArrayPrototypePush(batch, chunk);
+        if (batch.length === FROM_BATCH_SIZE) {
+          yield batch;
+          batch = [];
+        }
       }
       if (batch.length > 0) {
         yield batch;
@@ -594,7 +601,11 @@ function from(input) {
   // Check toAsyncStreamable protocol (takes precedence over toStreamable and
   // iteration protocols)
   if (typeof input[toAsyncStreamable] === 'function') {
-    const result = input[toAsyncStreamable]();
+    let result = input[toAsyncStreamable]();
+    if (isPromise(result)) {
+      result = PromisePrototypeThen(result, undefined, undefined);
+      markPromiseAsHandled(result);
+    }
     // Synchronous validated source (e.g. Readable batched iterator)
     if (result?.[kValidatedSource]) {
       return result;
diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index b6c2d9849c42..6a1323f6d0d5 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -8,10 +8,9 @@
 
 const {
   ArrayBufferIsView,
-  ArrayFromAsync,
-  ArrayIsArray,
   ArrayPrototypePush,
   ArrayPrototypeSlice,
+  FunctionPrototypeCall,
   PromisePrototypeThen,
   PromiseResolve,
   SymbolAsyncIterator,
@@ -34,7 +33,10 @@ const {
   isPromise,
   isUint8Array,
 } = require('internal/util/types');
-const { AbortController } = require('internal/abort_controller');
+const {
+  AbortController,
+  AbortSignal,
+} = require('internal/abort_controller');
 
 const {
   arrayBufferViewToUint8Array,
@@ -42,9 +44,7 @@ const {
   fromSync,
   isSyncIterable,
   isAsyncIterable,
-  isPrimitiveChunk,
   isUint8ArrayBatch,
-  normalizeAsyncValue,
 } = require('internal/streams/iter/from');
 
 const {
@@ -58,10 +58,7 @@ const {
 } = require('internal/streams/iter/utils');
 
 const {
-  kValidatedSource,
   kValidatedTransform,
-  toAsyncStreamable,
-  toStreamable,
 } = require('internal/streams/iter/types');
 
 // =============================================================================
@@ -124,22 +121,6 @@ function parsePipeToArgs(args, requiredMethod) {
   };
 }
 
-function canUseSyncIterablePipeToFastPath(source, transforms, signal) {
-  if (signal !== undefined ||
-      transforms.length !== 0 ||
-      isPrimitiveChunk(source) ||
-      ArrayIsArray(source) ||
-      source?.[kValidatedSource] ||
-      !isSyncIterable(source) ||
-      isAsyncIterable(source)) {
-    return false;
-  }
-
-  // Preserve from()'s top-level protocol precedence for custom iterables.
-  return typeof source[toAsyncStreamable] !== 'function' &&
-    typeof source[toStreamable] !== 'function';
-}
-
 // =============================================================================
 // Transform Output Flattening
 // =============================================================================
@@ -521,8 +502,9 @@ function* withFlushSync(source) {
   yield null;
 }
 
-function* applyStatefulSyncTransform(source, transform) {
-  const output = transform(withFlushSync(source));
+function* applyStatefulSyncTransform(source, transform, receiver) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, withFlushSync(source));
   for (const item of output) {
     if (item === null) continue;
     const batch = [];
@@ -553,7 +535,8 @@ function* createSyncPipeline(source, transforms) {
         current = applyFusedStatelessSyncTransforms(current, statelessRun);
         statelessRun = [];
       }
-      current = applyStatefulSyncTransform(current, transform.transform);
+      current = applyStatefulSyncTransform(
+        current, transform.transform, transform);
     } else {
       ArrayPrototypePush(statelessRun, transform);
     }
@@ -664,8 +647,10 @@ async function* withFlushAsync(source) {
   yield null;
 }
 
-async function* applyStatefulAsyncTransform(source, transform, options) {
-  const output = transform(withFlushAsync(source), options);
+async function* applyStatefulAsyncTransform(
+  source, transform, receiver, options) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, withFlushAsync(source), options);
   for await (const item of output) {
     if (item === null) continue;
     // Fast path: item is already a Uint8Array[] batch (e.g. compression transforms)
@@ -697,8 +682,10 @@ async function* applyStatefulAsyncTransform(source, transform, options) {
  * skips isUint8ArrayBatch validation (transform guarantees valid output).
  * @yields {Uint8Array[]}
  */
-async function* applyValidatedStatefulAsyncTransform(source, transform, options) {
-  const output = transform(source, options);
+async function* applyValidatedStatefulAsyncTransform(
+  source, transform, receiver, options) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, source, options);
   for await (const batch of output) {
     if (batch.length > 0) {
       yield batch;
@@ -766,10 +753,10 @@ async function* createAsyncPipeline(source, transforms, signal) {
       const opts = { __proto__: null, signal: transformSignal };
       if (transform[kValidatedTransform]) {
         current = applyValidatedStatefulAsyncTransform(
-          current, transform.transform, opts);
+          current, transform.transform, transform, opts);
       } else {
         current = applyStatefulAsyncTransform(
-          current, transform.transform, opts);
+          current, transform.transform, transform, opts);
       }
     } else {
       ArrayPrototypePush(statelessRun, transform);
@@ -821,6 +808,7 @@ async function* createAsyncPipeline(source, transforms, signal) {
  * @returns {Iterable<Uint8Array[]>}
  */
 function pullSync(source, ...transforms) {
+  const normalized = fromSync(source);
   for (let i = 0; i < transforms.length; i++) {
     if (!isTransform(transforms[i])) {
       throw new ERR_INVALID_ARG_TYPE(
@@ -831,7 +819,7 @@ function pullSync(source, ...transforms) {
   return {
     __proto__: null,
     *[SymbolIterator]() {
-      yield* createSyncPipeline(fromSync(source), transforms);
+      yield* createSyncPipeline(normalized, transforms);
     },
   };
 }
@@ -848,22 +836,121 @@ function pull(source, ...args) {
   const signal = options?.signal;
   if (signal !== undefined) {
     validateAbortSignal(signal, 'options.signal');
-    // Eagerly check abort at call time per spec
-    if (signal.aborted) {
+  }
+  const normalized = from(source);
+  signal?.throwIfAborted();
+
+  return {
+    __proto__: null,
+    [SymbolAsyncIterator]() {
+      const controller = new AbortController();
+      const iteratorSignal = signal === undefined ?
+        controller.signal : AbortSignal.any([signal, controller.signal]);
+
+      async function* pipeline() {
+        yield* createAsyncPipeline(normalized, transforms, iteratorSignal);
+      }
+      const iterator = pipeline();
+
       return {
         __proto__: null,
-        // eslint-disable-next-line require-yield
-        async *[SymbolAsyncIterator]() {
-          throw signal.reason;
+        next(value) {
+          return iterator.next(value);
+        },
+        return(value) {
+          controller.abort(lazyDOMException('Aborted', 'AbortError'));
+          return iterator.return(value);
+        },
+        throw(error) {
+          controller.abort(error);
+          return iterator.throw(error);
+        },
+        [SymbolAsyncIterator]() {
+          return this;
         },
       };
+    },
+  };
+}
+
+// Keep ownership of a bonded consumer outside the transform pipeline so it can
+// be detached even when the pipeline never starts or terminates early.
+function pullWithConsumerCleanup(source, transforms, signal) {
+  const sourceIterator = source[SymbolAsyncIterator]();
+  const pipelineSource = {
+    __proto__: null,
+    [SymbolAsyncIterator]() {
+      return sourceIterator;
+    },
+  };
+  let sourceClosed = false;
+  let abortHandler;
+
+  function closeSource(method, value) {
+    if (sourceClosed) return;
+    sourceClosed = true;
+    if (abortHandler !== undefined) {
+      signal.removeEventListener('abort', abortHandler);
     }
+    const close = sourceIterator[method] ?? sourceIterator.return;
+    if (typeof close === 'function') {
+      const result = FunctionPrototypeCall(close, sourceIterator, value);
+      PromisePrototypeThen(PromiseResolve(result), undefined, () => {});
+    }
+  }
+
+  if (signal?.aborted) {
+    closeSource('throw', signal.reason);
+    return {
+      __proto__: null,
+      // eslint-disable-next-line require-yield
+      async *[SymbolAsyncIterator]() {
+        throw signal.reason;
+      },
+    };
+  }
+
+  const pipeline = signal === undefined ?
+    pull(pipelineSource, ...transforms) :
+    pull(pipelineSource, ...transforms, { __proto__: null, signal });
+
+  if (signal !== undefined) {
+    abortHandler = () => closeSource('throw', signal.reason);
+    signal.addEventListener('abort', abortHandler,
+                            { __proto__: null, once: true });
+    if (signal.aborted) abortHandler();
   }
 
   return {
     __proto__: null,
-    async *[SymbolAsyncIterator]() {
-      yield* createAsyncPipeline(from(source), transforms, signal);
+    [SymbolAsyncIterator]() {
+      const iterator = pipeline[SymbolAsyncIterator]();
+      return {
+        __proto__: null,
+        next(value) {
+          return PromisePrototypeThen(
+            iterator.next(value),
+            (result) => {
+              if (result.done) closeSource('return');
+              return result;
+            },
+            (error) => {
+              closeSource('throw', error);
+              throw error;
+            });
+        },
+        return(value) {
+          closeSource('return', value);
+          return iterator.return(value);
+        },
+        throw(error) {
+          closeSource('throw', error);
+          return iterator.throw(error);
+        },
+        [SymbolAsyncIterator]() {
+          return this;
+        },
+      };
     },
   };
 }
@@ -942,13 +1029,21 @@ async function pipeTo(source, ...args) {
 
   const signal = options?.signal;
 
-  // Check for abort
-  signal?.throwIfAborted();
+  function failWriter(error) {
+    if (!options?.preventFail) {
+      writer.fail?.(wrapError(error));
+    }
+  }
+
+  try {
+    signal?.throwIfAborted();
+  } catch (error) {
+    failWriter(error);
+    throw error;
+  }
 
   const hasWriteSync = typeof writer.writeSync === 'function';
-  const useSyncIterableFastPath =
-    hasWriteSync && canUseSyncIterablePipeToFastPath(source, transforms, signal);
-  const normalized = useSyncIterableFastPath ? undefined : from(source);
+  const normalized = from(source);
 
   let totalBytes = 0;
   const hasWritev = typeof writer.writev === 'function';
@@ -1009,31 +1104,7 @@ async function pipeTo(source, ...args) {
   }
 
   try {
-    if (useSyncIterableFastPath) {
-      // Avoid from()'s async sync-iterable batching path. This keeps writes
-      // incremental for synchronous sources while preserving async
-      // normalization for non-primitive yielded values.
-      for (const value of source) {
-        if (isUint8ArrayBatch(value)) {
-          if (value.length > 0) {
-            const p = writeBatch(value);
-            if (p) await p;
-          }
-          continue;
-        }
-        if (isUint8Array(value)) {
-          const p = writeBatch([value]);
-          if (p) await p;
-          continue;
-        }
-
-        const batch = await ArrayFromAsync(normalizeAsyncValue(value));
-        if (batch.length > 0) {
-          const p = writeBatch(batch);
-          if (p) await p;
-        }
-      }
-    } else if (transforms.length === 0) {
+    if (transforms.length === 0) {
       // Fast path: no transforms - iterate normalized source directly
       if (signal) {
         for await (const batch of yieldAbortable(normalized, signal)) {
@@ -1070,9 +1141,7 @@ async function pipeTo(source, ...args) {
       }
     }
   } catch (error) {
-    if (!options?.preventFail) {
-      writer.fail?.(wrapError(error));
-    }
+    failWriter(error);
     throw error;
   }
 
@@ -1084,4 +1153,5 @@ module.exports = {
   pipeToSync,
   pull,
   pullSync,
+  pullWithConsumerCleanup,
 };
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index b9914efa115c..c1a2ba7d44f8 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -11,6 +11,7 @@ const {
   PromiseReject,
   PromiseResolve,
   PromiseWithResolvers,
+  SafeWeakSet,
   Symbol,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
@@ -46,7 +47,7 @@ const {
 } = require('internal/streams/iter/utils');
 
 const {
-  pull: pullWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
@@ -54,6 +55,11 @@ const {
 } = require('internal/streams/iter/ringbuffer');
 
 const kNoFailReason = Symbol('kNoFailReason');
+const consumerReturnErrors = new SafeWeakSet();
+
+function isConsumerReturnError(error) {
+  return consumerReturnErrors.has(error);
+}
 
 function raceEndWithSignal(promise, signal) {
   if (!signal) return promise;
@@ -325,7 +331,6 @@ class PushQueue {
       return this.#bytesWritten; // Idempotent
     }
 
-    this.#cleanup();
     this.#rejectPendingWrites(
       new ERR_INVALID_STATE.TypeError('Writer closed'));
     this.#resolvePendingDrains(false);
@@ -333,6 +338,7 @@ class PushQueue {
     // If buffer is empty, close immediately
     if (this.#slots.length === 0) {
       this.#writerState = 'closed';
+      this.#cleanup();
       this.#resolvePendingReads();
       return this.#bytesWritten;
     }
@@ -350,6 +356,7 @@ class PushQueue {
   endDrained() {
     if (this.#writerState !== 'closing') return;
     this.#writerState = 'closed';
+    this.#cleanup();
     if (this.#pendingEnd) {
       this.#pendingEnd.resolve(this.#bytesWritten);
       this.#pendingEnd = null;
@@ -402,12 +409,12 @@ class PushQueue {
     return this.#writerState;
   }
 
-  get pendingEndPromise() {
-    return this.#pendingEnd?.promise ?? null;
-  }
-
-  setPendingEnd(pending) {
-    this.#pendingEnd = pending;
+  getPendingEndPromise() {
+    if (this.#pendingEnd === null) {
+      const { promise, resolve, reject } = PromiseWithResolvers();
+      this.#pendingEnd = { __proto__: null, promise, resolve, reject };
+    }
+    return this.#pendingEnd.promise;
   }
 
   /**
@@ -425,6 +432,13 @@ class PushQueue {
   // ===========================================================================
 
   async read() {
+    if (this.#consumerState === 'returned') {
+      return { __proto__: null, done: true, value: undefined };
+    }
+    if (this.#consumerState === 'thrown') {
+      throw this.#error;
+    }
+
     // If there's data in the buffer, return it immediately
     if (this.#slots.length > 0) {
       const result = this.#drain();
@@ -458,16 +472,10 @@ class PushQueue {
   consumerReturn() {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'returned';
-    this.#cleanup();
+    const error = new ERR_INVALID_STATE.TypeError('Stream closed by consumer');
+    consumerReturnErrors.add(error);
+    this.#terminateWriterFromConsumer(error);
     this.#resolvePendingReads();
-    this.#rejectPendingWrites(
-      new ERR_INVALID_STATE.TypeError('Stream closed by consumer'));
-    // If closing, reject the pending end promise
-    if (this.#writerState === 'closing' && this.#pendingEnd) {
-      this.#pendingEnd.reject(
-        new ERR_INVALID_STATE.TypeError('Stream closed by consumer'));
-      this.#pendingEnd = null;
-    }
     // Resolve pending drains with false - no more data will be consumed
     this.#resolvePendingDrains(false);
   }
@@ -476,13 +484,8 @@ class PushQueue {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'thrown';
     this.#error = error;
-    this.#cleanup();
+    this.#terminateWriterFromConsumer(error);
     this.#rejectPendingReads(error);
-    this.#rejectPendingWrites(error);
-    if (this.#writerState === 'closing' && this.#pendingEnd) {
-      this.#pendingEnd.reject(error);
-      this.#pendingEnd = null;
-    }
     // Reject pending drains - the consumer errored
     this.#rejectPendingDrains(error);
   }
@@ -516,9 +519,30 @@ class PushQueue {
     return size;
   }
 
+  #terminateWriterFromConsumer(error) {
+    this.#slots.clear();
+    this.#bufferedBytes = 0;
+    if (this.#writerState === 'open' || this.#writerState === 'closing') {
+      this.#writerState = 'errored';
+      this.#error = error;
+    }
+    this.#cleanup();
+    this.#rejectPendingWrites(error);
+    if (this.#pendingEnd) {
+      this.#pendingEnd.reject(error);
+      this.#pendingEnd = null;
+    }
+  }
+
   #resolvePendingReads() {
     while (this.#pendingReads.length > 0) {
-      if (this.#slots.length > 0) {
+      if (this.#consumerState === 'returned') {
+        const pending = this.#pendingReads.shift();
+        pending.resolve({ __proto__: null, done: true, value: undefined });
+      } else if (this.#consumerState === 'thrown') {
+        const pending = this.#pendingReads.shift();
+        pending.reject(this.#error);
+      } else if (this.#slots.length > 0) {
         const pending = this.#pendingReads.shift();
         const result = this.#drain();
         this.#resolvePendingWrites();
@@ -533,9 +557,6 @@ class PushQueue {
       } else if (this.#writerState === 'errored') {
         const pending = this.#pendingReads.shift();
         pending.reject(this.#error);
-      } else if (this.#consumerState === 'returned') {
-        const pending = this.#pendingReads.shift();
-        pending.resolve({ __proto__: null, done: true, value: undefined });
       } else {
         break;
       }
@@ -660,15 +681,7 @@ class PushWriter {
       return PromiseReject(this.#queue.error);
     }
     if (result === -3) {
-      // Closing: buffer has data, create deferred promise that resolves
-      // when consumer drains past the end sentinel
-      const pendingEndPromise = this.#queue.pendingEndPromise;
-      if (pendingEndPromise !== null) {
-        return raceEndWithSignal(pendingEndPromise, signal);
-      }
-      const { promise, resolve, reject } = PromiseWithResolvers();
-      this.#queue.setPendingEnd({ __proto__: null, promise, resolve, reject });
-      return raceEndWithSignal(promise, signal);
+      return raceEndWithSignal(this.#queue.getPendingEndPromise(), signal);
     }
     // >= 0: byte count (immediate close or idempotent)
     return PromiseResolve(result);
@@ -688,8 +701,7 @@ class PushWriter {
   [SymbolAsyncDispose]() {
     const state = this.#queue.writerState;
     if (state === 'closing') {
-      // Wait for graceful drain
-      return this.#queue.pendingEndPromise ?? PromiseResolve();
+      return this.#queue.getPendingEndPromise();
     }
     if (state === 'open') {
       this.fail();
@@ -756,12 +768,8 @@ function push(...args) {
   // Apply transforms lazily if provided
   let readable;
   if (transforms.length > 0) {
-    if (options.signal) {
-      readable = pullWithTransforms(
-        rawReadable, ...transforms, { __proto__: null, signal: options.signal });
-    } else {
-      readable = pullWithTransforms(rawReadable, ...transforms);
-    }
+    readable = pullWithConsumerCleanup(
+      rawReadable, transforms, options.signal);
   } else {
     readable = rawReadable;
   }
@@ -770,5 +778,6 @@ function push(...args) {
 }
 
 module.exports = {
+  isConsumerReturnError,
   push,
 };
diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 711abeb21b9a..d0031d1bef01 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -10,7 +10,9 @@ const {
   PromisePrototypeThen,
   PromiseResolve,
   PromiseWithResolvers,
+  SafePromiseRace,
   SafeSet,
+  Symbol,
   SymbolAsyncIterator,
   SymbolDispose,
   SymbolIterator,
@@ -30,8 +32,8 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
-  pull: pullWithTransforms,
   pullSync: pullSyncWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
@@ -65,6 +67,9 @@ const {
 // Async Share Implementation
 // =============================================================================
 
+const kNoShareError = Symbol('kNoShareError');
+const kShareCancelled = Symbol('kShareCancelled');
+
 class ShareImpl {
   #source;
   #options;
@@ -77,6 +82,9 @@ class ShareImpl {
   #cancelled = false;
   #pulling = false;
   #pullWaiters = [];
+  #cancelPromise;
+  #resolveCancel;
+  #cancelError = kNoShareError;
   #cachedMinCursor = 0;
   #cachedMinCursorConsumers = 0;
   /** Cumulative byte size of buffered entries */
@@ -85,6 +93,9 @@ class ShareImpl {
   constructor(source, options) {
     this.#source = source;
     this.#options = options;
+    const { promise, resolve } = PromiseWithResolvers();
+    this.#cancelPromise = promise;
+    this.#resolveCancel = resolve;
   }
 
   get consumerCount() {
@@ -111,13 +122,7 @@ class ShareImpl {
     const rawConsumer = this.#createRawConsumer();
 
     if (transforms.length > 0 || signal) {
-      if (signal) {
-        return pullWithTransforms(
-          rawConsumer,
-          ...transforms,
-          { __proto__: null, signal });
-      }
-      return pullWithTransforms(rawConsumer, ...transforms);
+      return pullWithConsumerCleanup(rawConsumer, transforms, signal);
     }
     return rawConsumer;
   }
@@ -129,6 +134,7 @@ class ShareImpl {
       resolve: null,
       reject: null,
       detached: false,
+      error: kNoShareError,
       pendingNext: PromiseResolve(),
     };
 
@@ -147,25 +153,21 @@ class ShareImpl {
       __proto__: null,
       [SymbolAsyncIterator]() {
         const getNext = async () => {
-          if (self.#sourceError !== undefined) {
-            state.detached = true;
-            self.#consumers.delete(state);
-            throw self.#sourceError;
-          }
-
           // Loop until we get data, source is exhausted, or
           // consumer is detached. Multiple consumers may be woken
           // after a single pull - those that find no data at their
           // cursor must re-pull rather than terminating prematurely.
           for (;;) {
             if (state.detached) {
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
             if (self.#cancelled) {
               state.detached = true;
+              state.error = self.#cancelError;
               self.#deleteConsumer(state);
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -185,16 +187,29 @@ class ShareImpl {
             if (self.#sourceExhausted) {
               state.detached = true;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (self.#sourceError !== undefined) {
+                state.error = self.#sourceError;
+                throw state.error;
+              }
               return { __proto__: null, done: true, value: undefined };
             }
 
             // Need to pull from source - check buffer limit
-            const shouldBuffer = await self.#waitForBufferSpace();
+            let shouldBuffer;
+            try {
+              shouldBuffer = await self.#waitForBufferSpace();
+            } catch (error) {
+              state.detached = true;
+              if (self.#deleteConsumer(state)) {
+                self.#tryTrimBuffer();
+              }
+              throw error;
+            }
             if (shouldBuffer === null) {
               state.detached = true;
+              state.error = self.#cancelError;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -246,14 +261,23 @@ class ShareImpl {
     this.#cancelled = true;
 
     if (reason !== undefined) {
-      this.#sourceError = reason;
+      this.#cancelError = reason;
     }
 
+    this.#resolveCancel(kShareCancelled);
+    this.#resolveCancel = null;
+
     if (this.#sourceIterator?.return) {
-      PromisePrototypeThen(this.#sourceIterator.return(), undefined, () => {});
+      try {
+        PromisePrototypeThen(
+          PromiseResolve(this.#sourceIterator.return()), undefined, () => {});
+      } catch {
+        // Cancellation has precedence over source cleanup errors.
+      }
     }
 
     for (const consumer of this.#consumers) {
+      consumer.error = this.#cancelError;
       if (consumer.resolve) {
         if (reason !== undefined) {
           consumer.reject?.(reason);
@@ -266,6 +290,8 @@ class ShareImpl {
       consumer.detached = true;
     }
     this.#consumers.clear();
+    this.#buffer.clear();
+    this.#bufferedBytes = 0;
 
     for (let i = 0; i < this.#pullWaiters.length; i++) {
       this.#pullWaiters[i]();
@@ -369,7 +395,12 @@ class ShareImpl {
           }
         }
 
-        const result = await this.#sourceIterator.next();
+        const result = await SafePromiseRace([
+          this.#sourceIterator.next(),
+          this.#cancelPromise,
+        ]);
+
+        if (this.#cancelled || result === kShareCancelled) return;
 
         if (result.done) {
           this.#sourceExhausted = true;
diff --git a/lib/internal/streams/readable.js b/lib/internal/streams/readable.js
index 7a089c591630..c213af3f97f6 100644
--- a/lib/internal/streams/readable.js
+++ b/lib/internal/streams/readable.js
@@ -131,6 +131,7 @@ const kHasPaused = 1 << 25;
 const kPaused = 1 << 26;
 const kDataListening = 1 << 27;
 const kEndScheduled = 1 << 28;
+const kEofReadablePending = 1 << 29;
 
 // TODO(benjamingr) it is likely slower to do it this way than with free functions
 function makeBitMapDescriptor(bit) {
@@ -670,7 +671,7 @@ Readable.prototype.read = function(n) {
     state.highWaterMark = computeNewHighWaterMark(n);
 
   if (n !== 0)
-    state[kState] &= ~kEmittedReadable;
+    state[kState] &= ~(kEmittedReadable | kEofReadablePending);
 
   // If we're doing read(0) to trigger a readable event, but we
   // already have a bunch of data in the buffer, then just trigger
@@ -813,7 +814,16 @@ function onEofChunk(stream, state) {
     // If we are sync, wait until next tick to emit the data.
     // Otherwise we risk emitting data in the flow()
     // the readable code triggers during a read() call.
-    emitReadable(stream);
+    if ((state[kState] & (kFlowing | kNeedReadable)) !== 0 ||
+        stream.listenerCount('readable') > 0) {
+      emitReadable(stream);
+    } else {
+      // Nobody is observing the stream: do not schedule the 'readable'
+      // emission at all. A 'readable' listener attached later redeems it
+      // (see Readable.prototype.on), and read() and resume() reach the
+      // end of the stream on their own.
+      state[kState] |= kEofReadablePending;
+    }
   } else {
     // Emit 'readable' now to make sure it gets picked up.
     state[kState] &= ~kNeedReadable;
@@ -1162,8 +1172,17 @@ Readable.prototype.on = function(ev, fn) {
       debug('on readable');
       if (state.length) {
         emitReadable(this);
-      } else if ((state[kState] & kReading) === 0) {
-        process.nextTick(nReadingNextTick, this);
+      } else {
+        if ((state[kState] & kEofReadablePending) !== 0) {
+          // The end-of-stream 'readable' emission was skipped because
+          // nobody was listening when the stream ended (see onEofChunk):
+          // emit it now.
+          state[kState] &= ~kEofReadablePending;
+          emitReadable(this);
+        }
+        if ((state[kState] & kReading) === 0) {
+          process.nextTick(nReadingNextTick, this);
+        }
       }
     }
   }
diff --git a/lib/internal/streams/writable.js b/lib/internal/streams/writable.js
index 47e003ea3a8a..09d713f8a1fe 100644
--- a/lib/internal/streams/writable.js
+++ b/lib/internal/streams/writable.js
@@ -787,7 +787,7 @@ function clearBuffer(stream, state) {
 
     if (i === buffered.length) {
       resetBuffer(state);
-    } else if (i > 256) {
+    } else if (i > 256 && i * 2 >= buffered.length) {
       buffered.splice(0, i);
       state.bufferedIndex = 0;
     } else {
diff --git a/lib/internal/test_runner/reporter/junit.js b/lib/internal/test_runner/reporter/junit.js
index 5052f5444c0d..e5a3fa961eac 100644
--- a/lib/internal/test_runner/reporter/junit.js
+++ b/lib/internal/test_runner/reporter/junit.js
@@ -22,7 +22,7 @@ const inspectOptions = { __proto__: null, colors: false, breakLength: Infinity }
 const HOSTNAME = hostname();
 
 function escapeAttribute(s = '') {
-  return escapeContent(RegExpPrototypeSymbolReplace(/"/g, RegExpPrototypeSymbolReplace(/\n/g, s, '&#10;'), '&quot;'));
+  return RegExpPrototypeSymbolReplace(/"/g, RegExpPrototypeSymbolReplace(/\n/g, escapeContent(s), '&#10;'), '&quot;');
 }
 
 function escapeContent(s = '') {
diff --git a/lib/internal/test_runner/reporter/v8-serializer.js b/lib/internal/test_runner/reporter/v8-serializer.js
index c75bfcdac478..0f0cf20902b5 100644
--- a/lib/internal/test_runner/reporter/v8-serializer.js
+++ b/lib/internal/test_runner/reporter/v8-serializer.js
@@ -9,11 +9,12 @@ const { serializeError } = require('internal/error_serdes');
 
 
 module.exports = async function* v8Reporter(source) {
-  const serializer = new DefaultSerializer();
-  serializer.writeHeader();
-  const headerLength = TypedArrayPrototypeGetLength(serializer.releaseBuffer());
+  const headerSerializer = new DefaultSerializer();
+  headerSerializer.writeHeader();
+  const headerLength = TypedArrayPrototypeGetLength(headerSerializer.releaseBuffer());
 
   for await (const item of source) {
+    const serializer = new DefaultSerializer();
     const originalError = item.data.details?.error;
     if (originalError) {
       // Error is overridden with a serialized version, so that it can be
diff --git a/lib/internal/tls/common.js b/lib/internal/tls/common.js
index 66331d2d9999..70502337df8f 100644
--- a/lib/internal/tls/common.js
+++ b/lib/internal/tls/common.js
@@ -100,6 +100,7 @@ function createSecureContext(options) {
     minVersion,
     maxVersion,
     secureProtocol,
+    singleUse,
   } = options;
 
   let { secureOptions } = options;
@@ -112,6 +113,13 @@ function createSecureContext(options) {
 
   configSecureContext(c.context, options);
 
+  // A single-use context belongs to exactly one connection, so the underlying
+  // SSL_CTX can be freed as soon as that connection closes instead of waiting
+  // for the JS wrapper to be garbage collected. TLSSocket relies on this flag
+  // to know that it may close the context itself.
+  if (singleUse)
+    c.singleUse = true;
+
   return c;
 }
 
diff --git a/lib/internal/tls/wrap.js b/lib/internal/tls/wrap.js
index 89254b105b9b..9285d0aaca45 100644
--- a/lib/internal/tls/wrap.js
+++ b/lib/internal/tls/wrap.js
@@ -104,6 +104,7 @@ const kDisableRenegotiation = Symbol('disable-renegotiation');
 const kErrorEmitted = Symbol('error-emitted');
 const kHandshakeTimeout = Symbol('handshake-timeout');
 const kRes = Symbol('res');
+const kSecureContext = Symbol('secureContext');
 const kSNICallback = Symbol('snicallback');
 const kALPNCallback = Symbol('alpncallback');
 const kEnableTrace = Symbol('enableTrace');
@@ -263,8 +264,8 @@ function loadSession(hello) {
       return owner.destroy(new ERR_SOCKET_CLOSED());
 
     owner._handle.loadSession(session);
-    // Session is loaded. End the parser to allow handshaking to continue.
-    owner._handle.endParser();
+    // Session is loaded. Let the handshake continue.
+    owner._handle.clientHelloDone();
   }
 
   if (hello.sessionId.length <= 0 ||
@@ -282,8 +283,8 @@ function loadSession(hello) {
     // Sessions with tickets can be resumed directly from the ticket, no server
     // session storage is necessary.
     // Without a call to a resumeSession listener, a session will never be
-    // loaded, so end the parser to allow handshaking to continue.
-    owner._handle.endParser();
+    // loaded, so let the handshake continue.
+    owner._handle.clientHelloDone();
   }
 }
 
@@ -651,6 +652,7 @@ function TLSSocket(socket, opts) {
   this.authorized = false;
   this.authorizationError = null;
   this[kRes] = null;
+  this[kSecureContext] = null;
   this[kIsVerified] = false;
   this[kPendingSession] = null;
 
@@ -749,6 +751,18 @@ for (const proxiedMethod of proxiedMethods) {
     makeMethodProxy(proxiedMethod);
 }
 
+// A single-use context is owned by the socket that created it, so its SSL_CTX
+// can be released as soon as the socket is gone instead of waiting for the JS
+// wrapper to be garbage collected. It is shared by every handle the socket
+// goes through, so it must outlive any individual TLSWrap.
+function closeSingleUseContext(secureContext) {
+  if (secureContext !== null && secureContext.singleUse &&
+      secureContext.context !== null) {
+    secureContext.context.close();
+    secureContext.context = null;
+  }
+}
+
 tls_wrap.TLSWrap.prototype.close = function close(cb) {
   let ssl;
   if (this[owner_symbol]) {
@@ -761,10 +775,6 @@ tls_wrap.TLSWrap.prototype.close = function close(cb) {
   const done = () => {
     if (ssl) {
       ssl.destroySSL();
-      if (ssl._secureContext.singleUse) {
-        ssl._secureContext.context.close();
-        ssl._secureContext.context = null;
-      }
     }
     if (cb)
       cb();
@@ -822,6 +832,7 @@ TLSSocket.prototype._wrapHandle = function(wrap, handle, wrapHasActiveWriteFromP
   res._parent = handle;  // C++ "wrap" object: TCPWrap, JSStream, ...
   res._parentWrap = wrap;  // JS object: net.Socket, JSStreamSocket, ...
   res._secureContext = context;
+  this[kSecureContext] = context;
   res.reading = handle.reading;
   this[kRes] = res;
   defineHandleReading(this, handle);
@@ -887,13 +898,16 @@ function destroySSL(self) {
 }
 
 TLSSocket.prototype._destroySSL = function _destroySSL() {
-  if (!this.ssl) return;
-  this.ssl.destroySSL();
-  if (this.ssl._secureContext.singleUse) {
-    this.ssl._secureContext.context.close();
-    this.ssl._secureContext.context = null;
-  }
-  this.ssl = null;
+  if (this.ssl) {
+    this.ssl.destroySSL();
+    this.ssl = null;
+  }
+  // Release the context here rather than when a handle closes: a socket that
+  // swaps handles, as autoSelectFamily retries do, shares one context across
+  // the successive TLSWraps and still needs it after the old handle is gone.
+  // TLSWrap.close() may already have cleared `ssl` on the way here.
+  closeSingleUseContext(this[kSecureContext]);
+  this[kSecureContext] = null;
   this[kPendingSession] = null;
   this[kIsVerified] = false;
 };
@@ -971,7 +985,6 @@ TLSSocket.prototype._init = function(socket, wrap) {
     if (this.server) {
       if (this.server.listenerCount('resumeSession') > 0 ||
           this.server.listenerCount('newSession') > 0) {
-        // Also starts the client hello parser as a side effect.
         ssl.enableSessionCallbacks();
       }
       if (this.server.listenerCount('OCSPRequest') > 0)
@@ -1324,7 +1337,7 @@ function onServerSocketSecure() {
 
       if (this._rejectUnauthorized)
         this.destroy();
-    } else if (!this._handle.getPeerX509Certificate()) {
+    } else if (!this._handle.hasPeerCertificate()) {
       // Ncrypto reports X509_V_OK for TLS 1.3 resumption without a peer
       // certificate, as it uses PSKs. Require one to authorize the socket.
       this.authorizationError = 'UNABLE_TO_GET_ISSUER_CERT';
diff --git a/lib/internal/util/comparisons.js b/lib/internal/util/comparisons.js
index 1233fa78dc92..ab6e4b21783b 100644
--- a/lib/internal/util/comparisons.js
+++ b/lib/internal/util/comparisons.js
@@ -132,6 +132,8 @@ let getCryptoKeyType;
 let getCryptoKeyExtractable;
 let getCryptoKeyAlgorithm;
 let getCryptoKeyUsagesMask;
+let getCryptoKeySecondaryHandle;
+let getCryptoKeySeedData;
 let getKeyObjectHandle;
 let getKeyObjectType;
 
@@ -432,14 +434,28 @@ function objectComparisonStart(val1, val2, mode, memos) {
         getCryptoKeyExtractable,
         getCryptoKeyAlgorithm,
         getCryptoKeyUsagesMask,
+        getCryptoKeySecondaryHandle,
+        getCryptoKeySeedData,
       } = require('internal/crypto/keys'));
     }
+    const val1SecondaryHandle = getCryptoKeySecondaryHandle(val1);
+    const val2SecondaryHandle = isCryptoKey(val2) ?
+      getCryptoKeySecondaryHandle(val2) : undefined;
+    const val1SeedData = getCryptoKeySeedData(val1);
+    const val2SeedData = isCryptoKey(val2) ?
+      getCryptoKeySeedData(val2) : undefined;
     if (!isCryptoKey(val2) ||
       getCryptoKeyType(val1) !== getCryptoKeyType(val2) ||
       getCryptoKeyExtractable(val1) !== getCryptoKeyExtractable(val2) ||
       !innerDeepEqual(getCryptoKeyAlgorithm(val1), getCryptoKeyAlgorithm(val2), mode, memos) ||
       getCryptoKeyUsagesMask(val1) !== getCryptoKeyUsagesMask(val2) ||
-      !getCryptoKeyHandle(val1).equals(getCryptoKeyHandle(val2))
+      !getCryptoKeyHandle(val1).equals(getCryptoKeyHandle(val2)) ||
+      (val1SecondaryHandle === undefined) !== (val2SecondaryHandle === undefined) ||
+      (val1SecondaryHandle !== undefined &&
+        !val1SecondaryHandle.equals(val2SecondaryHandle)) ||
+      (val1SeedData === undefined) !== (val2SeedData === undefined) ||
+      (val1SeedData !== undefined &&
+        !innerDeepEqual(val1SeedData, val2SeedData, mode, memos))
     ) {
       return false;
     }
@@ -686,16 +702,18 @@ function setObjectEquiv(array, a, b, mode, memo) {
   const comparator = mode !== kLoose ? objectComparisonStart : innerDeepEqual;
   const extraChecks = mode === kLoose || array.length !== a.size;
   for (const val1 of a) {
-    if (extraChecks) {
-      if (typeof val1 === 'object') {
-        if (b.has(val1)) {
-          continue;
-        }
-      } else if (b.has(val1)) {
+    // Primitive and null members can only match by identity, and must never
+    // reach objectComparisonStart (which throws on `val.constructor` for
+    // null/undefined). Resolve them directly for every such member.
+    if (typeof val1 !== 'object' || val1 === null) {
+      if (b.has(val1)) {
         continue;
-      } else if (mode !== kLoose) {
+      }
+      if (mode !== kLoose) {
         return false;
       }
+    } else if (extraChecks && b.has(val1)) {
+      continue;
     }
 
     let innerStart = start;
diff --git a/lib/internal/util/debounce.js b/lib/internal/util/debounce.js
new file mode 100644
index 000000000000..3038dfeb83fe
--- /dev/null
+++ b/lib/internal/util/debounce.js
@@ -0,0 +1,237 @@
+'use strict';
+
+const {
+  ArrayPrototypePush,
+  ObjectDefineProperties,
+  PromiseReject,
+  PromiseWithResolvers,
+  ReflectApply,
+} = primordials;
+
+const {
+  AbortError,
+} = require('internal/errors');
+const {
+  validateAbortSignal,
+  validateBoolean,
+  validateFunction,
+  validateInteger,
+  validateObject,
+} = require('internal/validators');
+const { addAbortListener } = require('internal/events/abort_listener');
+const { kEmptyObject } = require('internal/util');
+const { TIMEOUT_MAX } = require('internal/timers');
+const { clearTimeout, setTimeout } = require('timers');
+const { markPromiseAsHandled } = internalBinding('util');
+
+/**
+ * @typedef {object} DebounceOptions
+ * @property {AbortSignal} [signal] An AbortSignal that cancels pending and future calls.
+ * @property {boolean} [leading] Whether to invoke on the leading edge.
+ * @property {boolean} [rejectOnCancel] Whether to reject superseded calls.
+ */
+
+/**
+ * Creates a function that delays calling `fn` until `wait` milliseconds have
+ * elapsed since its most recent invocation.
+ * @param {Function} fn
+ * @param {number} wait
+ * @param {DebounceOptions} [options]
+ * @returns {Function}
+ */
+function debounce(fn, wait, options = kEmptyObject) {
+  validateFunction(fn, 'fn');
+  validateInteger(wait, 'wait', 0, TIMEOUT_MAX);
+  validateObject(options, 'options');
+
+  const {
+    leading = false,
+    rejectOnCancel = false,
+    signal,
+  } = options;
+
+  validateBoolean(leading, 'options.leading');
+  validateBoolean(rejectOnCancel, 'options.rejectOnCancel');
+  validateAbortSignal(signal, 'options.signal');
+
+  if (signal?.aborted) {
+    throw new AbortError(undefined, { __proto__: null, cause: signal.reason });
+  }
+
+  let args;
+  let abortError;
+  let pendingCalls = [];
+  let refed = true;
+  let timeout;
+
+  function rejectPending(error) {
+    const calls = pendingCalls;
+    pendingCalls = [];
+    for (let i = 0; i < calls.length; i++) {
+      calls[i].reject(error);
+    }
+  }
+
+  function cancelWithError(error) {
+    if (timeout === undefined) return;
+    clearTimeout(timeout);
+    timeout = undefined;
+    args = undefined;
+    rejectPending(error);
+  }
+
+  function cancel(reason) {
+    if (timeout === undefined) return;
+    const error = reason === undefined ?
+      new AbortError() :
+      new AbortError(undefined, { __proto__: null, cause: reason });
+    cancelWithError(error);
+  }
+
+  function abort() {
+    if (abortError === undefined) {
+      abortError = signal.reason === undefined ?
+        new AbortError() :
+        new AbortError(undefined, { __proto__: null, cause: signal.reason });
+    }
+    cancelWithError(abortError);
+  }
+
+  function ref() {
+    refed = true;
+    timeout?.ref();
+    return debounced;
+  }
+
+  function unref() {
+    refed = false;
+    timeout?.unref();
+    return debounced;
+  }
+
+  function invoke(callArgs, calls) {
+    if (signal?.aborted) {
+      abort();
+      for (let i = 0; i < calls.length; i++) {
+        calls[i].reject(abortError);
+      }
+      return;
+    }
+
+    let result;
+    try {
+      result = ReflectApply(fn, debounced, callArgs);
+    } catch (error) {
+      for (let i = 0; i < calls.length; i++) {
+        calls[i].reject(error);
+      }
+      return;
+    }
+
+    for (let i = 0; i < calls.length; i++) {
+      calls[i].resolve(result);
+    }
+  }
+
+  function invokePending() {
+    const callArgs = args;
+    args = undefined;
+    const calls = pendingCalls;
+    pendingCalls = [];
+    if (calls.length !== 0) invoke(callArgs, calls);
+  }
+
+  function onTimeout() {
+    timeout = undefined;
+    invokePending();
+  }
+
+  function flush() {
+    if (pendingCalls.length === 0) return;
+
+    clearTimeout(timeout);
+    timeout = undefined;
+    invokePending();
+  }
+
+  function debounced(...callArgs) {
+    if (signal?.aborted) abort();
+    if (abortError !== undefined) return PromiseReject(abortError);
+
+    const invokeNow = leading && timeout === undefined;
+    if (timeout !== undefined) {
+      if (pendingCalls.length !== 0) {
+        markPromiseAsHandled(pendingCalls[pendingCalls.length - 1].promise);
+        if (rejectOnCancel) {
+          rejectPending(new AbortError('The debounced call was superseded'));
+        }
+      }
+      timeout.refresh();
+    } else {
+      timeout = setTimeout(onTimeout, wait);
+      if (!refed) timeout.unref();
+    }
+
+    if (signal?.aborted) {
+      abort();
+      return PromiseReject(abortError);
+    }
+
+    const call = PromiseWithResolvers();
+    if (invokeNow) {
+      invoke(callArgs, [call]);
+    } else {
+      ArrayPrototypePush(pendingCalls, call);
+      args = callArgs;
+    }
+    return call.promise;
+  }
+
+  function createFn(value) {
+    return {
+      __proto__: null,
+      configurable: true,
+      enumerable: true,
+      writable: true,
+      value,
+    };
+  }
+
+  ObjectDefineProperties(debounced, {
+    __proto__: null,
+    cancel: createFn(cancel),
+    flush: createFn(flush),
+    ref: createFn(ref),
+    unref: createFn(unref),
+    pending: {
+      __proto__: null,
+      enumerable: false,
+      get() {
+        return pendingCalls.length === 0 ? null : pendingCalls[pendingCalls.length - 1].promise;
+      },
+    },
+    pendingCount: {
+      __proto__: null,
+      enumerable: false,
+      get() { return pendingCalls.length; },
+    },
+    length: {
+      __proto__: null,
+      configurable: true,
+      value: fn.length,
+    },
+    name: {
+      __proto__: null,
+      configurable: true,
+      value: fn.name,
+    },
+  });
+
+  if (signal !== undefined) {
+    addAbortListener(signal, abort);
+  }
+
+  return debounced;
+}
+
+module.exports = debounce;
diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
index 17e9de541289..01ec92a08c21 100644
--- a/lib/internal/util/inspect.js
+++ b/lib/internal/util/inspect.js
@@ -778,20 +778,15 @@ function getPrefix(constructor, tag, fallback, size = '') {
     return `[${fallback}${size}: null prototype] `;
   }
 
-  let result = `${constructor}${size} `;
   if (tag !== '') {
-    const position = constructor.indexOf(tag);
-    if (position === -1) {
-      result += `[${tag}] `;
-    } else {
-      const endPos = position + tag.length;
-      if (endPos !== constructor.length &&
-        constructor[endPos] === constructor[endPos].toLowerCase()) {
-        result += `[${tag}] `;
-      }
+    const dot = StringPrototypeLastIndexOf(tag, '.');
+    if (constructor === (dot >= 1 ? StringPrototypeSlice(tag, dot + 1) : tag)) {
+      return `${tag}${size} `;
     }
+    return `${constructor}${size} [${tag}] `;
   }
-  return result;
+
+  return `${constructor}${size} `;
 }
 
 // Look up the keys of the object.
diff --git a/lib/internal/util/throttle.js b/lib/internal/util/throttle.js
new file mode 100644
index 000000000000..bc1b4f01bdea
--- /dev/null
+++ b/lib/internal/util/throttle.js
@@ -0,0 +1,370 @@
+'use strict';
+
+const {
+  ArrayPrototypePush,
+  ArrayPrototypeSlice,
+  ObjectDefineProperties,
+  PromisePrototypeThen,
+  PromiseReject,
+  PromiseResolve,
+  PromiseWithResolvers,
+  ReflectApply,
+} = primordials;
+
+const {
+  AbortError,
+  codes: {
+    ERR_THROTTLED,
+  },
+} = require('internal/errors');
+const {
+  validateAbortSignal,
+  validateBoolean,
+  validateFunction,
+  validateInteger,
+  validateObject,
+  validateOneOf,
+} = require('internal/validators');
+const { addAbortListener } = require('internal/events/abort_listener');
+const { kEmptyObject } = require('internal/util');
+const { TIMEOUT_MAX } = require('internal/timers');
+const { clearTimeout, setTimeout } = require('timers');
+
+const timersBinding = internalBinding('timers');
+const { markPromiseAsHandled } = internalBinding('util');
+
+/**
+ * @typedef {object} ThrottleOptions
+ * @property {number} [concurrency] The maximum number of unsettled invocations.
+ * @property {number} [maxPending] The maximum number of queued calls.
+ * @property {'queue'|'drop'} [overflow] How calls exceeding the limit are handled.
+ * @property {AbortSignal} [signal] An AbortSignal that cancels pending and future calls.
+ * @property {boolean} [strict] Whether to enforce the limit over a rolling interval.
+ */
+
+/**
+ * Creates a function that invokes `fn` at most `limit` times per `interval`.
+ * @param {Function} fn
+ * @param {number} limit
+ * @param {number} interval
+ * @param {ThrottleOptions} [options]
+ * @returns {Function}
+ */
+function throttle(fn, limit, interval, options = kEmptyObject) {
+  validateFunction(fn, 'fn');
+  validateInteger(limit, 'limit', 1);
+  validateInteger(interval, 'interval', 0, TIMEOUT_MAX);
+  validateObject(options, 'options');
+
+  const {
+    concurrency = Infinity,
+    maxPending = Infinity,
+    overflow = 'queue',
+    signal,
+    strict = false,
+  } = options;
+
+  if (concurrency !== Infinity) {
+    validateInteger(concurrency, 'options.concurrency', 1);
+  }
+  if (maxPending !== Infinity) {
+    validateInteger(maxPending, 'options.maxPending', 0);
+  }
+  validateOneOf(overflow, 'options.overflow', ['queue', 'drop']);
+  validateAbortSignal(signal, 'options.signal');
+  validateBoolean(strict, 'options.strict');
+
+  if (signal?.aborted) {
+    throw new AbortError(undefined, { __proto__: null, cause: signal.reason });
+  }
+
+  let abortError;
+  let activeCount = 0;
+  let pendingCalls = [];
+  let pendingIndex = 0;
+  let refed = true;
+  let strictIndex = 0;
+  let strictTicks = [];
+  let timeout;
+  let windowCount = 0;
+  let windowStart;
+
+  function pendingCount() {
+    return pendingCalls.length - pendingIndex;
+  }
+
+  function dequeue() {
+    const call = pendingCalls[pendingIndex];
+    pendingCalls[pendingIndex++] = undefined;
+
+    if (pendingIndex === pendingCalls.length) {
+      pendingCalls = [];
+      pendingIndex = 0;
+    } else if (pendingIndex > 1024 && pendingIndex * 2 >= pendingCalls.length) {
+      pendingCalls = ArrayPrototypeSlice(pendingCalls, pendingIndex);
+      pendingIndex = 0;
+    }
+
+    return call;
+  }
+
+  function rejectPending(error) {
+    const calls = pendingCalls;
+    const start = pendingIndex;
+    pendingCalls = [];
+    pendingIndex = 0;
+    for (let i = start; i < calls.length; i++) {
+      calls[i].reject(error);
+    }
+  }
+
+  function resetLimiter() {
+    strictIndex = 0;
+    strictTicks = [];
+    windowCount = 0;
+    windowStart = undefined;
+  }
+
+  function cancelWithError(error) {
+    if (timeout !== undefined) {
+      clearTimeout(timeout);
+      timeout = undefined;
+    }
+    resetLimiter();
+    rejectPending(error);
+  }
+
+  function cancel(reason) {
+    const error = reason === undefined ?
+      new AbortError() :
+      new AbortError(undefined, { __proto__: null, cause: reason });
+    cancelWithError(error);
+  }
+
+  function abort() {
+    if (abortError === undefined) {
+      abortError = signal.reason === undefined ?
+        new AbortError() :
+        new AbortError(undefined, { __proto__: null, cause: signal.reason });
+    }
+    cancelWithError(abortError);
+  }
+
+  function ref() {
+    refed = true;
+    timeout?.ref();
+    return throttled;
+  }
+
+  function unref() {
+    refed = false;
+    timeout?.unref();
+    return throttled;
+  }
+
+  function hasImmediateCapacity() {
+    if (signal?.aborted ||
+        pendingCount() !== 0 ||
+        activeCount >= concurrency) {
+      return false;
+    }
+
+    const now = timersBinding.getLibuvNow();
+    if (strict) {
+      let index = strictIndex;
+      while (index < strictTicks.length &&
+             now - strictTicks[index] >= interval) {
+        index++;
+      }
+      return strictTicks.length - index < limit;
+    }
+
+    return windowStart === undefined ||
+      now - windowStart >= interval ||
+      windowCount < limit;
+  }
+
+  function pruneStrictTicks(now) {
+    while (strictIndex < strictTicks.length &&
+           now - strictTicks[strictIndex] >= interval) {
+      strictIndex++;
+    }
+
+    if (strictIndex === strictTicks.length) {
+      strictIndex = 0;
+      strictTicks = [];
+    } else if (strictIndex > 1024 && strictIndex * 2 >= strictTicks.length) {
+      strictTicks = ArrayPrototypeSlice(strictTicks, strictIndex);
+      strictIndex = 0;
+    }
+  }
+
+  function hasCapacity(now) {
+    if (strict) {
+      pruneStrictTicks(now);
+      return strictTicks.length - strictIndex < limit;
+    }
+
+    if (windowStart === undefined || now - windowStart >= interval) {
+      windowCount = 0;
+      windowStart = now;
+    }
+    return windowCount < limit;
+  }
+
+  function reserve(now) {
+    if (strict) {
+      ArrayPrototypePush(strictTicks, now);
+    } else {
+      windowCount++;
+    }
+  }
+
+  function onSettled() {
+    activeCount--;
+    drain();
+  }
+
+  function invoke(call) {
+    activeCount++;
+    let resultPromise;
+    try {
+      resultPromise = PromiseResolve(ReflectApply(fn, throttled, call.args));
+    } catch (error) {
+      resultPromise = PromiseReject(error);
+    }
+    call.resolve(resultPromise);
+    PromisePrototypeThen(resultPromise, onSettled, onSettled);
+  }
+
+  function drop() {
+    const promise = PromiseReject(new ERR_THROTTLED());
+    markPromiseAsHandled(promise);
+    return promise;
+  }
+
+  function schedule() {
+    if (timeout !== undefined ||
+        pendingCount() === 0 ||
+        activeCount >= concurrency) {
+      return;
+    }
+
+    const now = timersBinding.getLibuvNow();
+    if (hasCapacity(now)) {
+      drain();
+      return;
+    }
+
+    const delay = strict ?
+      strictTicks[strictIndex] + interval - now :
+      windowStart + interval - now;
+    timeout = setTimeout(onTimeout, delay);
+    if (!refed) timeout.unref();
+  }
+
+  function drain() {
+    if (signal?.aborted) {
+      abort();
+      return;
+    }
+
+    while (pendingCount() !== 0 && activeCount < concurrency) {
+      const now = timersBinding.getLibuvNow();
+      if (!hasCapacity(now)) break;
+      const call = dequeue();
+      reserve(now);
+      invoke(call);
+    }
+
+    schedule();
+  }
+
+  function onTimeout() {
+    timeout = undefined;
+    drain();
+  }
+
+  function throttled(...callArgs) {
+    if (signal?.aborted) abort();
+    if (abortError !== undefined) return PromiseReject(abortError);
+
+    const now = timersBinding.getLibuvNow();
+    const canInvoke = pendingCount() === 0 &&
+      activeCount < concurrency &&
+      hasCapacity(now);
+    if (!canInvoke &&
+        (overflow === 'drop' || pendingCount() >= maxPending)) {
+      return drop();
+    }
+
+    const call = PromiseWithResolvers();
+    call.args = callArgs;
+
+    if (canInvoke) {
+      reserve(now);
+      invoke(call);
+    } else {
+      ArrayPrototypePush(pendingCalls, call);
+      schedule();
+    }
+
+    return call.promise;
+  }
+
+  function createFn(value) {
+    return {
+      __proto__: null,
+      configurable: true,
+      enumerable: true,
+      writable: true,
+      value,
+    };
+  }
+
+  ObjectDefineProperties(throttled, {
+    __proto__: null,
+    cancel: createFn(cancel),
+    hasImmediateCapacity: createFn(hasImmediateCapacity),
+    ref: createFn(ref),
+    unref: createFn(unref),
+    pending: {
+      __proto__: null,
+      enumerable: false,
+      get() {
+        return pendingCount() === 0 ? null :
+          pendingCalls[pendingCalls.length - 1].promise;
+      },
+    },
+    pendingCount: {
+      __proto__: null,
+      enumerable: false,
+      get: pendingCount,
+    },
+    activeCount: {
+      __proto__: null,
+      enumerable: false,
+      get() {
+        return activeCount;
+      },
+    },
+    length: {
+      __proto__: null,
+      configurable: true,
+      value: fn.length,
+    },
+    name: {
+      __proto__: null,
+      configurable: true,
+      value: fn.name,
+    },
+  });
+
+  if (signal !== undefined) {
+    addAbortListener(signal, abort);
+  }
+
+  return throttled;
+}
+
+module.exports = throttle;
diff --git a/lib/internal/webidl.js b/lib/internal/webidl.js
index 7f61bae8c21f..446a4e5f5aec 100644
--- a/lib/internal/webidl.js
+++ b/lib/internal/webidl.js
@@ -21,7 +21,6 @@ const {
   NumberMAX_SAFE_INTEGER,
   NumberMIN_SAFE_INTEGER,
   ObjectPrototypeHasOwnProperty,
-  ObjectPrototypeIsPrototypeOf,
   SafeArrayIterator,
   SafeSet,
   String,
@@ -37,6 +36,8 @@ const {
   isTypedArray,
 } = require('internal/util/types');
 
+const { getSharedArrayBufferGrowable } = internalBinding('util');
+
 const BIGINT_2_63 = 1n << 63n;
 const BIGINT_2_64 = 1n << 64n;
 
@@ -698,7 +699,7 @@ function createDictionaryConverter(
   };
 
   const dictionaries = ArrayIsArray(members[0]) ? members : [members];
-  const sortedDictionaries = [];
+  const sortedMembers = [];
 
   function ownMember(member, key) {
     return ObjectPrototypeHasOwnProperty(member, key) ? member[key] : undefined;
@@ -712,7 +713,7 @@ function createDictionaryConverter(
   // from least-derived to most-derived and sort only within each dictionary.
   // Callers with inheritance pass one member array per dictionary level.
   for (let i = 0; i < dictionaries.length; i++) {
-    const sortedMembers = ArrayPrototypeToSorted(
+    const sortedDictionary = ArrayPrototypeToSorted(
       dictionaries[i],
       compareMembers,
     );
@@ -721,22 +722,21 @@ function createDictionaryConverter(
     // Re-materialize each descriptor once with every key present, copied from
     // own properties only. The ordinary prototype is deliberate: nothing
     // consults it now, and detaching it measurably slows these reads down.
-    for (let j = 0; j < sortedMembers.length; j++) {
-      const member = sortedMembers[j];
+    for (let j = 0; j < sortedDictionary.length; j++) {
+      const member = sortedDictionary[j];
       const defaultValue = ownMember(member, 'defaultValue');
       const required = ownMember(member, 'required');
       if (typeof defaultValue === 'function' || required) {
         anyMissingMemberHandling = true;
       }
-      sortedMembers[j] = {
+      setOwnProperty(sortedMembers, sortedMembers.length, {
         key: ownMember(member, 'key'),
         converter: ownMember(member, 'converter'),
         defaultValue,
         required,
         validator: ownMember(member, 'validator'),
-      };
+      });
     }
-    ArrayPrototypePush(sortedDictionaries, sortedMembers);
   }
 
   const hasMissingMemberHandling = anyMissingMemberHandling;
@@ -752,43 +752,41 @@ function createDictionaryConverter(
 
     // Step 2: create the IDL dictionary value.
     const idlDict = { __proto__: null };
-
-    // Steps 3-4: iterate each dictionary level, then its sorted members.
-    for (let i = 0; i < sortedDictionaries.length; i++) {
-      const sortedMembers = sortedDictionaries[i];
-      for (let j = 0; j < sortedMembers.length; j++) {
-        const member = sortedMembers[j];
-        // Step 4.1.1: get the dictionary member identifier.
-        const key = member.key;
-        // Steps 4.1.2-4.1.3: read the JavaScript member value.
-        const jsMemberValue = jsDict == null ? undefined : jsDict[key];
-
-        // Step 4.1.4: convert and store present member values.
-        if (jsMemberValue !== undefined) {
-          const converter = member.converter;
-          // Step 4.1.4.1: convert the JavaScript value to IDL.
-          const idlMemberValue = converter(
-            jsMemberValue,
-            makeOptions(options, dictionaryMemberContext(key, options)),
-          );
-          // Validators are a Node.js extension after conversion. They let
-          // consumers reject known unsupported values while dictionary
-          // conversion still has precise member context. Web Crypto uses this
-          // so SubtleCrypto.supports() can make accurate decisions from
-          // normalized dictionaries instead of probing by running operations.
-          member.validator?.(idlMemberValue, jsDict);
-          // Step 4.1.4.2: set idlDict[key] to the IDL value.
-          idlDict[key] = idlMemberValue;
-        } else if (hasMissingMemberHandling) {
-          if (typeof member.defaultValue === 'function') {
-            // Step 4.1.5: store the member default value.
-            idlDict[key] = member.defaultValue();
-          } else if (member.required) {
-            // Step 4.1.6: required missing members throw.
-            throw makeException(
-              missingDictionaryMemberMessage(dictionaryName, key),
-              makeOptions(options, options.context, 'ERR_MISSING_OPTION'));
-          }
+    if (jsDict == null && !hasMissingMemberHandling) return idlDict;
+
+    // Steps 3-4: members retain their per-dictionary order from construction.
+    for (let i = 0; i < sortedMembers.length; i++) {
+      const member = sortedMembers[i];
+      // Step 4.1.1: get the dictionary member identifier.
+      const key = member.key;
+      // Steps 4.1.2-4.1.3: read the JavaScript member value.
+      const jsMemberValue = jsDict == null ? undefined : jsDict[key];
+
+      // Step 4.1.4: convert and store present member values.
+      if (jsMemberValue !== undefined) {
+        const converter = member.converter;
+        // Step 4.1.4.1: convert the JavaScript value to IDL.
+        const idlMemberValue = converter(
+          jsMemberValue,
+          makeOptions(options, dictionaryMemberContext(key, options)),
+        );
+        // Validators are a Node.js extension after conversion. They let
+        // consumers reject known unsupported values while dictionary
+        // conversion still has precise member context. Web Crypto uses this
+        // so SubtleCrypto.supports() can make accurate decisions from
+        // normalized dictionaries instead of probing by running operations.
+        member.validator?.(idlMemberValue, jsDict);
+        // Step 4.1.4.2: set idlDict[key] to the IDL value.
+        idlDict[key] = idlMemberValue;
+      } else if (hasMissingMemberHandling) {
+        if (typeof member.defaultValue === 'function') {
+          // Step 4.1.5: store the member default value.
+          idlDict[key] = member.defaultValue();
+        } else if (member.required) {
+          // Step 4.1.6: required missing members throw.
+          throw makeException(
+            missingDictionaryMemberMessage(dictionaryName, key),
+            makeOptions(options, options.context, 'ERR_MISSING_OPTION'));
         }
       }
     }
@@ -824,7 +822,12 @@ function createSequenceConverter(converter) {
 
     // Step 4 and create-sequence step 1: get the iterator record.
     const iterator = FunctionPrototypeCall(method, V);
-    const nextMethod = iterator?.next;
+    if (type(iterator) !== 'Object') {
+      throw makeException(
+        'cannot be converted to sequence.',
+        options);
+    }
+    const nextMethod = iterator.next;
     if (typeof nextMethod !== 'function') {
       throw makeException(
         'cannot be converted to sequence.',
@@ -861,13 +864,13 @@ function createSequenceConverter(converter) {
  * Creates a converter for a Web IDL interface type.
  * @see https://webidl.spec.whatwg.org/#js-interface
  * @param {string} name Interface identifier.
- * @param {object} prototype Interface prototype object.
+ * @param {(value: any) => boolean} brandCheck Interface brand predicate.
  * @returns {Converter}
  */
-function createInterfaceConverter(name, prototype) {
+function createInterfaceConverter(name, brandCheck) {
   return (V, options = kEmptyObject) => {
     // Web IDL interface conversion step 1: return V if it implements I.
-    if (ObjectPrototypeIsPrototypeOf(prototype, V)) {
+    if (brandCheck(V)) {
       return V;
     }
     // Step 2: otherwise throw.
@@ -933,12 +936,8 @@ function validateBufferSourceBacking(buffer, options) {
 function validateAllowGrowableSharedArrayBuffer(buffer, options) {
   // SharedArrayBuffer and ArrayBufferView conversion step 3:
   // IsFixedLengthArrayBuffer(buffer) must be true without [AllowResizable].
-  // Do not use a primordial getter here. When this module is included in the
-  // startup snapshot, an early-captured SharedArrayBuffer.prototype.growable
-  // getter does not detect growable buffers created after deserialization.
-  // Lazily capturing the getter would work, but it would observe the runtime
-  // prototype at first comparison, so it would not be an actual primordial.
-  if (!options.allowResizable && buffer.growable) {
+  if (!options.allowResizable &&
+      FunctionPrototypeCall(getSharedArrayBufferGrowable, buffer)) {
     throw makeException(
       'is backed by a growable SharedArrayBuffer, which is not allowed.',
       options);
diff --git a/lib/internal/webstreams/adapters.js b/lib/internal/webstreams/adapters.js
index 5469b3149447..9c277ed7e991 100644
--- a/lib/internal/webstreams/adapters.js
+++ b/lib/internal/webstreams/adapters.js
@@ -23,11 +23,16 @@ const { TextEncoder } = require('internal/encoding');
 const {
   ReadableStream,
   isReadableStream,
+  readableStreamDefaultReaderRead,
+  kChunk,
+  kClose,
+  kError,
 } = require('internal/webstreams/readablestream');
 
 const {
   WritableStream,
   isWritableStream,
+  writableStreamDefaultWriterWriteWithRequest,
 } = require('internal/webstreams/writablestream');
 
 const {
@@ -53,6 +58,10 @@ const {
   Buffer,
 } = require('buffer');
 
+const {
+  kResolvedPromise,
+} = require('internal/webstreams/util');
+
 const {
   isAnyArrayBuffer,
 } = require('internal/util/types');
@@ -84,6 +93,7 @@ const {
 const {
   WriteWrap,
   ShutdownWrap,
+  kArrayBufferOffset,
   kReadBytesOrError,
   kLastWriteWasAsync,
   streamBaseState,
@@ -140,6 +150,96 @@ function handleKnownInternalErrors(cause) {
 
 const noop = () => {};
 
+// A single shared write request tracks every chunk written to the
+// destination WritableStream, replacing the per-write promise pair that
+// writer.ready + writer.write() would allocate. Only one write/writev
+// batch is in flight at a time, so one callback slot is enough.
+// `promise` is non-undefined so writable-stream queue entries are
+// discriminated from kNilRequest by `promise === undefined`;
+// `failed`/`failure` latch a write that could not proceed.
+function createWriteTracker(getDestination) {
+  return {
+    promise: null,
+    pending: 0,
+    failed: false,
+    failure: undefined,
+    callback: undefined,
+    error: undefined,
+    hasError: false,
+    dispatching: false,
+    resolve() {
+      this.pending--;
+      if (!this.dispatching && this.pending === 0 &&
+          this.callback !== undefined) {
+        this.settle();
+      }
+    },
+    reject(error) {
+      this.pending--;
+      if (!this.hasError) {
+        this.hasError = true;
+        this.error = error;
+      }
+      if (!this.dispatching && this.pending === 0 &&
+          this.callback !== undefined) {
+        this.settle();
+      }
+    },
+    settle() {
+      const callback = this.callback;
+      this.callback = undefined;
+      let error;
+      if (this.hasError) {
+        error = this.error;
+        this.hasError = false;
+        this.error = undefined;
+      } else if (this.failed) {
+        error = this.failure;
+      }
+      this.failed = false;
+      this.failure = undefined;
+      if (error !== undefined) {
+        // Deliver failures in a microtask: this can run while the
+        // writable-stream machinery is mid-transition (e.g. inside
+        // writableStreamFinishErroring), and the callback typically
+        // destroys the stream, which re-enters the machinery.
+        PromisePrototypeThen(kResolvedPromise, () => {
+          try {
+            callback(error);
+          } catch (err) {
+            process.nextTick(() => destroy(getDestination(), err));
+          }
+        });
+        return;
+      }
+      try {
+        callback(error);
+      } catch (err) {
+        // In a next tick because this can run within a promise context,
+        // and any error thrown must not become an unhandled rejection.
+        process.nextTick(() => destroy(getDestination(), err));
+      }
+    },
+  };
+}
+
+function dispatchWrite(writer, chunk, tracker) {
+  tracker.dispatching = true;
+  writableStreamDefaultWriterWriteWithRequest(writer, chunk, tracker);
+  tracker.dispatching = false;
+  if (tracker.pending === 0)
+    tracker.settle();
+}
+
+function dispatchWritev(writer, chunks, tracker) {
+  tracker.dispatching = true;
+  for (let i = 0; i < chunks.length; i++)
+    writableStreamDefaultWriterWriteWithRequest(writer, chunks[i].chunk, tracker);
+  tracker.dispatching = false;
+  if (tracker.pending === 0)
+    tracker.settle();
+}
+
 /**
  * @typedef {import('../../stream').Writable} Writable
  * @typedef {import('../../stream').Readable} Readable
@@ -312,6 +412,7 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
 
   const writer = writableStream.getWriter();
   let closed = false;
+  const writeTracker = createWriteTracker(() => writable);
 
   const writable = new Writable({
     highWaterMark,
@@ -320,27 +421,8 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
     signal,
 
     writev(chunks, callback) {
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          // In a next tick because this is happening within
-          // a promise context, and if there are any errors
-          // thrown we don't want those to cause an unhandled
-          // rejection. Let's just escape the promise and
-          // handle it separately.
-          process.nextTick(() => destroy(writable, error));
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(
-          writer.ready,
-          () => SafePromiseAllReturnVoid(
-            chunks,
-            (data) => writer.write(data.chunk))),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWritev(writer, chunks, writeTracker);
     },
 
     write(chunk, encoding, callback) {
@@ -359,18 +441,8 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
         }
       }
 
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          destroy(writable, error);
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(writer.ready, () => writer.write(chunk)),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWrite(writer, chunk, writeTracker);
     },
 
     destroy(error, callback) {
@@ -540,6 +612,7 @@ function newReadableStreamFromStreamReadable(streamReadable, options = kEmptyObj
     streamReadable.pause();
 
     streamReadable.on('data', function onData(chunk) {
+      if (wasCanceled) return;
       // Copy the Buffer to detach it from the pool.
       if (Buffer.isBuffer(chunk) && !objectMode)
         chunk = new Uint8Array(chunk);
@@ -584,6 +657,14 @@ function newStreamReadableFromReadableStream(readableStream, options = kEmptyObj
 
   const reader = readableStream.getReader();
   let closed = false;
+  let readRequest;
+  let pendingChunk;
+
+  function forwardChunk() {
+    const chunk = pendingChunk;
+    pendingChunk = undefined;
+    readable.push(chunk);
+  }
 
   const readable = new Readable({
     objectMode,
@@ -592,17 +673,25 @@ function newStreamReadableFromReadableStream(readableStream, options = kEmptyObj
     signal,
 
     read() {
-      PromisePrototypeThen(
-        reader.read(),
-        (chunk) => {
-          if (chunk.done) {
-            // Value should always be undefined here.
-            readable.push(null);
-          } else {
-            readable.push(chunk.value);
-          }
+      // At most one read is in flight (Readable does not call read()
+      // again before push()), so a single reused read request replaces
+      // the promise, read-result object, and reaction closures that
+      // reader.read() would allocate per chunk. The chunk is forwarded
+      // in a microtask to keep the old reaction position: a sync push
+      // could deliver a chunk that an error or destroy should beat.
+      readRequest ??= {
+        [kChunk](chunk) {
+          pendingChunk = chunk;
+          PromisePrototypeThen(kResolvedPromise, forwardChunk);
+        },
+        [kClose]() {
+          readable.push(null);
         },
-        (error) => destroy(readable, error));
+        [kError](error) {
+          destroy(readable, error);
+        },
+      };
+      readableStreamDefaultReaderRead(reader, readRequest);
     },
 
     destroy(error, callback) {
@@ -757,6 +846,15 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
   const reader = readableStream.getReader();
   let writableClosed = false;
   let readableClosed = false;
+  let readRequest;
+  let pendingChunk;
+  const writeTracker = createWriteTracker(() => duplex);
+
+  function forwardChunk() {
+    const chunk = pendingChunk;
+    pendingChunk = undefined;
+    duplex.push(chunk);
+  }
 
   const duplex = new Duplex({
     allowHalfOpen,
@@ -767,27 +865,8 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
     signal,
 
     writev(chunks, callback) {
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          // In a next tick because this is happening within
-          // a promise context, and if there are any errors
-          // thrown we don't want those to cause an unhandled
-          // rejection. Let's just escape the promise and
-          // handle it separately.
-          process.nextTick(() => destroy(duplex, error));
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(
-          writer.ready,
-          () => SafePromiseAllReturnVoid(
-            chunks,
-            (data) => writer.write(data.chunk))),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWritev(writer, chunks, writeTracker);
     },
 
     write(chunk, encoding, callback) {
@@ -806,18 +885,8 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
         }
       }
 
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          destroy(duplex, error);
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(writer.ready, () => writer.write(chunk)),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWrite(writer, chunk, writeTracker);
     },
 
     final(callback) {
@@ -843,16 +912,21 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
     },
 
     read() {
-      PromisePrototypeThen(
-        reader.read(),
-        (chunk) => {
-          if (chunk.done) {
-            duplex.push(null);
-          } else {
-            duplex.push(chunk.value);
-          }
+      // Same single-in-flight reused read request as
+      // newStreamReadableFromReadableStream().
+      readRequest ??= {
+        [kChunk](chunk) {
+          pendingChunk = chunk;
+          PromisePrototypeThen(kResolvedPromise, forwardChunk);
         },
-        (error) => destroy(duplex, error));
+        [kClose]() {
+          duplex.push(null);
+        },
+        [kError](error) {
+          destroy(duplex, error);
+        },
+      };
+      readableStreamDefaultReaderRead(reader, readRequest);
     },
 
     destroy(error, callback) {
@@ -1037,7 +1111,8 @@ function newReadableStreamFromStreamBase(streamBase, strategy, options = kEmptyO
         return;
       }
 
-      controller.enqueue(arrayBuffer);
+      const offset = streamBaseState[kArrayBufferOffset];
+      controller.enqueue(new Uint8Array(arrayBuffer, offset, nread));
 
       if (controller.desiredSize <= 0)
         streamBase.readStop();
diff --git a/lib/internal/webstreams/readablestream.js b/lib/internal/webstreams/readablestream.js
index dfb3b7e11af5..7d861995d580 100644
--- a/lib/internal/webstreams/readablestream.js
+++ b/lib/internal/webstreams/readablestream.js
@@ -1419,22 +1419,30 @@ const isReadableStreamBYOBReader =
 
 // ---- ReadableStream Implementation
 
+// The state record classes null out their prototype chain to keep
+// Object.prototype out of property lookups; every field ever assigned
+// is declared so the shape never transitions.
+class ReadableStreamTransferState {
+  writable = undefined;
+  port1 = undefined;
+  port2 = undefined;
+  promise = undefined;
+}
+ObjectSetPrototypeOf(ReadableStreamTransferState.prototype, null);
+
+class ReadableStreamState {
+  closedPromise = undefined;
+  disturbed = false;
+  reader = undefined;
+  state = 'readable';
+  storedError = undefined;
+  controller = undefined;
+  transfer = new ReadableStreamTransferState();
+}
+ObjectSetPrototypeOf(ReadableStreamState.prototype, null);
+
 function createReadableStreamState() {
-  return {
-    __proto__: null,
-    closedPromise: undefined,
-    disturbed: false,
-    reader: undefined,
-    state: 'readable',
-    storedError: undefined,
-    transfer: {
-      __proto__: null,
-      writable: undefined,
-      port1: undefined,
-      port2: undefined,
-      promise: undefined,
-    },
-  };
+  return new ReadableStreamState();
 }
 
 function readableStreamFromIterable(iterable) {
@@ -3870,6 +3878,9 @@ module.exports = {
   readableStreamReaderGenericRelease,
   readableStreamBYOBReaderRead,
   readableStreamDefaultReaderRead,
+  kChunk,
+  kClose,
+  kError,
   setupReadableStreamBYOBReader,
   setupReadableStreamDefaultReader,
   readableStreamDefaultControllerClose,
diff --git a/lib/internal/webstreams/transformstream.js b/lib/internal/webstreams/transformstream.js
index 30b7b1c8fac1..85c118474894 100644
--- a/lib/internal/webstreams/transformstream.js
+++ b/lib/internal/webstreams/transformstream.js
@@ -253,21 +253,38 @@ ObjectDefineProperties(TransformStream.prototype, {
   [SymbolToStringTag]: getNonWritablePropertyDescriptor(TransformStream.name),
 });
 
+// The state record classes null out their prototype chain to keep
+// Object.prototype out of property lookups; every field ever assigned
+// is declared so the shape never transitions.
+class TransformStreamState {
+  readable = undefined;
+  writable = undefined;
+  controller = undefined;
+  backpressure = undefined;
+  // Continuation slots replacing the spec's
+  // [[backpressureChangePromise]]; see transformStreamSetBackpressure.
+  pullPending = false;
+  pendingWriteParked = false;
+  pendingWriteChunk = undefined;
+  writeContinuation = undefined;
+}
+ObjectSetPrototypeOf(TransformStreamState.prototype, null);
+
+class TransformStreamControllerState {
+  stream = undefined;
+  transformAlgorithm = undefined;
+  flushAlgorithm = undefined;
+  cancelAlgorithm = undefined;
+  performTransformRejected = undefined;
+  finishPromise = undefined;
+}
+ObjectSetPrototypeOf(TransformStreamControllerState.prototype, null);
+
 function InternalTransferredTransformStream() {
   ObjectSetPrototypeOf(this, TransformStream.prototype);
   markTransferMode(this, false, true);
   this[kType] = 'TransformStream';
-  this[kState] = {
-    __proto__: null,
-    readable: undefined,
-    writable: undefined,
-    backpressure: undefined,
-    pullPending: false,
-    pendingWrite: undefined,
-    pendingWriteChunk: undefined,
-    writeContinuation: undefined,
-    controller: undefined,
-  };
+  this[kState] = new TransformStreamState();
 }
 
 ObjectSetPrototypeOf(InternalTransferredTransformStream.prototype, TransformStream.prototype);
@@ -388,19 +405,10 @@ function initializeTransformStream(
     readableSizeAlgorithm,
   );
 
-  stream[kState] = {
-    __proto__: null,
-    readable,
-    writable,
-    controller: undefined,
-    backpressure: undefined,
-    // Continuation slots replacing the spec's
-    // [[backpressureChangePromise]]; see transformStreamSetBackpressure.
-    pullPending: false,
-    pendingWrite: undefined,
-    pendingWriteChunk: undefined,
-    writeContinuation: undefined,
-  };
+  const state = new TransformStreamState();
+  state.readable = readable;
+  state.writable = writable;
+  stream[kState] = state;
 
   transformStreamSetBackpressure(stream, true);
 }
@@ -457,7 +465,7 @@ function transformStreamSetBackpressure(stream, backpressure) {
         kResolvedPromise,
         state.readable[kState].controller[kState].pullFulfilled);
     }
-  } else if (state.pendingWrite !== undefined) {
+  } else if (state.pendingWriteParked) {
     PromisePrototypeThen(kResolvedPromise, state.writeContinuation);
   }
 }
@@ -470,14 +478,12 @@ function setupTransformStreamDefaultController(
   cancelAlgorithm) {
   assert(isTransformStream(stream));
   assert(stream[kState].controller === undefined);
-  controller[kState] = {
-    __proto__: null,
-    stream,
-    transformAlgorithm,
-    flushAlgorithm,
-    cancelAlgorithm,
-    performTransformRejected: undefined,
-  };
+  const controllerState = new TransformStreamControllerState();
+  controllerState.stream = stream;
+  controllerState.transformAlgorithm = transformAlgorithm;
+  controllerState.flushAlgorithm = flushAlgorithm;
+  controllerState.cancelAlgorithm = cancelAlgorithm;
+  controller[kState] = controllerState;
   stream[kState].controller = controller;
 }
 
@@ -603,35 +609,41 @@ function transformStreamDefaultSinkWriteAlgorithm(stream, chunk) {
   } = state;
   assert(writable[kState].state === 'writable');
   if (state.backpressure) {
-    // Park the chunk and one promise record; the backpressure -> false
-    // flip delivers the cached continuation (see
-    // transformStreamSetBackpressure) at the same microtask position as
-    // the old [[backpressureChangePromise]] reaction. The continuation
-    // resolves the sink promise with the perform-transform promise, so
-    // adoption reproduces the old derived-chain settle depth exactly.
-    // The writable dispatches a single write at a time, so one pending
-    // slot suffices.
-    assert(state.pendingWrite === undefined);
-    const pendingWrite = PromiseWithResolvers();
-    state.pendingWrite = pendingWrite;
+    // Park the chunk; the backpressure -> false flip delivers the cached
+    // continuation (see transformStreamSetBackpressure) at the same
+    // microtask position as the old [[backpressureChangePromise]]
+    // reaction. The continuation completes the parked write by wiring
+    // the perform-transform promise directly to the writable
+    // controller's write reactions (they exist: the controller creates
+    // them before invoking the write algorithm), replacing the promise
+    // record the old code allocated and resolved per parked chunk. The
+    // writable dispatches a single write at a time, so one pending slot
+    // suffices.
+    assert(!state.pendingWriteParked);
+    state.pendingWriteParked = true;
     state.pendingWriteChunk = chunk;
     state.writeContinuation ??= () => {
-      const pending = state.pendingWrite;
       const pendingChunk = state.pendingWriteChunk;
-      state.pendingWrite = undefined;
+      state.pendingWriteParked = false;
       state.pendingWriteChunk = undefined;
       const writableState = state.writable[kState];
+      const writableControllerState = writableState.controller[kState];
       if (writableState.state === 'erroring') {
-        pending.reject(writableState.storedError);
+        const error = writableState.storedError;
+        PromisePrototypeThen(
+          kResolvedPromise,
+          () => writableControllerState.writeRejected(error));
         return;
       }
       assert(writableState.state === 'writable');
-      pending.resolve(
+      PromisePrototypeThen(
         transformStreamDefaultControllerPerformTransform(
           controller,
-          pendingChunk));
+          pendingChunk),
+        writableControllerState.writeFulfilled,
+        writableControllerState.writeRejected);
     };
-    return pendingWrite.promise;
+    return kParkedAlgorithmResult;
   }
   return transformStreamDefaultControllerPerformTransform(controller, chunk);
 }
diff --git a/lib/internal/webstreams/writablestream.js b/lib/internal/webstreams/writablestream.js
index 1e9ca02cfe96..362a68fc9db9 100644
--- a/lib/internal/webstreams/writablestream.js
+++ b/lib/internal/webstreams/writablestream.js
@@ -596,35 +596,42 @@ const isWritableStreamDefaultWriter =
 const isWritableStreamDefaultController =
   isBrandCheck('WritableStreamDefaultController');
 
+// The state record classes null out their prototype chain to keep
+// Object.prototype out of property lookups; every field ever assigned
+// is declared so the shape never transitions.
+class WritableStreamTransferState {
+  readable = undefined;
+  port1 = undefined;
+  port2 = undefined;
+  promise = undefined;
+}
+ObjectSetPrototypeOf(WritableStreamTransferState.prototype, null);
+
+class WritableStreamState {
+  closedPromise = undefined;
+  closeRequest = kNilRequest;
+  // Mirrors "closeRequest or inFlightCloseRequest is pending"; kept as a
+  // flag because the predicate runs several times per chunk on the write
+  // hot path.
+  closeQueuedOrInFlight = false;
+  inFlightWriteRequest = kNilRequest;
+  inFlightCloseRequest = kNilRequest;
+  pendingAbortRequest = kNilPendingAbortRequest;
+  backpressure = false;
+  controller = undefined;
+  state = 'writable';
+  storedError = undefined;
+  // Ring-buffer request queue, materialized lazily on the first pending
+  // write (see writableStreamAddWriteRequest) so construction allocates
+  // no request storage.
+  writeRequests = kEmptyQueue;
+  writer = undefined;
+  transfer = new WritableStreamTransferState();
+}
+ObjectSetPrototypeOf(WritableStreamState.prototype, null);
+
 function createWritableStreamState() {
-  return {
-    __proto__: null,
-    closedPromise: undefined,
-    closeRequest: kNilRequest,
-    // Mirrors "closeRequest or inFlightCloseRequest is pending"; kept as a
-    // flag because the predicate runs several times per chunk on the write
-    // hot path.
-    closeQueuedOrInFlight: false,
-    inFlightWriteRequest: kNilRequest,
-    inFlightCloseRequest: kNilRequest,
-    pendingAbortRequest: kNilPendingAbortRequest,
-    backpressure: false,
-    controller: undefined,
-    state: 'writable',
-    storedError: undefined,
-    // Ring-buffer request queue, materialized lazily on the first pending
-    // write (see writableStreamAddWriteRequest) so construction allocates
-    // no request storage.
-    writeRequests: kEmptyQueue,
-    writer: undefined,
-    transfer: {
-      __proto__: null,
-      readable: undefined,
-      port1: undefined,
-      port2: undefined,
-      promise: undefined,
-    },
-  };
+  return new WritableStreamState();
 }
 
 function isWritableStreamLocked(stream) {
@@ -928,6 +935,13 @@ function writableStreamFinishErroring(stream) {
     writableStreamRejectCloseAndClosedPromiseIfNeeded(stream);
     return;
   }
+  // The closed promises are only rejected once the sink's abort algorithm
+  // settles, so materialize them here: deriving them from the 'errored'
+  // state within that window would hand out an already rejected promise.
+  stream[kState].closedPromise ??= PromiseWithResolvers();
+  const writer = stream[kState].writer;
+  if (writer !== undefined)
+    writer[kState].close ??= PromiseWithResolvers();
   PromisePrototypeThen(
     stream[kState].controller[kAbort](abortRequest.reason),
     () => {
diff --git a/lib/net.js b/lib/net.js
index 36e1531a780c..cbaa7ecb92b9 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -388,6 +388,10 @@ const kBoundPath = Symbol('kBoundPath');
 
 const isLinux = process.platform === 'linux';
 
+// Internal: construct an empty BoundSocket shell during postMessage()
+// deserialization; the transferred handle is installed by [kDeserialize].
+const kBoundSocketDeserialize = Symbol('kBoundSocketDeserialize');
+
 // A role-neutral wrapper over a synchronously bound libuv handle: bound to a
 // local address (a numeric IP literal for TCP, or a filesystem/abstract path
 // for a unix-domain socket via { path }) but neither listening nor connecting
@@ -396,11 +400,20 @@ const isLinux = process.platform === 'linux';
 // handle must be closed by the caller. bind(2) is non-blocking, so binding
 // happens inline and errors throw synchronously. No DNS is performed.
 class BoundSocket {
-  #handle;
+  #handle = null;
   #address = {};
   #path;
 
   constructor(options = kEmptyObject) {
+    // An un-adopted BoundSocket can be moved to another thread by listing it
+    // in the transferList of a worker_threads postMessage() call. See
+    // [kTransfer]().
+    markTransferMode(this, false, true);
+
+    if (options === kBoundSocketDeserialize) {
+      return;
+    }
+
     validateObject(options, 'options');
 
     if (options.path !== undefined) {
@@ -544,7 +557,56 @@ class BoundSocket {
   get isPipe() {
     return this.#path !== undefined;
   }
+
+  // A BoundSocket can be transferred only while it still owns its handle,
+  // i.e. before it has been adopted, closed or already transferred. Only TCP
+  // binds are transferable; pipe handles cannot move between event loops.
+  #assertTransferable() {
+    if (this.#handle === null || !(this.#handle instanceof TCP)) {
+      throw new ERR_WORKER_HANDLE_NOT_TRANSFERABLE('net.BoundSocket');
+    }
+  }
+
+  [kTransferList]() {
+    this.#assertTransferable();
+    return [this.#handle];
+  }
+
+  [kTransfer]() {
+    this.#assertTransferable();
+    const handle = this.#handle;
+    // Detach the handle; the messaging layer takes ownership of it via
+    // TCPWrap::TransferForMessaging(). Further use on the sending side throws
+    // ERR_SOCKET_HANDLE_ADOPTED, as after adoption.
+    this.#handle = null;
+    return {
+      data: { handle },
+      deserializeInfo: 'net:_TransferredBoundSocket',
+    };
+  }
+
+  [kDeserialize](data) {
+    const handle = data?.handle;
+    if (handle == null || !(handle instanceof TCP)) {
+      throw new ERR_WORKER_HANDLE_NOT_TRANSFERABLE('net.BoundSocket');
+    }
+    // Re-derive the bound address from the transferred handle rather than
+    // trusting serialized state.
+    const err = handle.getsockname(this.#address);
+    if (err) {
+      handle.close();
+      throw new ERR_WORKER_HANDLE_NOT_TRANSFERABLE('net.BoundSocket');
+    }
+    this.#handle = handle;
+  }
+}
+
+// Deserialization target for a transferred BoundSocket: constructs an empty
+// shell without binding a new socket. Internal, not part of the public API.
+function _TransferredBoundSocket() {
+  return new BoundSocket(kBoundSocketDeserialize);
 }
+_TransferredBoundSocket.prototype = BoundSocket.prototype;
 
 function Socket(options) {
   if (!(this instanceof Socket)) return new Socket(options);
@@ -2937,6 +2999,7 @@ Server.prototype.unref = function() {
 module.exports = {
   _createServerHandle: createServerHandle,
   _normalizeArgs: normalizeArgs,
+  _TransferredBoundSocket,
   get BlockList() {
     BlockList ??= require('internal/blocklist').BlockList;
     return BlockList;
diff --git a/lib/path.js b/lib/path.js
index 63b037cddfb9..658b5d6901df 100644
--- a/lib/path.js
+++ b/lib/path.js
@@ -1262,8 +1262,7 @@ const posix = {
       }
 
       resolvedPath = `${path}/${resolvedPath}`;
-      resolvedAbsolute =
-        StringPrototypeCharCodeAt(path, 0) === CHAR_FORWARD_SLASH;
+      resolvedAbsolute = path[0] === '/';
     }
 
     if (!resolvedAbsolute) {
@@ -1296,10 +1295,8 @@ const posix = {
     if (path.length === 0)
       return '.';
 
-    const isAbsolute =
-      StringPrototypeCharCodeAt(path, 0) === CHAR_FORWARD_SLASH;
-    const trailingSeparator =
-      StringPrototypeCharCodeAt(path, path.length - 1) === CHAR_FORWARD_SLASH;
+    const isAbsolute = path[0] === '/';
+    const trailingSeparator = path[path.length - 1] === '/';
 
     // Normalize the path
     path = normalizeString(path, !isAbsolute, '/', isPosixPathSeparator);
@@ -1639,8 +1636,8 @@ const posix = {
 
     // Get non-dir info
     for (; i >= start; --i) {
-      const code = StringPrototypeCharCodeAt(path, i);
-      if (code === CHAR_FORWARD_SLASH) {
+      const char = path[i];
+      if (char === '/') {
         // If we reached a path separator that was not part of a set of path
         // separators at the end of the string, stop now
         if (!matchedSlash) {
@@ -1655,7 +1652,7 @@ const posix = {
         matchedSlash = false;
         end = i + 1;
       }
-      if (code === CHAR_DOT) {
+      if (char === '.') {
         // If this is our first dot, mark it as the start of our extension
         if (startDot === -1)
           startDot = i;
diff --git a/lib/perf_hooks.js b/lib/perf_hooks.js
index 18e979630e0e..5de247442b52 100644
--- a/lib/perf_hooks.js
+++ b/lib/perf_hooks.js
@@ -25,6 +25,8 @@ const {
 
 const {
   createHistogram,
+  createSlidingWindowHistogram,
+  importHistogram,
 } = require('internal/histogram');
 
 const monitorEventLoopDelay = require('internal/perf/event_loop_delay');
@@ -43,6 +45,8 @@ module.exports = {
   eventLoopUtilization,
   timerify,
   createHistogram,
+  createSlidingWindowHistogram,
+  importHistogram,
   performance,
 };
 
diff --git a/lib/trace_events.js b/lib/trace_events.js
index b4b9be242737..c3645de66982 100644
--- a/lib/trace_events.js
+++ b/lib/trace_events.js
@@ -15,10 +15,14 @@ const {
 } = require('internal/errors').codes;
 
 const { ownsProcessState } = require('internal/worker');
-if (!hasTracing || !ownsProcessState)
+const {
+  CategorySet,
+  getEnabledCategories,
+  hasAgent,
+} = internalBinding('trace_events');
+if (!hasTracing || !ownsProcessState || !hasAgent())
   throw new ERR_TRACE_EVENTS_UNAVAILABLE();
 
-const { CategorySet, getEnabledCategories } = internalBinding('trace_events');
 const { customInspectSymbol } = require('internal/util');
 const { format } = require('internal/util/inspect');
 const {
diff --git a/lib/util.js b/lib/util.js
index e5a3aea4a9e1..622a3f239f3a 100644
--- a/lib/util.js
+++ b/lib/util.js
@@ -587,6 +587,13 @@ function deprecate(fn, msg, code, { modifyPrototype } = {}) {
   return internalDeprecate(fn, msg, code, undefined, modifyPrototype);
 }
 
+function markPromiseAsHandled(promise) {
+  if (!types.isPromise(promise)) {
+    throw new ERR_INVALID_ARG_TYPE('promise', 'Promise', promise);
+  }
+  binding.markPromiseAsHandled(promise);
+}
+
 // Keep the `exports =` so that various functions can still be monkeypatched
 module.exports = {
   _errnoException,
@@ -617,6 +624,7 @@ module.exports = {
     }
     return internalDeepEqual(a, b, skipPrototype);
   },
+  markPromiseAsHandled,
   promisify,
   stripVTControlCharacters,
   toUSVString(input) {
@@ -659,6 +667,21 @@ defineLazyProperties(
   ['diff'],
 );
 
+ObjectDefineProperties(module.exports, {
+  debounce: {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get() { return require('internal/util/debounce'); },
+  },
+  throttle: {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get() { return require('internal/util/throttle'); },
+  },
+});
+
 defineLazyProperties(
   module.exports,
   'internal/util/trace_sigint',
diff --git a/lib/zlib.js b/lib/zlib.js
index e6c5c420d551..9f69809cda4d 100644
--- a/lib/zlib.js
+++ b/lib/zlib.js
@@ -190,9 +190,14 @@ function zlibOnError(message, errno, code) {
   // There is no way to cleanly recover.
   // Continuing only obscures problems.
 
-  const error = genericNodeError(message, { errno, code });
-  error.errno = errno;
-  error.code = code;
+  let error;
+  if (code === 'ERR_TRAILING_JUNK_AFTER_STREAM_END') {
+    error = new ERR_TRAILING_JUNK_AFTER_STREAM_END();
+  } else {
+    error = genericNodeError(message, { errno, code });
+    error.errno = errno;
+    error.code = code;
+  }
   self.destroy(error);
   self[kError] = error;
 }
@@ -932,7 +937,11 @@ class Zstd extends ZlibBase {
       if (isAnyArrayBuffer(dictionary)) {
         dictionary = new Uint8Array(dictionary);
       } else {
-        dictionary = undefined;
+        throw new ERR_INVALID_ARG_TYPE(
+          'options.dictionary',
+          ['Buffer', 'TypedArray', 'DataView', 'ArrayBuffer'],
+          dictionary,
+        );
       }
     }
 
@@ -949,6 +958,7 @@ class Zstd extends ZlibBase {
       writeState,
       processCallback,
       dictionary,
+      opts?.rejectGarbageAfterEnd === true,
     );
 
     super(opts, mode, handle, zstdDefaultOpts);
diff --git a/node.gni b/node.gni
index 41f200189a34..28ef444b72c1 100644
--- a/node.gni
+++ b/node.gni
@@ -74,5 +74,19 @@ declare_args() {
   node_use_amaro = true
 }
 
+# Link against shared copies of the bundled dependencies instead of building
+# them, like configure's --shared-* options. The libraries are looked up with
+# pkg-config, so these are meant for Linux distribution builds.
+declare_args() {
+  node_shared_brotli = false
+  node_shared_cares = false
+  node_shared_hdr_histogram = false
+  node_shared_http_parser = false
+  node_shared_libuv = false
+  node_shared_nghttp2 = false
+  node_shared_sqlite = false
+  node_shared_zstd = false
+}
+
 assert(!node_enable_inspector || node_use_openssl,
        "node_enable_inspector requires node_use_openssl")
diff --git a/node.gyp b/node.gyp
index 988838e85858..62c748b130c7 100644
--- a/node.gyp
+++ b/node.gyp
@@ -397,25 +397,26 @@
       'src/crypto/crypto_kem.cc',
       'src/crypto/crypto_hmac.cc',
       'src/crypto/crypto_kmac.cc',
+      'src/crypto/crypto_mac.cc',
       'src/crypto/crypto_turboshake.cc',
       'src/crypto/crypto_random.cc',
       'src/crypto/crypto_rsa.cc',
       'src/crypto/crypto_spkac.cc',
       'src/crypto/crypto_util.cc',
-      'src/crypto/crypto_clienthello.cc',
       'src/crypto/crypto_dh.cc',
       'src/crypto/crypto_hash.cc',
       'src/crypto/crypto_keys.cc',
       'src/crypto/crypto_keygen.cc',
+      'src/crypto/crypto_pkcs12.cc',
       'src/crypto/crypto_scrypt.cc',
       'src/crypto/crypto_tls.cc',
       'src/crypto/crypto_x509.cc',
       'src/crypto/crypto_argon2.h',
       'src/crypto/crypto_bio.h',
-      'src/crypto/crypto_clienthello-inl.h',
       'src/crypto/crypto_dh.h',
       'src/crypto/crypto_hmac.h',
       'src/crypto/crypto_kmac.h',
+      'src/crypto/crypto_mac.h',
       'src/crypto/crypto_turboshake.h',
       'src/crypto/crypto_rsa.h',
       'src/crypto/crypto_spkac.h',
@@ -426,9 +427,9 @@
       'src/crypto/crypto_hash.h',
       'src/crypto/crypto_keys.h',
       'src/crypto/crypto_keygen.h',
+      'src/crypto/crypto_pkcs12.h',
       'src/crypto/crypto_scrypt.h',
       'src/crypto/crypto_tls.h',
-      'src/crypto/crypto_clienthello.h',
       'src/crypto/crypto_context.h',
       'src/crypto/crypto_ec.h',
       'src/crypto/crypto_pqc.h',
@@ -442,7 +443,6 @@
       'src/node_crypto.h',
     ],
     'node_cctest_openssl_sources': [
-      'test/cctest/test_crypto_clienthello.cc',
       'test/cctest/test_node_crypto.cc',
       'test/cctest/test_node_crypto_env.cc',
     ],
@@ -1213,54 +1213,6 @@
         }],
       ],
     }, # fuzz_env
-    { # fuzz_ClientHelloParser.cc
-      'target_name': 'fuzz_ClientHelloParser',
-      'type': 'executable',
-      'dependencies': [
-        '<(node_lib_target_name)',
-      ],
-      'includes': [
-        'node.gypi'
-      ],
-      'include_dirs': [
-        'src',
-        'tools/msvs/genfiles',
-        'deps/v8/include',
-        'deps/cares/include',
-        'deps/uv/include',
-        'test/cctest',
-      ],
-      'defines': [
-        'NODE_ARCH="<(target_arch)"',
-        'NODE_PLATFORM="<(OS)"',
-        'NODE_WANT_INTERNALS=1',
-      ],
-      'sources': [
-        'test/fuzzers/fuzz_ClientHelloParser.cc',
-      ],
-      'conditions': [
-        [ 'node_shared_hdr_histogram=="false"', {
-          'dependencies': [
-            'deps/histogram/histogram.gyp:histogram',
-          ],
-        }],
-        [ 'node_shared_uvwasi=="false"', {
-          'dependencies': [ 'deps/uvwasi/uvwasi.gyp:uvwasi' ],
-          'include_dirs': [ 'deps/uvwasi/include' ],
-        }],
-        ['OS=="linux" or OS=="openharmony"', {
-          'ldflags': [ '-fsanitize=fuzzer' ]
-        }],
-        # Ensure that ossfuzz flag has been set and that we are on Linux
-        [ 'OS not in "linux openharmony" or ossfuzz!="true"', {
-          'type': 'none',
-        }],
-        # Avoid excessive LTO
-        ['enable_lto=="true"', {
-          'ldflags': [ '-fno-lto' ],
-        }],
-      ],
-    }, # fuzz_ClientHelloParser.cc
     { # fuzz_strings
       'target_name': 'fuzz_strings',
       'type': 'executable',
diff --git a/src/api/embed_helpers.cc b/src/api/embed_helpers.cc
index c1bcb3948c4c..051110c9c6e9 100644
--- a/src/api/embed_helpers.cc
+++ b/src/api/embed_helpers.cc
@@ -117,8 +117,6 @@ CommonEnvironmentSetup::CommonEnvironmentSetup(
   Isolate::CreateParams params;
   params.array_buffer_allocator = impl_->allocator.get();
   params.external_references = external_references.data();
-  params.cpp_heap =
-      v8::CppHeap::Create(platform, v8::CppHeapCreateParams{{}}).release();
 
   Isolate* isolate;
 
@@ -130,6 +128,8 @@ CommonEnvironmentSetup::CommonEnvironmentSetup(
     // isolate, so that the memory reducer can be initialized.
     isolate = impl_->isolate = Isolate::Allocate(GetOrCreateIsolateGroup());
     platform->RegisterIsolate(isolate, loop);
+    params.cpp_heap =
+        v8::CppHeap::Create(platform, v8::CppHeapCreateParams{{}}).release();
 
     impl_->snapshot_creator.emplace(isolate, params);
     isolate->SetCaptureStackTraceForUncaughtExceptions(
diff --git a/src/api/environment.cc b/src/api/environment.cc
index 4969c908c487..4debed160e1a 100644
--- a/src/api/environment.cc
+++ b/src/api/environment.cc
@@ -227,7 +227,8 @@ void SetIsolateCreateParamsForNode(Isolate::CreateParams* params) {
 #endif
 }
 
-void SetIsolateErrorHandlers(v8::Isolate* isolate, const IsolateSettings& s) {
+static void SetIsolateErrorHandlers(v8::Isolate* isolate,
+                                    const IsolateSettings& s) {
   if (s.flags & MESSAGE_LISTENER_WITH_ERROR_LEVEL)
     isolate->AddMessageListenerWithErrorLevel(
             errors::PerIsolateMessageListener,
@@ -313,6 +314,34 @@ IsolateGroup GetOrCreateIsolateGroup() {
   return IsolateGroup::GetDefault();
 }
 
+// V8 shares the read-only heap between isolates and requires them all to be
+// created from the same snapshot, so every isolate gets the blob and external
+// references the first NewIsolate() call used. ~SnapshotData() leaves that blob
+// alone because its owner may be gone before the last isolate is created.
+static Mutex first_snapshot_mutex;
+static bool first_snapshot_recorded = false;
+static v8::StartupData first_snapshot_blob{nullptr, 0};
+static const intptr_t* first_external_references = nullptr;
+
+static void UseFirstSnapshot(Isolate::CreateParams* params) {
+  Mutex::ScopedLock lock(first_snapshot_mutex);
+  if (!first_snapshot_recorded) {
+    first_snapshot_recorded = true;
+    if (params->snapshot_blob != nullptr) {
+      first_snapshot_blob = *params->snapshot_blob;
+    }
+    first_external_references = params->external_references;
+  }
+  params->snapshot_blob =
+      first_snapshot_blob.data != nullptr ? &first_snapshot_blob : nullptr;
+  params->external_references = first_external_references;
+}
+
+bool IsFirstSnapshotBlob(const char* data) {
+  Mutex::ScopedLock lock(first_snapshot_mutex);
+  return first_snapshot_recorded && data == first_snapshot_blob.data;
+}
+
 // TODO(joyeecheung): we may want to expose this, but then we need to be
 // careful about what we override in the params.
 Isolate* NewIsolate(Isolate::CreateParams* params,
@@ -328,15 +357,7 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
     SnapshotBuilder::InitializeIsolateParams(snapshot_data, params);
   }
 
-  {
-    // Because it uses a shared readonly-heap, V8 requires all snapshots used
-    // for creating Isolates to be identical. This isn't really memory-safe
-    // but also otherwise just doesn't work, and the only real alternative
-    // is disabling shared-readonly-heap mode altogether.
-    static Isolate::CreateParams first_params = *params;
-    params->snapshot_blob = first_params.snapshot_blob;
-    params->external_references = first_params.external_references;
-  }
+  UseFirstSnapshot(params);
 
   // Register the isolate on the platform before the isolate gets initialized,
   // so that the isolate can access the platform during initialization.
@@ -352,16 +373,7 @@ Isolate* NewIsolate(Isolate::CreateParams* params,
 
   SetIsolateCreateParamsForNode(params);
   Isolate::Initialize(isolate, *params);
-
-  Isolate::Scope isolate_scope(isolate);
-
-  if (snapshot_data == nullptr) {
-    // If in deserialize mode, delay until after the deserialization is
-    // complete.
-    SetIsolateUpForNode(isolate, settings);
-  } else {
-    SetIsolateMiscHandlers(isolate, settings);
-  }
+  SetIsolateUpForNode(isolate, settings);
 
   return isolate;
 }
@@ -401,7 +413,11 @@ IsolateData* CreateIsolateData(
     ArrayBufferAllocator* allocator,
     const EmbedderSnapshotData* embedder_snapshot_data) {
   return IsolateData::CreateIsolateData(
-      isolate, loop, platform, allocator, embedder_snapshot_data);
+      isolate,
+      loop,
+      platform,
+      allocator,
+      SnapshotData::FromEmbedderWrapper(embedder_snapshot_data));
 }
 
 void FreeIsolateData(IsolateData* isolate_data) {
@@ -489,7 +505,6 @@ Environment* CreateEnvironment(
       FreeEnvironment(env);
       return nullptr;
     }
-    SetIsolateErrorHandlers(isolate, {});
   }
 
   Context::Scope context_scope(context);
@@ -519,6 +534,9 @@ void FreeEnvironment(Environment* env) {
   Isolate* isolate = env->isolate();
   Isolate::DisallowJavascriptExecutionScope disallow_js(isolate,
       Isolate::DisallowJavascriptExecutionScope::THROW_ON_FAILURE);
+  // A termination requested by Stop() targets this Environment; if no JS ran
+  // since, it is still pending and must not hit the isolate's next user.
+  isolate->CancelTerminateExecution();
   {
     HandleScope handle_scope(isolate);  // For env->context().
     Context::Scope context_scope(env->context());
diff --git a/src/api/exceptions.cc b/src/api/exceptions.cc
index 871fe78de951..4396dc19d842 100644
--- a/src/api/exceptions.cc
+++ b/src/api/exceptions.cc
@@ -8,6 +8,8 @@
 #include "v8.h"
 
 #include <cstring>
+#include <string>
+#include <string_view>
 
 namespace node {
 
@@ -20,6 +22,40 @@ using v8::Object;
 using v8::String;
 using v8::Value;
 
+static Local<String> StringFromPath(Isolate* isolate, std::string_view path) {
+#ifdef _WIN32
+  constexpr std::string_view kUncPrefix = "\\\\?\\UNC\\";
+  constexpr std::string_view kLongPrefix = "\\\\?\\";
+
+  if (path.starts_with(kUncPrefix)) {
+    std::string s;
+    s.reserve(2 + (path.size() - kUncPrefix.size()));
+    s.append("\\\\");
+    s.append(path.substr(kUncPrefix.size()));
+    return String::NewFromUtf8(isolate,
+                               s.data(),
+                               v8::NewStringType::kNormal,
+                               static_cast<int>(s.size()))
+        .ToLocalChecked();
+  }
+
+  if (path.starts_with(kLongPrefix)) {
+    auto rest = path.substr(kLongPrefix.size());
+    return String::NewFromUtf8(isolate,
+                               rest.data(),
+                               v8::NewStringType::kNormal,
+                               static_cast<int>(rest.size()))
+        .ToLocalChecked();
+  }
+#endif
+
+  return String::NewFromUtf8(isolate,
+                             path.data(),
+                             v8::NewStringType::kNormal,
+                             static_cast<int>(path.size()))
+      .ToLocalChecked();
+}
+
 Local<Value> ErrnoException(Isolate* isolate,
                             int errorno,
                             const char* syscall,
@@ -42,7 +78,7 @@ Local<Value> ErrnoException(Isolate* isolate,
   Local<String> path_string;
   if (path != nullptr) {
     // FIXME(bnoordhuis) It's questionable to interpret the file path as UTF-8.
-    path_string = String::NewFromUtf8(isolate, path).ToLocalChecked();
+    path_string = StringFromPath(isolate, std::string_view(path));
   }
 
   if (path_string.IsEmpty() == false) {
@@ -72,22 +108,6 @@ Local<Value> ErrnoException(Isolate* isolate,
   return e;
 }
 
-static Local<String> StringFromPath(Isolate* isolate, const char* path) {
-#ifdef _WIN32
-  if (strncmp(path, "\\\\?\\UNC\\", 8) == 0) {
-    return String::Concat(
-        isolate,
-        FIXED_ONE_BYTE_STRING(isolate, "\\\\"),
-        String::NewFromUtf8(isolate, path + 8).ToLocalChecked());
-  } else if (strncmp(path, "\\\\?\\", 4) == 0) {
-    return String::NewFromUtf8(isolate, path + 4).ToLocalChecked();
-  }
-#endif
-
-  return String::NewFromUtf8(isolate, path).ToLocalChecked();
-}
-
-
 Local<Value> UVException(Isolate* isolate,
                          int errorno,
                          const char* syscall,
@@ -114,7 +134,7 @@ Local<Value> UVException(Isolate* isolate,
   js_msg = String::Concat(isolate, js_msg, js_syscall);
 
   if (path != nullptr) {
-    js_path = StringFromPath(isolate, path);
+    js_path = StringFromPath(isolate, std::string_view(path));
 
     js_msg =
         String::Concat(isolate, js_msg, FIXED_ONE_BYTE_STRING(isolate, " '"));
@@ -124,7 +144,7 @@ Local<Value> UVException(Isolate* isolate,
   }
 
   if (dest != nullptr) {
-    js_dest = StringFromPath(isolate, dest);
+    js_dest = StringFromPath(isolate, std::string_view(dest));
 
     js_msg = String::Concat(
         isolate, js_msg, FIXED_ONE_BYTE_STRING(isolate, " -> '"));
diff --git a/src/api/hooks.cc b/src/api/hooks.cc
index 86132d5eec29..3213a30a7bc7 100644
--- a/src/api/hooks.cc
+++ b/src/api/hooks.cc
@@ -127,20 +127,78 @@ struct ACHHandle final {
 // this.
 void DeleteACHHandle::operator ()(ACHHandle* handle) const { delete handle; }
 
+// TODO(addaleax): Having this extra set of data structures is far from
+// ideal, but unfortunately the public synchronous cleanup hook API was
+// slightly mis-designed; in particular, RemoveEnvironmentCleanupHook() needs
+// to keep working when the Isolate either has no active context (such as
+// during GC) or that context is associated with another Node.js Environment.
+// We should align this with the asynchronous API, which handles this properly
+// through an explicit reference to the cleanup hook instead of requiring
+// lookups in internal maps.
+struct CleanupHookThunk final {
+  Isolate* isolate;
+  Environment* env;
+  CleanupHook fun;
+  void* arg;
+
+  bool operator==(const CleanupHookThunk& other) const {
+    // `env` is intentionally not part of this comparison
+    return isolate == other.isolate && fun == other.fun && arg == other.arg;
+  }
+};
+struct CleanupHookThunkHash {
+  size_t operator()(const CleanupHookThunk& thunk) const {
+    return std::hash<void*>()(thunk.arg);
+  }
+};
+using CleanupHookRegistry =
+    std::unordered_set<CleanupHookThunk, CleanupHookThunkHash>;
+static ExclusiveAccess<CleanupHookRegistry> cleanup_hook_registry;
+
+static void CleanupHookThunkRun(void* arg) {
+  const CleanupHookThunk* thunk = static_cast<CleanupHookThunk*>(arg);
+  // `thunk->fun` may itself remove and free this CleanupHookThunk (e.g. via
+  // ~ObjectWrap(), which calls RemoveEnvironmentCleanupHook()), so cache the
+  // fields we still need before invoking it rather than reading them from
+  // `thunk` afterwards.
+  Isolate* isolate = thunk->isolate;
+  CleanupHook fun = thunk->fun;
+  void* fun_arg = thunk->arg;
+  fun(fun_arg);
+  RemoveEnvironmentCleanupHook(isolate, fun, fun_arg);
+}
+
 void AddEnvironmentCleanupHook(Isolate* isolate,
                                CleanupHook fun,
                                void* arg) {
   Environment* env = Environment::GetCurrent(isolate);
   CHECK_NOT_NULL(env);
-  env->AddCleanupHook(fun, arg);
+  void* wrapped_arg;
+  {
+    ExclusiveAccess<CleanupHookRegistry>::Scoped registry(
+        &cleanup_hook_registry);
+    auto result = registry->insert({isolate, env, fun, arg});
+    CHECK(result.second);
+    wrapped_arg = const_cast<CleanupHookThunk*>(&*result.first);
+  }
+  env->AddCleanupHook(CleanupHookThunkRun, wrapped_arg);
 }
 
 void RemoveEnvironmentCleanupHook(Isolate* isolate,
                                   CleanupHook fun,
                                   void* arg) {
-  Environment* env = Environment::GetCurrent(isolate);
-  CHECK_NOT_NULL(env);
-  env->RemoveCleanupHook(fun, arg);
+  CleanupHookThunk thunk;
+  void* wrapped_arg;
+  {
+    ExclusiveAccess<CleanupHookRegistry>::Scoped registry(
+        &cleanup_hook_registry);
+    auto result = registry->find({isolate, nullptr, fun, arg});
+    if (result == registry->end()) return;
+    wrapped_arg = const_cast<CleanupHookThunk*>(&*result);
+    thunk = *result;
+    registry->erase(result);
+  }
+  thunk.env->RemoveCleanupHook(CleanupHookThunkRun, wrapped_arg);
 }
 
 static void FinishAsyncCleanupHook(void* arg) {
diff --git a/src/base_object_types.h b/src/base_object_types.h
index cd1a06e41a30..1a63e1da1e84 100644
--- a/src/base_object_types.h
+++ b/src/base_object_types.h
@@ -24,7 +24,8 @@ namespace node {
 #define UNSERIALIZABLE_BINDING_TYPES(V)                                        \
   V(http2_binding_data, http2::BindingData)                                    \
   V(http_parser_binding_data, http_parser::BindingData)                        \
-  V(quic_binding_data, quic::BindingData)
+  V(quic_binding_data, quic::BindingData)                                      \
+  V(sqlite_binding_data, sqlite::BindingData)
 
 // List of (non-binding) BaseObjects that are serializable in the snapshot.
 // The first argument should match what the type passes to
diff --git a/src/cppgc_helpers-inl.h b/src/cppgc_helpers-inl.h
index 745ecab746f7..f81dfb9bf60d 100644
--- a/src/cppgc_helpers-inl.h
+++ b/src/cppgc_helpers-inl.h
@@ -11,7 +11,6 @@ namespace node {
 template <typename T>
 void CppgcMixin::Wrap(T* ptr, Realm* realm, v8::Local<v8::Object> obj) {
   CHECK_GE(obj->InternalFieldCount(), T::kInternalFieldCount);
-  ptr->realm_ = realm;
   v8::Isolate* isolate = realm->isolate();
   ptr->traced_reference_ = v8::TracedReference<v8::Object>(isolate, obj);
   // Note that ptr must be of concrete type T in Wrap.
@@ -20,7 +19,7 @@ void CppgcMixin::Wrap(T* ptr, Realm* realm, v8::Local<v8::Object> obj) {
   obj->SetAlignedPointerInInternalField(
       kEmbedderType, realm->isolate_data()->embedder_id_for_cppgc());
   obj->SetAlignedPointerInInternalField(kSlot, ptr);
-  realm->TrackCppgcWrapper(ptr);
+  ptr->list_node_ = realm->TrackCppgcWrapper(ptr);
 }
 
 template <typename T>
@@ -45,17 +44,26 @@ T* CppgcMixin::Unwrap(v8::Local<v8::Object> obj) {
 }
 
 v8::Local<v8::Object> CppgcMixin::object() const {
-  return traced_reference_.Get(realm_->isolate());
+  return traced_reference_.Get(realm()->isolate());
 }
 
 Environment* CppgcMixin::env() const {
-  return realm_->env();
+  return realm()->env();
+}
+
+Realm* CppgcMixin::realm() const {
+  return list_node_ == nullptr ? nullptr : list_node_->realm;
+}
+
+void CppgcMixin::Finalize() {
+  Realm* current_realm = realm();
+  if (current_realm == nullptr) return;
+  this->Clean(current_realm);
+  list_node_->realm = nullptr;
 }
 
 CppgcMixin::~CppgcMixin() {
-  if (realm_ != nullptr) {
-    realm_->set_should_purge_empty_cppgc_wrappers(true);
-  }
+  delete list_node_;
 }
 
 }  // namespace node
diff --git a/src/cppgc_helpers.cc b/src/cppgc_helpers.cc
index 7c557a822d20..9424904c0ea8 100644
--- a/src/cppgc_helpers.cc
+++ b/src/cppgc_helpers.cc
@@ -1,14 +1,14 @@
-#include "cppgc_helpers.h"
-#include "env-inl.h"
+#include "cppgc_helpers.h"  // NOLINT(build/include_inline)
+#include "cppgc_helpers-inl.h"
 
 namespace node {
 
 void CppgcWrapperList::Cleanup() {
-  for (auto node : *this) {
-    CppgcMixin* ptr = node->persistent.Get();
-    if (ptr != nullptr) {
-      ptr->Finalize();
-    }
+  while (!IsEmpty()) {
+    CppgcWrapperListNode* node = PopFront();
+    CppgcMixin* wrapper = node->persistent.Get();
+    if (wrapper != nullptr) wrapper->Finalize();
+    node->realm = nullptr;
   }
 }
 
@@ -23,18 +23,4 @@ void CppgcWrapperList::MemoryInfo(MemoryTracker* tracker) const {
     }
   }
 }
-
-void CppgcWrapperList::PurgeEmpty() {
-  for (auto weak_it = begin(); weak_it != end();) {
-    CppgcWrapperListNode* node = *weak_it;
-    auto next_it = ++weak_it;
-    // The underlying cppgc wrapper has already been garbage collected.
-    // Remove it from the list.
-    if (!node->persistent) {
-      node->persistent.Clear();
-      delete node;
-    }
-    weak_it = next_it;
-  }
-}
 }  // namespace node
diff --git a/src/cppgc_helpers.h b/src/cppgc_helpers.h
index fb2af584a4ae..df6b4836c676 100644
--- a/src/cppgc_helpers.h
+++ b/src/cppgc_helpers.h
@@ -47,9 +47,9 @@ class CppgcWrapperListNode;
  * cleanup relies on a living Node.js `Realm`, it should implement a
  * pattern like this:
  *
- *   ~MyWrap() { this->Destroy(); }
+ *   ~MyWrap() { this->Finalize(); }
  *   void Clean(Realm* env) override {
- *     // Do cleanup that relies on a living Environemnt.
+ *     // Do cleanup that relies on a living Realm.
  *   }
  */
 class CppgcMixin : public cppgc::GarbageCollectedMixin, public MemoryRetainer {
@@ -68,7 +68,7 @@ class CppgcMixin : public cppgc::GarbageCollectedMixin, public MemoryRetainer {
 
   inline v8::Local<v8::Object> object() const;
   inline Environment* env() const;
-  inline Realm* realm() const { return realm_; }
+  inline Realm* realm() const;
   inline v8::Local<v8::Object> object(v8::Isolate* isolate) const {
     return traced_reference_.Get(isolate);
   }
@@ -95,11 +95,7 @@ class CppgcMixin : public cppgc::GarbageCollectedMixin, public MemoryRetainer {
   // destructor. Outside of Finalize(), subclasses should avoid calling
   // into JavaScript or perform any operation that can trigger garbage
   // collection during the destruction.
-  void Finalize() {
-    if (realm_ == nullptr) return;
-    this->Clean(realm_);
-    realm_ = nullptr;
-  }
+  inline void Finalize();
 
   // The default implementation of Clean() is a no-op. If subclasses wish
   // to perform cleanup that require a living Realm, they should
@@ -110,10 +106,8 @@ class CppgcMixin : public cppgc::GarbageCollectedMixin, public MemoryRetainer {
 
   inline ~CppgcMixin();
 
-  friend class CppgcWrapperListNode;
-
  private:
-  Realm* realm_ = nullptr;
+  CppgcWrapperListNode* list_node_ = nullptr;
   v8::TracedReference<v8::Object> traced_reference_;
 };
 
diff --git a/src/crypto/README.md b/src/crypto/README.md
index 0c5f90b6f752..e4988647a557 100644
--- a/src/crypto/README.md
+++ b/src/crypto/README.md
@@ -30,68 +30,66 @@ throughout the rest of the code.
 The rest of the files are structured by their function, as detailed in the
 following table:
 
-| File (\*.h/\*.cc)    | Description                                                                |
-| -------------------- | -------------------------------------------------------------------------- |
-| `crypto_aes`         | AES Cipher support.                                                        |
-| `crypto_argon2`      | Argon2 key / bit generation implementation.                                |
-| `crypto_cipher`      | General Encryption/Decryption utilities.                                   |
-| `crypto_clienthello` | TLS/SSL client hello parser implementation. Used during SSL/TLS handshake. |
-| `crypto_context`     | Implementation of the `SecureContext` object.                              |
-| `crypto_dh`          | Diffie-Hellman Key Agreement implementation.                               |
-| `crypto_dsa`         | DSA (Digital Signature) Key Generation functions.                          |
-| `crypto_ec`          | Elliptic-curve cryptography implementation.                                |
-| `crypto_hash`        | Basic hash (e.g. SHA-256) functions.                                       |
-| `crypto_hkdf`        | HKDF (Key derivation) implementation.                                      |
-| `crypto_hmac`        | HMAC implementations.                                                      |
-| `crypto_keys`        | Utilities for using and generating secret, private, and public keys.       |
-| `crypto_pbkdf2`      | PBKDF2 key / bit generation implementation.                                |
-| `crypto_rsa`         | RSA Key Generation functions.                                              |
-| `crypto_scrypt`      | Scrypt key / bit generation implementation.                                |
-| `crypto_sig`         | General digital signature and verification utilities.                      |
-| `crypto_spkac`       | Netscape SPKAC certificate utilities.                                      |
-| `crypto_ssl`         | Implementation of the `SSLWrap` object.                                    |
-| `crypto_timing`      | Implementation of the TimingSafeEqual.                                     |
+| File (\*.h/\*.cc) | Description                                                          |
+| ----------------- | -------------------------------------------------------------------- |
+| `crypto_aes`      | AES Cipher support.                                                  |
+| `crypto_argon2`   | Argon2 key / bit generation implementation.                          |
+| `crypto_cipher`   | General Encryption/Decryption utilities.                             |
+| `crypto_context`  | Implementation of the `SecureContext` object.                        |
+| `crypto_dh`       | Diffie-Hellman Key Agreement implementation.                         |
+| `crypto_dsa`      | DSA (Digital Signature) Key Generation functions.                    |
+| `crypto_ec`       | Elliptic-curve cryptography implementation.                          |
+| `crypto_hash`     | Basic hash (e.g. SHA-256) functions.                                 |
+| `crypto_hkdf`     | HKDF (Key derivation) implementation.                                |
+| `crypto_hmac`     | HMAC implementations.                                                |
+| `crypto_keygen`   | Secret and asymmetric key generation jobs.                           |
+| `crypto_keys`     | Utilities for using and generating secret, private, and public keys. |
+| `crypto_mac`      | Provider-generic MAC implementations.                                |
+| `crypto_pbkdf2`   | PBKDF2 key / bit generation implementation.                          |
+| `crypto_pqc`      | Post-quantum algorithm enumeration.                                  |
+| `crypto_rsa`      | RSA Key Generation functions.                                        |
+| `crypto_scrypt`   | Scrypt key / bit generation implementation.                          |
+| `crypto_sig`      | General digital signature and verification utilities.                |
+| `crypto_spkac`    | Netscape SPKAC certificate utilities.                                |
+| `crypto_ssl`      | Implementation of the `SSLWrap` object.                              |
+| `crypto_timing`   | Implementation of the TimingSafeEqual.                               |
+| `crypto_x509`     | X.509 certificate parsing and validation.                            |
 
 When new crypto protocols are added, they will be added into their own
 `crypto_` `*.h` and `*.cc` files.
 
 ## Helpful concepts
 
-Node.js currently uses OpenSSL to provide it's crypto substructure.
+Node.js currently uses OpenSSL to provide its crypto substructure.
 (Some custom Node.js distributions -- such as Electron -- use BoringSSL
 instead.)
 
 This section aims to explain some of the utilities that have been
 provided to make working with the OpenSSL APIs a bit easier.
 
+### The ncrypto boundary
+
+[`deps/ncrypto`](../../deps/ncrypto) provides the OpenSSL and BoringSSL
+wrappers used by this subsystem. Put backend adaptation, algorithm metadata,
+and reusable cryptographic operations there. Keep JavaScript argument
+validation, public API policy and errors, V8 objects, and crypto job integration
+in `src/crypto` and `lib/internal/crypto`.
+
+For provider operations, query the supported algorithms and parameters through
+ncrypto. Version guards are still needed when a C API is unavailable in older
+headers or when handling a known version-specific behavior.
+
 ### Pointer types
 
-Most of the key OpenSSL types need to be explicitly freed when they are
-no longer needed. Failure to do so introduces memory leaks. To make this
-easier (and less error prone), the `crypto_util.h` defines a number of
-smart-pointer aliases that should be used:
-
-```cpp
-using X509Pointer = DeleteFnPtr<X509, X509_free>;
-using BIOPointer = DeleteFnPtr<BIO, BIO_free_all>;
-using SSLCtxPointer = DeleteFnPtr<SSL_CTX, SSL_CTX_free>;
-using SSLSessionPointer = DeleteFnPtr<SSL_SESSION, SSL_SESSION_free>;
-using SSLPointer = DeleteFnPtr<SSL, SSL_free>;
-using PKCS8Pointer = DeleteFnPtr<PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free>;
-using EVPKeyPointer = DeleteFnPtr<EVP_PKEY, EVP_PKEY_free>;
-using EVPKeyCtxPointer = DeleteFnPtr<EVP_PKEY_CTX, EVP_PKEY_CTX_free>;
-using EVPMDCtxPointer = DeleteFnPtr<EVP_MD_CTX, EVP_MD_CTX_free>;
-using RSAPointer = DeleteFnPtr<RSA, RSA_free>;
-using ECPointer = DeleteFnPtr<EC_KEY, EC_KEY_free>;
-using BignumPointer = DeleteFnPtr<BIGNUM, BN_clear_free>;
-using NetscapeSPKIPointer = DeleteFnPtr<NETSCAPE_SPKI, NETSCAPE_SPKI_free>;
-using ECGroupPointer = DeleteFnPtr<EC_GROUP, EC_GROUP_free>;
-using ECPointPointer = DeleteFnPtr<EC_POINT, EC_POINT_free>;
-using ECKeyPointer = DeleteFnPtr<EC_KEY, EC_KEY_free>;
-using DHPointer = DeleteFnPtr<DH, DH_free>;
-using ECDSASigPointer = DeleteFnPtr<ECDSA_SIG, ECDSA_SIG_free>;
-using CipherCtxPointer = DeleteFnPtr<EVP_CIPHER_CTX, EVP_CIPHER_CTX_free>;
-```
+Most OpenSSL objects need to be explicitly freed when they are no longer
+needed. Use the ownership wrappers declared in
+[`ncrypto.h`](../../deps/ncrypto/ncrypto.h) to manage their lifetime.
+
+Some wrappers, such as `PKCS8Pointer`, are `DeleteFnPtr` aliases. Others,
+including `EVPKeyPointer`, `EVPKeyCtxPointer`, `EVPMDCtxPointer`, `BIOPointer`,
+`BignumPointer`, and `ECKeyPointer`, are dedicated classes that also provide
+operations on the wrapped state. Their representation can vary by backend;
+use their methods to keep that adaptation inside ncrypto.
 
 Examples of these being used are pervasive through the `src/crypto` code.
 
@@ -152,6 +150,70 @@ threadpool).
 Refer to `crypto_keys.h` and `crypto_keys.cc` for all code relating to the
 core key objects.
 
+#### Asymmetric key algorithms
+
+Use ncrypto's `KeyAlgorithm` descriptors to identify known algorithms in C++.
+They hold canonical algorithm names and metadata, with static lifetime, so
+callers can retain descriptor pointers across asynchronous jobs. For example,
+`KeyAlgorithm::RSA_PSS` names `RSA-PSS` and `KeyAlgorithm::ML_DSA_44` names
+`ML-DSA-44`.
+
+For an existing key, use `key.isA(KeyAlgorithm::RSA_PSS)` or another descriptor.
+On OpenSSL 3 and later this uses `EVP_PKEY_is_a()` to recognize provider aliases.
+Numeric key IDs are unsuitable for provider-only keys: OpenSSL can return `-1`
+for their ID. Numeric adapters for BoringSSL and legacy OpenSSL stay private to
+ncrypto.
+
+When a function needs algorithm metadata, use `key.getAlgorithm()`. It returns
+a pointer to a static descriptor, or `nullptr` for an empty key or an unrecognized
+algorithm. Reuse it for multiple checks within that function. Key-based helpers
+resolve the algorithm internally. Keep RSA distinct from RSA-PSS, and EC distinct
+from SM2.
+
+`key.rawSeed()` validates seed support and extracts the seed in one operation.
+Its result distinguishes an unsupported key type from an unavailable seed.
+OKP and AKP JWKs share ncrypto's `key.exportRawJwk()` and
+`EVPKeyPointer::NewRawJwk()` operations. Export returns the recognized algorithm
+and public/private bytes, selecting seed versus raw private material internally.
+Import checks that public bytes match the supplied private material. Node.js
+handles the distinct JWK field names, input-name validation, base64url encoding,
+JavaScript objects, and errors. RSA and EC retain their component and coordinate
+representations; ncrypto handles prime-product validation and affine-coordinate
+extraction through `Rsa` and `Ec`.
+
+`Ec::GetCurveId()`, `GetKeyComponents()`, and the raw-export helpers read
+provider parameters directly where supported, with backend adaptation in
+ncrypto. Keep these operations on the `EVPKeyPointer` when an `ECKeyPointer`
+reconstruction is unnecessary.
+
+`key.getKeyTypeName()` returns the descriptor's lowercase public key-type name,
+or `nullptr` when the key has no recognized public type. For example, ML-DSA-44
+returns `ml-dsa-44`, while SM2 has no public key-type name. These names live in
+ncrypto alongside the algorithm metadata.
+
+For construction, use `EVPKeyCtxPointer::NewFromAlgorithm()` with a descriptor,
+or `NewFromName()` when a backend algorithm name is needed.
+`EVPKeyPointer::NewRawPublic()`, `NewRawPrivate()`, and `NewRawSeed()` take
+descriptors too. Use the key's capability helpers for raw formats and signature
+contexts; recognizing an algorithm does not establish support for an operation.
+
+`KeyAlgorithm::FromName()` looks up known canonical names case-insensitively
+using the same `CaseInsensitiveNameEqual` as the digest, cipher, and MAC caches.
+It does not resolve arbitrary provider aliases or establish availability.
+`isAvailable()` checks whether the backend can create a context for the algorithm.
+Public input validation remains specific to each API: PQC JWK `alg` values use
+exact canonical names such as `ML-DSA-44`, while raw imports require exact public
+`asymmetricKeyType` values such as `ml-dsa-44`.
+
+The internal JavaScript binding exposes `getPqcKeyTypes()` for the available
+known PQC algorithm names in their canonical spelling. Named key generation
+passes algorithm names to `NamedKeyPairGenJob`, which resolves the name to a static
+`KeyAlgorithm` descriptor. Asymmetric key IDs are not exposed to JavaScript.
+
+Real EC curve and ASN.1/OID NIDs still have their own uses. The EC generation
+path keeps Ed/X algorithm descriptors separate from curve NIDs while preserving
+the existing accepted curve-name aliases.
+
 #### `KeyObjectData`
 
 `KeyObjectData` is an internal thread-safe structure used to wrap either
@@ -172,19 +234,33 @@ JavaScript needs access to those operations and is kept out of user-visible
 
 A `KeyObject` is the public Node.js-specific API for keys. It extends a
 native `NativeKeyObject`, which stores `KeyObjectData` for structured
-cloning. The JavaScript API surface reads its key type and a
-`KeyObjectHandle` through a hidden native-backed slot tuple, caching that
-tuple in a private field outside user-visible own properties. Derived
-metadata, such as symmetric key size and asymmetric key details, is read
-from the cached handle and appended lazily to the same private-field cache.
+cloning. The JavaScript constructor caches the known key type in a private
+field outside user-visible own properties. When a `KeyObjectHandle` is first
+needed, JavaScript replaces that value with a hidden native-backed slot tuple.
+Derived metadata, such as symmetric key size and asymmetric key details, is
+read from the cached handle and appended lazily to the same private-field
+cache.
 
 #### `CryptoKey`
 
 A `CryptoKey` is the Web Crypto API key type. In the Node.js implementation,
 public `CryptoKey` instances are backed by a native `NativeCryptoKey`, not by
-a `KeyObject`. `NativeCryptoKey` stores the same `KeyObjectData`
+a `KeyObject`. `NativeCryptoKey` stores the same primary `KeyObjectData`
 representation as `KeyObject`, plus the Web Crypto internal slots
-(`[[extractable]]`, `[[algorithm]]`, and `[[usages]]`).
+(`[[extractable]]`, `[[algorithm]]`, and `[[usages]]`). Normal construction
+primes a private JavaScript slot cache from the constructor arguments.
+Partially initialized transferred keys populate that cache from the native
+slots on first access. For Hybrid KEM `CryptoKey` instances only,
+`NativeCryptoKey` may also store a secondary `KeyObjectData` and `seed_data`
+used to reconstruct the hybrid key material.
+
+### X.509 certificates
+
+The public `X509Certificate` is backed directly by the native
+`X509Certificate` object. JavaScript caches derived certificate properties in
+a private array whose final entry is a bitmask of populated slots. Certificates
+from another realm use the same cache layout through a private `WeakMap` after
+passing the native brand check.
 
 ### `CryptoJob`
 
@@ -311,9 +387,10 @@ They perform their actions immediately.
 
 ```js
 // Example synchronous single-call operation
+const { timingSafeEqual } = require('node:crypto');
 const a = new Uint8Array(10);
 const b = new Uint8Array(10);
-crypto.timingSafeEqual(a, b);
+timingSafeEqual(a, b);
 ```
 
 Asynchronous single-call operations generally perform a
@@ -322,8 +399,10 @@ defer the actual crypto-operation work to the libuv threadpool.
 
 ```js
 // Example asynchronous single-call operation
+const { randomFill } = require('node:crypto');
 const buf = new Uint8Array(10);
-crypto.randomFill(buf, (err, buf) => {
+randomFill(buf, (err, buf) => {
+  if (err) throw err;
   console.log(buf);
 });
 ```
@@ -338,12 +417,12 @@ all asynchronous single-call operations are Promise-based.
 // Example Web Crypto API asynchronous single-call operation
 const { subtle } = globalThis.crypto;
 
-subtle.generateKeys({ name: 'HMAC', length: 256 }, true, ['sign'])
+subtle.generateKey({ name: 'HMAC', hash: 'SHA-256', length: 256 }, true, ['sign'])
   .then((key) => {
     console.log(key);
   })
   .catch((error) => {
-    console.error('an error occurred');
+    console.error('an error occurred', error);
   });
 ```
 
@@ -357,12 +436,12 @@ can be performed over time.
 
 ```js
 // Example stream-oriented operation
-const hash = crypto.createHash('sha256');
-let updates = 10;
+const { createHash } = require('node:crypto');
+const hash = createHash('sha256');
 setTimeout(() => {
   hash.update('hello world');
   setTimeout(() => {
-    console.log(hash.digest();)
+    console.log(hash.digest());
   }, 1000);
 }, 1000);
 ```
diff --git a/src/crypto/crypto_aes.h b/src/crypto/crypto_aes.h
index 76359f14e7df..6b18b1e29e24 100644
--- a/src/crypto/crypto_aes.h
+++ b/src/crypto/crypto_aes.h
@@ -13,15 +13,15 @@ namespace node::crypto {
 constexpr unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
 
 #define VARIANTS_COMMON(V)                                                     \
-  V(CTR_128, AES_CTR_Cipher, ncrypto::Cipher::AES_128_CTR)                     \
-  V(CTR_192, AES_CTR_Cipher, ncrypto::Cipher::AES_192_CTR)                     \
-  V(CTR_256, AES_CTR_Cipher, ncrypto::Cipher::AES_256_CTR)                     \
-  V(CBC_128, AES_Cipher, ncrypto::Cipher::AES_128_CBC)                         \
-  V(CBC_192, AES_Cipher, ncrypto::Cipher::AES_192_CBC)                         \
-  V(CBC_256, AES_Cipher, ncrypto::Cipher::AES_256_CBC)                         \
-  V(GCM_128, AES_Cipher, ncrypto::Cipher::AES_128_GCM)                         \
-  V(GCM_192, AES_Cipher, ncrypto::Cipher::AES_192_GCM)                         \
-  V(GCM_256, AES_Cipher, ncrypto::Cipher::AES_256_GCM)                         \
+  V(CTR_128, AES_CTR_Cipher, ncrypto::Cipher::AES_128_CTR())                   \
+  V(CTR_192, AES_CTR_Cipher, ncrypto::Cipher::AES_192_CTR())                   \
+  V(CTR_256, AES_CTR_Cipher, ncrypto::Cipher::AES_256_CTR())                   \
+  V(CBC_128, AES_Cipher, ncrypto::Cipher::AES_128_CBC())                       \
+  V(CBC_192, AES_Cipher, ncrypto::Cipher::AES_192_CBC())                       \
+  V(CBC_256, AES_Cipher, ncrypto::Cipher::AES_256_CBC())                       \
+  V(GCM_128, AES_Cipher, ncrypto::Cipher::AES_128_GCM())                       \
+  V(GCM_192, AES_Cipher, ncrypto::Cipher::AES_192_GCM())                       \
+  V(GCM_256, AES_Cipher, ncrypto::Cipher::AES_256_GCM())                       \
   VARIANTS_KW(V)
 
 #ifdef OPENSSL_IS_BORINGSSL
@@ -33,16 +33,16 @@ constexpr unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
   V(KW_256, AES_KW_Cipher, static_cast<const EVP_CIPHER*>(nullptr))
 #else
 #define VARIANTS_KW(V)                                                         \
-  V(KW_128, AES_Cipher, ncrypto::Cipher::AES_128_KW)                           \
-  V(KW_192, AES_Cipher, ncrypto::Cipher::AES_192_KW)                           \
-  V(KW_256, AES_Cipher, ncrypto::Cipher::AES_256_KW)
+  V(KW_128, AES_Cipher, ncrypto::Cipher::AES_128_KW())                         \
+  V(KW_192, AES_Cipher, ncrypto::Cipher::AES_192_KW())                         \
+  V(KW_256, AES_Cipher, ncrypto::Cipher::AES_256_KW())
 #endif
 
 #if OPENSSL_WITH_AES_OCB
 #define VARIANTS_OCB(V)                                                        \
-  V(OCB_128, AES_Cipher, ncrypto::Cipher::AES_128_OCB)                         \
-  V(OCB_192, AES_Cipher, ncrypto::Cipher::AES_192_OCB)                         \
-  V(OCB_256, AES_Cipher, ncrypto::Cipher::AES_256_OCB)
+  V(OCB_128, AES_Cipher, ncrypto::Cipher::AES_128_OCB())                       \
+  V(OCB_192, AES_Cipher, ncrypto::Cipher::AES_192_OCB())                       \
+  V(OCB_256, AES_Cipher, ncrypto::Cipher::AES_256_OCB())
 #else
 #define VARIANTS_OCB(V)
 #endif
diff --git a/src/crypto/crypto_chacha20_poly1305.cc b/src/crypto/crypto_chacha20_poly1305.cc
index 1cdb933c65d4..56ba78be7ccd 100644
--- a/src/crypto/crypto_chacha20_poly1305.cc
+++ b/src/crypto/crypto_chacha20_poly1305.cc
@@ -105,7 +105,7 @@ Maybe<void> ChaCha20Poly1305CipherTraits::AdditionalConfig(
     ChaCha20Poly1305CipherConfig* params) {
   Environment* env = Environment::GetCurrent(args);
 
-  params->cipher = ncrypto::Cipher::CHACHA20_POLY1305;
+  params->cipher = ncrypto::Cipher::CHACHA20_POLY1305();
 
 #ifndef OPENSSL_IS_BORINGSSL
   // On BoringSSL, ChaCha20-Poly1305 is not exposed via the EVP_CIPHER registry
diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
index 0df4daa25023..5c5895bf6154 100644
--- a/src/crypto/crypto_cipher.cc
+++ b/src/crypto/crypto_cipher.cc
@@ -8,6 +8,10 @@
 #include "node_process-inl.h"
 #include "v8.h"
 
+#include <algorithm>
+#include <string>
+#include <vector>
+
 namespace node {
 
 using ncrypto::Cipher;
@@ -48,10 +52,10 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
   const auto cipher = ([&] {
     if (args[1]->IsString()) {
       Utf8Value name(env->isolate(), args[1]);
-      return Cipher::FromName(*name);
+      return Cipher::FromName(*name, env->provider_cipher_cache.get());
     } else {
       int nid = args[1].As<Int32>()->Value();
-      return Cipher::FromNid(nid);
+      return Cipher::FromNid(nid, env->provider_cipher_cache.get());
     }
   })();
 
@@ -93,8 +97,8 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
     if (args[3]->IsInt32()) {
       int check_len = args[3].As<Int32>()->Value();
       // For CCM modes, the IV may be between 7 and 13 bytes.
-      // For GCM and OCB modes, we'll check by attempting to
-      // set the value. For everything else, just check that
+      // For GCM modes, any IV length is accepted. For OCB modes, we'll check
+      // by attempting to set the value. For everything else, just check that
       // check_len == iv_length.
 
       if (cipher.isCcmMode()) {
@@ -103,6 +107,8 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
         // Nothing to do.
       } else if (cipher.isOcbMode()) {
         if (!ctx.setIvLength(check_len)) return;
+      } else if (cipher.isSivMode() || cipher.isGcmSivMode()) {
+        if (check_len != iv_length) return;
       } else {
         if (check_len != iv_length) return;
       }
@@ -127,9 +133,11 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  if (info->Set(env->context(),
+  const int nid = cipher.getNid();
+  if (nid != NID_undef &&
+      info->Set(env->context(),
                 FIXED_ONE_BYTE_STRING(env->isolate(), "nid"),
-                Int32::New(env->isolate(), cipher.getNid()))
+                Int32::New(env->isolate(), nid))
           .IsNothing()) {
     return;
   }
@@ -188,20 +196,24 @@ void CipherBase::GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
 
 void CipherBase::GetCiphers(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
+  std::vector<std::string> cipher_names;
+  Cipher::ForEach(
+      [&](std::string_view name) { cipher_names.emplace_back(name); });
+  std::sort(cipher_names.begin(), cipher_names.end());
+  cipher_names.erase(std::unique(cipher_names.begin(), cipher_names.end()),
+                     cipher_names.end());
+
   LocalVector<Value> ciphers(env->isolate());
   bool errored = false;
-  Cipher::ForEach([&](std::string_view name) {
-    // If a prior iteration errored, do nothing further. We apparently
-    // can't actually stop openssl from stopping its iteration here.
-    // But why does it matter? Good question.
-    if (errored) return;
+  for (const std::string& name : cipher_names) {
+    if (errored) break;
     Local<Value> val;
     if (!ToV8Value(env->context(), name, env->isolate()).ToLocal(&val)) {
       errored = true;
-      return;
+      break;
     }
     ciphers.push_back(val);
-  });
+  }
 
   // If errored is true here, then we encountered a JavaScript error
   // while trying to create the V8 String from the std::string_view
@@ -212,15 +224,15 @@ void CipherBase::GetCiphers(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-CipherBase::CipherBase(Environment* env,
-                       Local<Object> wrap,
-                       CipherKind kind)
+CipherBase::CipherBase(Environment* env, Local<Object> wrap, CipherKind kind)
     : BaseObject(env, wrap),
       ctx_(nullptr),
       kind_(kind),
       auth_tag_state_(kAuthTagUnknown),
       auth_tag_len_(kNoAuthTagLength),
-      pending_auth_failed_(false) {
+      pending_auth_failed_(false),
+      has_one_shot_update_(false),
+      siv_aad_components_(0) {
   MakeWeak();
 }
 
@@ -303,7 +315,7 @@ void CipherBase::RegisterExternalReferences(
 void CipherBase::New(const FunctionCallbackInfo<Value>& args) {
   CHECK(args.IsConstructCall());
   Environment* env = Environment::GetCurrent(args);
-  CHECK_EQ(args.Length(), 5);
+  CHECK(args.Length() == 5 || args.Length() == 7);
 
   CipherBase* cipher =
       new CipherBase(env, args.This(), args[0]->IsTrue() ? kCipher : kDecipher);
@@ -335,7 +347,25 @@ void CipherBase::New(const FunctionCallbackInfo<Value>& args) {
     auth_tag_len = kNoAuthTagLength;
   }
 
-  cipher->InitIv(*cipher_type, key_buf, iv_buf, auth_tag_len);
+  if (args.Length() == 5) {
+    cipher->InitIv(
+        *cipher_type, key_buf, iv_buf, auth_tag_len, nullptr, nullptr);
+    return;
+  }
+
+  CHECK(args[5]->IsString() || args[5]->IsUndefined());
+  CHECK(args[6]->IsString() || args[6]->IsUndefined());
+  const Utf8Value cts_mode(env->isolate(),
+                           args[5]->IsString() ? args[5] : Local<Value>());
+  const Utf8Value xts_standard(env->isolate(),
+                               args[6]->IsString() ? args[6] : Local<Value>());
+
+  cipher->InitIv(*cipher_type,
+                 key_buf,
+                 iv_buf,
+                 auth_tag_len,
+                 args[5]->IsString() ? *cts_mode : nullptr,
+                 args[6]->IsString() ? *xts_standard : nullptr);
 }
 
 void CipherBase::CommonInit(const char* cipher_type,
@@ -344,7 +374,9 @@ void CipherBase::CommonInit(const char* cipher_type,
                             int key_len,
                             const unsigned char* iv,
                             int iv_len,
-                            unsigned int auth_tag_len) {
+                            unsigned int auth_tag_len,
+                            const char* cts_mode,
+                            const char* xts_standard) {
   MarkPopErrorOnReturn mark_pop_error_on_return;
   CHECK(!ctx_);
   ctx_ = CipherCtxPointer::New();
@@ -364,6 +396,18 @@ void CipherBase::CommonInit(const char* cipher_type,
                             "Failed to initialize cipher");
   }
 
+  if (cts_mode != nullptr && !ctx_.setCtsMode(cts_mode)) {
+    ctx_.reset();
+    return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
+        env(), "%s does not support the ctsMode option", cipher_type);
+  }
+
+  if (xts_standard != nullptr && !ctx_.setXtsStandard(xts_standard)) {
+    ctx_.reset();
+    return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
+        env(), "%s does not support the xtsStandard option", cipher_type);
+  }
+
   if (cipher.isSupportedAuthenticatedMode()) {
     CHECK_GE(iv_len, 0);
     if (!InitAuthenticated(cipher_type, iv_len, auth_tag_len)) {
@@ -386,11 +430,14 @@ void CipherBase::CommonInit(const char* cipher_type,
 void CipherBase::InitIv(const char* cipher_type,
                         const ByteSource& key_buf,
                         const ArrayBufferOrViewContents<unsigned char>& iv_buf,
-                        unsigned int auth_tag_len) {
+                        unsigned int auth_tag_len,
+                        const char* cts_mode,
+                        const char* xts_standard) {
   HandleScope scope(env()->isolate());
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
-  auto cipher = Cipher::FromName(cipher_type);
+  auto cipher =
+      Cipher::FromName(cipher_type, env()->provider_cipher_cache.get());
   if (!cipher) return THROW_ERR_CRYPTO_UNKNOWN_CIPHER(env());
 
   const int expected_iv_len = cipher.getIvLength();
@@ -419,14 +466,24 @@ void CipherBase::InitIv(const char* cipher_type,
     }
   }
 
-  CommonInit(
-      cipher_type,
-      cipher,
-      key_buf.data<unsigned char>(),
-      key_buf.size(),
-      iv_buf.data(),
-      iv_buf.size(),
-      auth_tag_len);
+  if (cipher.isSivMode() && has_iv) {
+    return THROW_ERR_CRYPTO_INVALID_IV(env());
+  }
+
+  if (cipher.isGcmSivMode() &&
+      (!has_iv || static_cast<int>(iv_buf.size()) != expected_iv_len)) {
+    return THROW_ERR_CRYPTO_INVALID_IV(env());
+  }
+
+  CommonInit(cipher_type,
+             cipher,
+             key_buf.data<unsigned char>(),
+             key_buf.size(),
+             iv_buf.data(),
+             iv_buf.size(),
+             auth_tag_len,
+             cts_mode,
+             xts_standard);
 }
 
 bool CipherBase::InitAuthenticated(const char* cipher_type,
@@ -435,7 +492,9 @@ bool CipherBase::InitAuthenticated(const char* cipher_type,
   CHECK(IsAuthenticatedMode());
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
-  if (!ctx_.setIvLength(iv_len)) {
+  const bool is_siv = ctx_.isSivMode() || ctx_.isGcmSivMode();
+
+  if (!is_siv && !ctx_.setIvLength(iv_len)) {
     THROW_ERR_CRYPTO_INVALID_IV(env());
     return false;
   }
@@ -444,7 +503,7 @@ bool CipherBase::InitAuthenticated(const char* cipher_type,
     // TODO(tniessen) Support CCM decryption in FIPS mode
     if (kind_ == kDecipher && ncrypto::isFipsEnabled()) {
       THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
-          env(), "CCM encryption not supported in FIPS mode");
+          env(), "CCM decryption not supported in FIPS mode");
       return false;
     }
 
@@ -460,6 +519,8 @@ bool CipherBase::InitAuthenticated(const char* cipher_type,
     // an explicit authTagLength. This remains deprecated, but supported.
     if (ctx_.isGcmMode()) {
       return true;
+    } else if (is_siv) {
+      auth_tag_len = EVP_GCM_TLS_TAG_LEN;
 #ifdef EVP_CHACHAPOLY_TLS_TAG_LEN
     } else if (ctx_.isChaCha20Poly1305()) {
       auth_tag_len = EVP_CHACHAPOLY_TLS_TAG_LEN;
@@ -469,13 +530,24 @@ bool CipherBase::InitAuthenticated(const char* cipher_type,
           env(), "authTagLength required for %s", cipher_type);
       return false;
     }
-  } else if ((ctx_.isGcmMode() && !Cipher::IsValidGCMTagLength(auth_tag_len)) ||
-             (!ctx_.isGcmMode() && !ctx_.setAeadTagLength(auth_tag_len))) {
+  } else {
     // GCM authentication tag lengths are restricted according to NIST 800-38d,
-    // page 9. For other modes, we rely on OpenSSL to validate the length.
-    THROW_ERR_CRYPTO_INVALID_AUTH_TAG(
-        env(), "Invalid authentication tag length: %u", auth_tag_len);
-    return false;
+    // page 9. SIV modes only support 16-byte tags. For other modes, we rely on
+    // OpenSSL to validate the length.
+    bool is_invalid_auth_tag_length;
+    if (is_siv) {
+      is_invalid_auth_tag_length = auth_tag_len != EVP_GCM_TLS_TAG_LEN;
+    } else if (ctx_.isGcmMode()) {
+      is_invalid_auth_tag_length = !Cipher::IsValidGCMTagLength(auth_tag_len);
+    } else {
+      is_invalid_auth_tag_length = !ctx_.setAeadTagLength(auth_tag_len);
+    }
+
+    if (is_invalid_auth_tag_length) {
+      THROW_ERR_CRYPTO_INVALID_AUTH_TAG(
+          env(), "Invalid authentication tag length: %u", auth_tag_len);
+      return false;
+    }
   }
 
   // Remember the given authentication tag length for later.
@@ -532,6 +604,11 @@ void CipherBase::SetAuthTag(const FunctionCallbackInfo<Value>& args) {
     return args.GetReturnValue().Set(false);
   }
 
+  if ((cipher->ctx_.isSivMode() || cipher->ctx_.isGcmSivMode()) &&
+      cipher->has_one_shot_update_) {
+    return args.GetReturnValue().Set(false);
+  }
+
   ArrayBufferOrViewContents<char> auth_tag(args[0]);
   if (!auth_tag.CheckSizeInt32()) [[unlikely]] {
     return THROW_ERR_OUT_OF_RANGE(env, "buffer is too big");
@@ -584,6 +661,9 @@ bool CipherBase::SetAAD(
     int plaintext_len) {
   if (!ctx_ || !IsAuthenticatedMode())
     return false;
+  const bool is_siv = ctx_.isSivMode();
+  if ((is_siv || ctx_.isGcmSivMode()) && has_one_shot_update_) return false;
+  if (is_siv && siv_aad_components_ >= kMaxSivAADComponents) return false;
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
   int outlen;
@@ -615,7 +695,9 @@ bool CipherBase::SetAAD(
       .data = data.data(),
       .len = data.size(),
   };
-  return ctx_.update(buffer, nullptr, &outlen);
+  const bool success = ctx_.update(buffer, nullptr, &outlen);
+  if (success && is_siv) siv_aad_components_++;
+  return success;
 }
 
 void CipherBase::SetAAD(const FunctionCallbackInfo<Value>& args) {
@@ -641,10 +723,23 @@ CipherBase::UpdateResult CipherBase::Update(
   if (!ctx_ || len > INT_MAX) return kErrorState;
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
-  if (ctx_.isCcmMode() && !CheckCCMMessageLength(len)) {
+  const bool is_ccm_mode = ctx_.isCcmMode();
+  const bool is_ccm_decipher = kind_ == kDecipher && is_ccm_mode;
+
+  if (is_ccm_mode && !CheckCCMMessageLength(len)) {
     return kErrorMessageSize;
   }
 
+  const bool is_siv = ctx_.isSivMode() || ctx_.isGcmSivMode();
+  const bool is_cts = ctx_.isCtsMode();
+  const bool is_xts = ctx_.isXtsMode();
+  const bool is_wrap = ctx_.isWrapMode();
+  const bool is_one_shot =
+      is_ccm_decipher || is_siv || is_cts || is_xts || is_wrap;
+  if (is_one_shot && has_one_shot_update_) {
+    return kErrorState;
+  }
+
   const int block_size = ctx_.getBlockSize();
   CHECK_GT(block_size, 0);
   if (len + block_size > INT_MAX) return kErrorState;
@@ -671,6 +766,18 @@ CipherBase::UpdateResult CipherBase::Update(
 
   bool r = ctx_.update(
       buffer, static_cast<unsigned char*>((*out)->Data()), &buf_len);
+  if (is_ccm_decipher || is_siv || ((is_cts || is_xts || is_wrap) && r)) {
+    has_one_shot_update_ = true;
+  }
+
+  // When in CCM mode, EVP_CipherUpdate will fail if the authentication tag is
+  // invalid. AES-SIV reports the same authentication failure at update time,
+  // but the AEAD contract expects the failure to surface from final().
+  const bool pending_auth_failed =
+      !r && kind_ == kDecipher && (ctx_.isCcmMode() || is_siv);
+  if (pending_auth_failed) {
+    buf_len = 0;
+  }
 
   CHECK_LE(static_cast<size_t>(buf_len), (*out)->ByteLength());
   if (buf_len == 0) {
@@ -684,9 +791,7 @@ CipherBase::UpdateResult CipherBase::Update(
     memcpy((*out)->Data(), old_out->Data(), buf_len);
   }
 
-  // When in CCM mode, EVP_CipherUpdate will fail if the authentication tag is
-  // invalid. In that case, remember the error and throw in final().
-  if (!r && kind_ == kDecipher && ctx_.isCcmMode()) {
+  if (pending_auth_failed) {
     pending_auth_failed_ = true;
     return kSuccess;
   }
@@ -740,6 +845,13 @@ void CipherBase::SetAutoPadding(const FunctionCallbackInfo<Value>& args) {
 
 bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
   if (!ctx_) return false;
+  const bool is_one_shot = ctx_.isSivMode() || ctx_.isGcmSivMode() ||
+                           ctx_.isCtsMode() || ctx_.isXtsMode() ||
+                           ctx_.isWrapMode();
+  if (is_one_shot && !has_one_shot_update_) {
+    ctx_.reset();
+    return false;
+  }
 
   *out = ArrayBuffer::NewBackingStore(
       env()->isolate(),
@@ -759,7 +871,8 @@ bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
   // EVP_CipherFinal_ex must not be called and will fail.
   bool ok;
   if (kind_ == kDecipher && ctx_.isCcmMode()) {
-    ok = !pending_auth_failed_;
+    ok = auth_tag_state_ == kAuthTagSetByUser && has_one_shot_update_ &&
+         !pending_auth_failed_;
     *out = ArrayBuffer::NewBackingStore(env()->isolate(), 0);
   } else {
     int out_len = (*out)->ByteLength();
@@ -834,6 +947,7 @@ bool PublicKeyCipher::Cipher(
     const EVPKeyPointer& pkey,
     int padding,
     const Digest& digest,
+    const Digest& mgf1_digest,
     const ArrayBufferOrViewContents<unsigned char>& oaep_label,
     const ArrayBufferOrViewContents<unsigned char>& data,
     std::unique_ptr<BackingStore>* out) {
@@ -843,6 +957,7 @@ bool PublicKeyCipher::Cipher(
   const ncrypto::Cipher::CipherParams params{
       .padding = padding,
       .digest = digest,
+      .mgf1_digest = mgf1_digest,
       .label = label,
   };
 
@@ -915,8 +1030,17 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
   if (!oaep_label.CheckSizeInt32()) [[unlikely]] {
     return THROW_ERR_OUT_OF_RANGE(env, "oaepLabel is too big");
   }
+
+  Digest mgf1_digest;
+  if (args[offset + 4]->IsString()) {
+    Utf8Value mgf1_str(env->isolate(), args[offset + 4]);
+    mgf1_digest = Digest::FromName(*mgf1_str);
+    if (!mgf1_digest) return THROW_ERR_OSSL_EVP_INVALID_DIGEST(env);
+  }
+
   std::unique_ptr<BackingStore> out;
-  if (!Cipher<cipher>(env, pkey, padding, digest, oaep_label, buf, &out)) {
+  if (!Cipher<cipher>(
+          env, pkey, padding, digest, mgf1_digest, oaep_label, buf, &out)) {
     return ThrowCryptoError(env, ERR_get_error());
   }
 
diff --git a/src/crypto/crypto_cipher.h b/src/crypto/crypto_cipher.h
index f351c845497d..f6deb774ea36 100644
--- a/src/crypto/crypto_cipher.h
+++ b/src/crypto/crypto_cipher.h
@@ -43,6 +43,7 @@ class CipherBase : public BaseObject {
     kAuthTagComputed,
   };
   static const unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
+  static constexpr unsigned int kMaxSivAADComponents = 126;
 
   void CommonInit(const char* cipher_type,
                   const ncrypto::Cipher& cipher,
@@ -50,11 +51,15 @@ class CipherBase : public BaseObject {
                   int key_len,
                   const unsigned char* iv,
                   int iv_len,
-                  unsigned int auth_tag_len);
+                  unsigned int auth_tag_len,
+                  const char* cts_mode,
+                  const char* xts_standard);
   void InitIv(const char* cipher_type,
               const ByteSource& key_buf,
               const ArrayBufferOrViewContents<unsigned char>& iv_buf,
-              unsigned int auth_tag_len);
+              unsigned int auth_tag_len,
+              const char* cts_mode,
+              const char* xts_standard);
   bool InitAuthenticated(const char* cipher_type,
                          int iv_len,
                          unsigned int auth_tag_len);
@@ -86,6 +91,8 @@ class CipherBase : public BaseObject {
   unsigned int auth_tag_len_;
   char auth_tag_[ncrypto::Cipher::MAX_AUTH_TAG_LENGTH];
   bool pending_auth_failed_;
+  bool has_one_shot_update_;
+  unsigned int siv_aad_components_;
   int max_message_size_;
 };
 
@@ -106,6 +113,7 @@ class PublicKeyCipher {
                      const ncrypto::EVPKeyPointer& pkey,
                      int padding,
                      const ncrypto::Digest& digest,
+                     const ncrypto::Digest& mgf1_digest,
                      const ArrayBufferOrViewContents<unsigned char>& oaep_label,
                      const ArrayBufferOrViewContents<unsigned char>& data,
                      std::unique_ptr<v8::BackingStore>* out);
diff --git a/src/crypto/crypto_clienthello-inl.h b/src/crypto/crypto_clienthello-inl.h
deleted file mode 100644
index 1b8a0c00c307..000000000000
--- a/src/crypto/crypto_clienthello-inl.h
+++ /dev/null
@@ -1,90 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-#ifndef SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_
-#define SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include "crypto/crypto_clienthello.h"
-#include "util.h"
-
-namespace node {
-namespace crypto {
-inline ClientHelloParser::ClientHelloParser()
-    : state_(kEnded),
-      onhello_cb_(nullptr),
-      onend_cb_(nullptr),
-      cb_arg_(nullptr) {
-  Reset();
-}
-
-inline void ClientHelloParser::Reset() {
-  frame_len_ = 0;
-  body_offset_ = 0;
-  extension_offset_ = 0;
-  session_size_ = 0;
-  session_id_ = nullptr;
-  tls_ticket_size_ = -1;
-  tls_ticket_ = nullptr;
-  servername_size_ = 0;
-  servername_ = nullptr;
-}
-
-inline void ClientHelloParser::Start(ClientHelloParser::OnHelloCb onhello_cb,
-                                     ClientHelloParser::OnEndCb onend_cb,
-                                     void* cb_arg) {
-  if (!IsEnded())
-    return;
-  Reset();
-
-  CHECK_NOT_NULL(onhello_cb);
-
-  state_ = kWaiting;
-  onhello_cb_ = onhello_cb;
-  onend_cb_ = onend_cb;
-  cb_arg_ = cb_arg;
-}
-
-inline void ClientHelloParser::End() {
-  if (state_ == kEnded)
-    return;
-  state_ = kEnded;
-  if (onend_cb_ != nullptr) {
-    onend_cb_(cb_arg_);
-    onend_cb_ = nullptr;
-  }
-}
-
-inline bool ClientHelloParser::IsEnded() const {
-  return state_ == kEnded;
-}
-
-inline bool ClientHelloParser::IsPaused() const {
-  return state_ == kPaused;
-}
-
-}  // namespace crypto
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#endif  // SRC_CRYPTO_CRYPTO_CLIENTHELLO_INL_H_
diff --git a/src/crypto/crypto_clienthello.cc b/src/crypto/crypto_clienthello.cc
deleted file mode 100644
index 203289ae2911..000000000000
--- a/src/crypto/crypto_clienthello.cc
+++ /dev/null
@@ -1,238 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-#include "crypto/crypto_clienthello.h"  // NOLINT(build/include_inline)
-#include "crypto/crypto_clienthello-inl.h"
-
-namespace node {
-namespace crypto {
-void ClientHelloParser::Parse(const uint8_t* data, size_t avail) {
-  switch (state_) {
-    case kWaiting:
-      if (!ParseRecordHeader(data, avail))
-        break;
-      [[fallthrough]];
-    case kTLSHeader:
-      ParseHeader(data, avail);
-      break;
-    case kPaused:
-      // Just nop
-    case kEnded:
-      // Already ended, just ignore it
-      break;
-    default:
-      break;
-  }
-}
-
-
-bool ClientHelloParser::ParseRecordHeader(const uint8_t* data, size_t avail) {
-  // >= 5 bytes for header parsing
-  if (avail < 5)
-    return false;
-
-  if (data[0] == kChangeCipherSpec ||
-      data[0] == kAlert ||
-      data[0] == kHandshake ||
-      data[0] == kApplicationData) {
-    frame_len_ = (data[3] << 8) + data[4];
-    state_ = kTLSHeader;
-    body_offset_ = 5;
-  } else {
-    End();
-    return false;
-  }
-
-  // Sanity check (too big frame, or too small)
-  // Let OpenSSL handle it
-  if (frame_len_ >= kMaxTLSFrameLen) {
-    End();
-    return false;
-  }
-
-  return true;
-}
-
-
-void ClientHelloParser::ParseHeader(const uint8_t* data, size_t avail) {
-  ClientHello hello;
-
-  // We need at least six bytes (one byte for kClientHello, three bytes for the
-  // length of the handshake message, and two bytes for the protocol version).
-  // If the client sent a frame that suggests a smaller ClientHello, give up.
-  if (frame_len_ < 6) return End();
-
-  // >= 5 + frame size bytes for frame parsing
-  if (body_offset_ + frame_len_ > avail)
-    return;
-
-  // Check hello protocol version.  Protocol tuples that we know about:
-  //
-  // (3,1) TLS v1.0
-  // (3,2) TLS v1.1
-  // (3,3) TLS v1.2
-  //
-  // Note that TLS v1.3 uses a TLS v1.2 handshake so requires no specific
-  // support here.
-  if (data[body_offset_ + 4] != 0x03 ||
-      data[body_offset_ + 5] < 0x01 ||
-      data[body_offset_ + 5] > 0x03) {
-    return End();
-  }
-
-  if (data[body_offset_] == kClientHello) {
-    if (state_ == kTLSHeader) {
-      if (!ParseTLSClientHello(data, avail))
-        return End();
-    } else {
-      // We couldn't get here, but whatever
-      return End();
-    }
-
-    // Check if we overflowed (do not reply with any private data)
-    if (session_id_ == nullptr ||
-        session_size_ > 32 ||
-        session_id_ + session_size_ > data + avail) {
-      return End();
-    }
-  }
-
-  state_ = kPaused;
-  hello.session_id_ = session_id_;
-  hello.session_size_ = session_size_;
-  hello.has_ticket_ = tls_ticket_ != nullptr && tls_ticket_size_ != 0;
-  hello.servername_ = servername_;
-  hello.servername_size_ = static_cast<uint8_t>(servername_size_);
-  onhello_cb_(cb_arg_, hello);
-}
-
-
-void ClientHelloParser::ParseExtension(const uint16_t type,
-                                       const uint8_t* data,
-                                       size_t len) {
-  // NOTE: In case of anything we're just returning back, ignoring the problem.
-  // That's because we're heavily relying on OpenSSL to solve any problem with
-  // incoming data.
-  switch (type) {
-    case kServerName:
-      {
-        if (len < 2)
-          return;
-        uint32_t server_names_len = (data[0] << 8) + data[1];
-        if (server_names_len + 2 > len)
-          return;
-        for (size_t offset = 2; offset < 2 + server_names_len; ) {
-          if (offset + 3 > len)
-            return;
-          uint8_t name_type = data[offset];
-          if (name_type != kServernameHostname)
-            return;
-          uint16_t name_len = (data[offset + 1] << 8) + data[offset + 2];
-          offset += 3;
-          if (offset + name_len > len)
-            return;
-          servername_ = data + offset;
-          servername_size_ = name_len;
-          offset += name_len;
-        }
-      }
-      break;
-    case kTLSSessionTicket:
-      tls_ticket_size_ = len;
-      tls_ticket_ = data + len;
-      break;
-    default:
-      // Ignore
-      break;
-  }
-}
-
-
-bool ClientHelloParser::ParseTLSClientHello(const uint8_t* data, size_t avail) {
-  const uint8_t* body;
-
-  // Skip frame header, hello header, protocol version and random data
-  size_t session_offset = body_offset_ + 4 + 2 + 32;
-
-  if (session_offset + 1 >= avail)
-    return false;
-
-  body = data + session_offset;
-  session_size_ = *body;
-  session_id_ = body + 1;
-
-  size_t cipher_offset = session_offset + 1 + session_size_;
-
-  // Session OOB failure
-  if (cipher_offset + 1 >= avail)
-    return false;
-
-  uint16_t cipher_len =
-      (data[cipher_offset] << 8) + data[cipher_offset + 1];
-  size_t comp_offset = cipher_offset + 2 + cipher_len;
-
-  // Cipher OOB failure
-  if (comp_offset >= avail)
-    return false;
-
-  uint8_t comp_len = data[comp_offset];
-  size_t extension_offset = comp_offset + 1 + comp_len;
-
-  // Compression OOB failure
-  if (extension_offset > avail)
-    return false;
-
-  // No extensions present
-  if (extension_offset == avail)
-    return true;
-
-  size_t ext_off = extension_offset + 2;
-
-  // Parse known extensions
-  while (ext_off < avail) {
-    // Extension OOB
-    if (ext_off + 4 > avail)
-      return false;
-
-    uint16_t ext_type = (data[ext_off] << 8) + data[ext_off + 1];
-    uint16_t ext_len = (data[ext_off + 2] << 8) + data[ext_off + 3];
-    ext_off += 4;
-
-    // Extension OOB
-    if (ext_off + ext_len > avail)
-      return false;
-
-    ParseExtension(ext_type,
-                   data + ext_off,
-                   ext_len);
-
-    ext_off += ext_len;
-  }
-
-  // Extensions OOB failure
-  if (ext_off > avail)
-    return false;
-
-  return true;
-}
-
-}  // namespace crypto
-}  // namespace node
diff --git a/src/crypto/crypto_clienthello.h b/src/crypto/crypto_clienthello.h
deleted file mode 100644
index 3af08bc6475e..000000000000
--- a/src/crypto/crypto_clienthello.h
+++ /dev/null
@@ -1,131 +0,0 @@
-// Copyright Joyent, Inc. and other Node contributors.
-//
-// Permission is hereby granted, free of charge, to any person obtaining a
-// copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to permit
-// persons to whom the Software is furnished to do so, subject to the
-// following conditions:
-//
-// The above copyright notice and this permission notice shall be included
-// in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-// USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-#ifndef SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_
-#define SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_
-
-#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#include <cstddef>  // size_t
-#include <cstdint>
-
-namespace node {
-namespace crypto {
-// Parse the client hello so we can do async session resumption. OpenSSL's
-// session resumption uses synchronous callbacks, see SSL_CTX_sess_set_get_cb
-// and get_session_cb.
-//
-// TLS1.3 handshakes masquerade as TLS1.2 session resumption, and to do this,
-// they always include a session_id in the ClientHello, making up a bogus value
-// if necessary. The parser can't know if its a bogus id, and will cause a
-// 'newSession' event to be emitted. This should do no harm, the id won't be
-// found, and the handshake will continue.
-class ClientHelloParser {
- public:
-  inline ClientHelloParser();
-
-  class ClientHello {
-   public:
-    inline uint8_t session_size() const { return session_size_; }
-    inline const uint8_t* session_id() const { return session_id_; }
-    inline bool has_ticket() const { return has_ticket_; }
-    inline uint8_t servername_size() const { return servername_size_; }
-    inline const uint8_t* servername() const { return servername_; }
-
-   private:
-    uint8_t session_size_;
-    const uint8_t* session_id_;
-    bool has_ticket_;
-    uint8_t servername_size_;
-    const uint8_t* servername_;
-
-    friend class ClientHelloParser;
-  };
-
-  typedef void (*OnHelloCb)(void* arg, const ClientHello& hello);
-  typedef void (*OnEndCb)(void* arg);
-
-  void Parse(const uint8_t* data, size_t avail);
-
-  inline void Reset();
-  inline void Start(OnHelloCb onhello_cb, OnEndCb onend_cb, void* cb_arg);
-  inline void End();
-  inline bool IsPaused() const;
-  inline bool IsEnded() const;
-
- private:
-  static const size_t kMaxTLSFrameLen = 16 * 1024 + 5;
-  static const size_t kMaxSSLExFrameLen = 32 * 1024;
-  static const uint8_t kServernameHostname = 0;
-  static const size_t kMinStatusRequestSize = 5;
-
-  enum ParseState {
-    kWaiting,
-    kTLSHeader,
-    kPaused,
-    kEnded
-  };
-
-  enum FrameType {
-    kChangeCipherSpec = 20,
-    kAlert = 21,
-    kHandshake = 22,
-    kApplicationData = 23,
-    kOther = 255
-  };
-
-  enum HandshakeType {
-    kClientHello = 1
-  };
-
-  enum ExtensionType {
-    kServerName = 0,
-    kTLSSessionTicket = 35
-  };
-
-  bool ParseRecordHeader(const uint8_t* data, size_t avail);
-  void ParseHeader(const uint8_t* data, size_t avail);
-  void ParseExtension(const uint16_t type,
-                      const uint8_t* data,
-                      size_t len);
-  bool ParseTLSClientHello(const uint8_t* data, size_t avail);
-
-  ParseState state_;
-  OnHelloCb onhello_cb_;
-  OnEndCb onend_cb_;
-  void* cb_arg_;
-  size_t frame_len_ = 0;
-  size_t body_offset_ = 0;
-  size_t extension_offset_ = 0;
-  uint8_t session_size_ = 0;
-  const uint8_t* session_id_ = nullptr;
-  uint16_t servername_size_ = 0;
-  const uint8_t* servername_ = nullptr;
-  uint16_t tls_ticket_size_ = -1;
-  const uint8_t* tls_ticket_ = nullptr;
-};
-
-}  // namespace crypto
-}  // namespace node
-
-#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
-
-#endif  // SRC_CRYPTO_CRYPTO_CLIENTHELLO_H_
diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc
index fde12953860c..ea0747511a10 100644
--- a/src/crypto/crypto_common.cc
+++ b/src/crypto/crypto_common.cc
@@ -28,8 +28,8 @@
 namespace node {
 
 using ncrypto::ClearErrorOnReturn;
-using ncrypto::ECKeyPointer;
 using ncrypto::EVPKeyPointer;
+using ncrypto::KeyAlgorithm;
 using ncrypto::SSLPointer;
 using ncrypto::SSLSessionPointer;
 using ncrypto::StackOfX509;
@@ -218,33 +218,26 @@ MaybeLocal<Object> GetEphemeralKey(Environment* env, const SSLPointer& ssl) {
 
   bool found = false;
   if (EVPKeyPointer key = ssl.getPeerTempKey()) {
-    int kid = key.id();
-    switch (kid) {
-      case EVP_PKEY_DH: {
-        values[0] = env->dh_string();
-        values[2] = Integer::New(env->isolate(), key.bits());
-        found = true;
-        break;
+    const auto* algorithm = key.getAlgorithm();
+    if (algorithm == &KeyAlgorithm::DH) {
+      values[0] = env->dh_string();
+      values[2] = Integer::New(env->isolate(), key.bits());
+      found = true;
+    } else if (algorithm == &KeyAlgorithm::EC ||
+               algorithm == &KeyAlgorithm::X25519 ||
+               algorithm == &KeyAlgorithm::X448) {
+      const char* curve_name = nullptr;
+      if (algorithm == &KeyAlgorithm::EC) {
+        const int nid = ncrypto::Ec::GetCurveId(key);
+        if (nid != NID_undef) curve_name = OBJ_nid2sn(nid);
+      } else {
+        curve_name = algorithm->name();
       }
-      case EVP_PKEY_EC:
-      case EVP_PKEY_X25519:
-      case EVP_PKEY_X448: {
-        const char* curve_name;
-        if (kid == EVP_PKEY_EC) {
-          ECKeyPointer ec(key);
-          if (!ec) break;
-          int nid = EC_GROUP_get_curve_name(ec.getGroup());
-          if (nid == NID_undef) break;
-          curve_name = OBJ_nid2sn(nid);
-        } else {
-          curve_name = OBJ_nid2sn(kid);
-        }
-        if (curve_name == nullptr) break;
+      if (curve_name != nullptr) {
         values[0] = env->ecdh_string();
         values[1] = OneByteString(env->isolate(), curve_name);
         values[2] = Integer::New(env->isolate(), key.bits());
         found = true;
-        break;
       }
     }
   }
diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
index af8d52fbe699..74ea622dad50 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
@@ -2,6 +2,7 @@
 #include "base_object-inl.h"
 #include "crypto/crypto_bio.h"
 #include "crypto/crypto_common.h"
+#include "crypto/crypto_pkcs12.h"
 #include "crypto/crypto_util.h"
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
@@ -15,7 +16,6 @@
 #ifdef NODE_OPENSSL_HAS_CERT_COMP
 #include <openssl/comp.h>
 #endif
-#include <openssl/pkcs12.h>
 #include <openssl/rand.h>
 #include <openssl/x509.h>
 #ifdef __APPLE__
@@ -41,6 +41,7 @@ using ncrypto::Digest;
 using ncrypto::EnginePointer;
 #endif  // !OPENSSL_NO_ENGINE
 using ncrypto::EVPKeyPointer;
+using ncrypto::KeyAlgorithm;
 using ncrypto::MarkPopErrorOnReturn;
 using ncrypto::SSLPointer;
 using ncrypto::StackOfX509;
@@ -1689,6 +1690,14 @@ void SecureContext::SetNewSessionCallback(NewSessionCb cb) {
   SSL_CTX_sess_set_new_cb(ctx_.get(), cb);
 }
 
+void SecureContext::SetClientHelloCallback(ClientHelloCb cb) {
+#ifdef OPENSSL_IS_BORINGSSL
+  SSL_CTX_set_select_certificate_cb(ctx_.get(), cb);
+#else
+  SSL_CTX_set_client_hello_cb(ctx_.get(), cb, nullptr);
+#endif
+}
+
 void SecureContext::SetGetSessionCallback(GetSessionCb cb) {
   SSL_CTX_sess_set_get_cb(ctx_.get(), cb);
 }
@@ -2024,7 +2033,7 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
 
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
     EVPKeyPointer params(PEM_read_bio_Parameters(bio.get(), nullptr));
-    if (params && params.id() == EVP_PKEY_DH) dh.reset(params.release());
+    if (params && params.isA(KeyAlgorithm::DH)) dh.reset(params.release());
 #else
     dh.reset(PEM_read_bio_DHparams(bio.get(), nullptr, nullptr, nullptr));
 #endif
@@ -2261,13 +2270,30 @@ void SecureContext::Close(const FunctionCallbackInfo<Value>& args) {
   sc->Reset();
 }
 
+namespace {
+// The historical error shape for the TLS `pfx` option: the OpenSSL reason
+// string, except for OpenSSL 3's bare "unsupported" error, which on its own
+// says nothing useful.
+// TODO(@jasnell): Should this use ThrowCryptoError?
+// NOLINTNEXTLINE(runtime/int) -- matches ERR_get_error()
+void ThrowPFXError(Environment* env, unsigned long err) {
+#if OPENSSL_VERSION_MAJOR >= 3
+  if (ERR_GET_REASON(err) == ERR_R_UNSUPPORTED) {
+    return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
+        env, "Unsupported PKCS12 PFX data");
+  }
+#endif
+
+  const char* str = ERR_reason_error_string(err);
+  str = str != nullptr ? str : "Unknown error";
+  env->ThrowError(str);
+}
+}  // namespace
+
 // Takes .pfx or .p12 and password in string or buffer format
 void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
 
-  std::vector<char> pass;
-  bool ret = false;
-
   SecureContext* sc;
   ASSIGN_OR_RETURN_UNWRAP(&sc, args.This());
   ClearErrorOnReturn clear_error_on_return;
@@ -2282,66 +2308,55 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
         env, "Unable to load PFX certificate");
   }
 
+  // PKCS12_parse() takes a NUL-terminated C string; a view is not one, so copy
+  // the bytes out. A passphrase is optional; nullptr means none was given.
+  std::vector<char> pass_storage;
+  const char* pass = nullptr;
   if (args.Length() >= 2) {
     THROW_AND_RETURN_IF_NOT_BUFFER(env, args[1], "Pass phrase");
     Local<ArrayBufferView> abv = args[1].As<ArrayBufferView>();
     size_t passlen = abv->ByteLength();
-    pass.resize(passlen + 1);
-    abv->CopyContents(pass.data(), passlen);
-    pass[passlen] = '\0';
+    pass_storage.resize(passlen + 1);
+    abv->CopyContents(pass_storage.data(), passlen);
+    pass_storage[passlen] = '\0';
+    pass = pass_storage.data();
   }
 
   // Free previous certs
   sc->issuer_.reset();
   sc->cert_.reset();
 
-  DeleteFnPtr<PKCS12, PKCS12_free> p12;
-  EVPKeyPointer pkey;
-  X509Pointer cert;
-  StackOfX509 extra_certs;
-
-  PKCS12* p12_ptr = nullptr;
-  EVP_PKEY* pkey_ptr = nullptr;
-  X509* cert_ptr = nullptr;
-  STACK_OF(X509)* extra_certs_ptr = nullptr;
-
-  if (!d2i_PKCS12_bio(in.get(), &p12_ptr)) {
-    goto done;
-  }
-
-  // Move ownership to the smart pointer:
-  p12.reset(p12_ptr);
-
-  if (!PKCS12_parse(
-          p12.get(), pass.data(), &pkey_ptr, &cert_ptr, &extra_certs_ptr)) {
-    goto done;
+  auto parsed = ParsePKCS12Bundle(in, pass);
+  if (!parsed) {
+    // Every parse failure carries the OpenSSL error that caused it, which is
+    // all this path needs: ThrowPFXError() derives the same message it always
+    // has, the UNSUPPORTED_ALGORITHM case included.
+    return ThrowPFXError(env, parsed.openssl_error.value_or(0));
   }
 
-  // Move ownership of the parsed data:
-  pkey.reset(pkey_ptr);
-  cert.reset(cert_ptr);
-  extra_certs.reset(extra_certs_ptr);
-
-  if (!pkey) {
+  // Unlike crypto.parsePKCS12(), TLS needs both halves of the pair.
+  if (!parsed.value.key) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(
         env, "Unable to load private key from PFX data");
   }
 
-  if (!cert) {
+  if (!parsed.value.cert) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(
         env, "Unable to load certificate from PFX data");
   }
 
+  const StackOfX509& extra_certs = parsed.value.ca;
+
   if (!SSL_CTX_use_certificate_chain(sc->ctx_.get(),
-                                     std::move(cert),
+                                     std::move(parsed.value.cert),
                                      extra_certs.get(),
                                      &sc->cert_,
                                      &sc->issuer_)) {
-    goto done;
+    return ThrowPFXError(env, ERR_get_error());
   }
 
-  if (!SSL_CTX_use_PrivateKey(sc->ctx_.get(), pkey.get())) {
-    goto done;
+  if (!SSL_CTX_use_PrivateKey(sc->ctx_.get(), parsed.value.key.get())) {
+    return ThrowPFXError(env, ERR_get_error());
   }
 
   // Add CA certs too
@@ -2351,27 +2366,6 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
     X509_STORE_add_cert(sc->GetCertStoreOwnedByThisSecureContext(), ca);
     CHECK_EQ(1, SSL_CTX_add_client_CA(sc->ctx_.get(), ca));
   }
-  ret = true;
-
-done:
-  if (!ret) {
-    // TODO(@jasnell): Should this use ThrowCryptoError?
-    unsigned long err = ERR_get_error();  // NOLINT(runtime/int)
-
-#if OPENSSL_VERSION_MAJOR >= 3
-    if (ERR_GET_REASON(err) == ERR_R_UNSUPPORTED) {
-      // OpenSSL's "unsupported" error without any context is very
-      // common and not very helpful, so we override it:
-      return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
-          env, "Unsupported PKCS12 PFX data");
-    }
-#endif
-
-    const char* str = ERR_reason_error_string(err);
-    str = str != nullptr ? str : "Unknown error";
-
-    return env->ThrowError(str);
-  }
 }
 
 #ifndef OPENSSL_NO_ENGINE
@@ -2575,9 +2569,11 @@ int SecureContext::TicketKeyCallback(SSL* ssl,
 
   ArrayBufferViewContents<unsigned char> aes_key(aes.As<ArrayBufferView>());
   if (enc) {
-    EVP_EncryptInit_ex(ectx, Cipher::AES_128_CBC, nullptr, aes_key.data(), iv);
+    EVP_EncryptInit_ex(
+        ectx, Cipher::AES_128_CBC(), nullptr, aes_key.data(), iv);
   } else {
-    EVP_DecryptInit_ex(ectx, Cipher::AES_128_CBC, nullptr, aes_key.data(), iv);
+    EVP_DecryptInit_ex(
+        ectx, Cipher::AES_128_CBC(), nullptr, aes_key.data(), iv);
   }
 
   return r;
@@ -2600,7 +2596,8 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
     memcpy(name, sc->ticket_key_name_, sizeof(sc->ticket_key_name_));
     if (!ncrypto::CSPRNG(iv, 16) ||
         EVP_EncryptInit_ex(
-            ectx, Cipher::AES_128_CBC, nullptr, sc->ticket_key_aes_, iv) <= 0 ||
+            ectx, Cipher::AES_128_CBC(), nullptr, sc->ticket_key_aes_, iv) <=
+            0 ||
         !InitTicketHmac(
             hctx, sc->ticket_key_hmac_, sizeof(sc->ticket_key_hmac_))) {
       return -1;
@@ -2614,7 +2611,7 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
   }
 
   if (EVP_DecryptInit_ex(
-          ectx, Cipher::AES_128_CBC, nullptr, sc->ticket_key_aes_, iv) <= 0 ||
+          ectx, Cipher::AES_128_CBC(), nullptr, sc->ticket_key_aes_, iv) <= 0 ||
       !InitTicketHmac(
           hctx, sc->ticket_key_hmac_, sizeof(sc->ticket_key_hmac_))) {
     return -1;
diff --git a/src/crypto/crypto_context.h b/src/crypto/crypto_context.h
index 95ddea4c262d..c65f553e40fd 100644
--- a/src/crypto/crypto_context.h
+++ b/src/crypto/crypto_context.h
@@ -35,6 +35,11 @@ class SecureContext final : public BaseObject {
   using KeylogCb = void (*)(const SSL*, const char*);
   using NewSessionCb = int (*)(SSL*, SSL_SESSION*);
   using SelectSNIContextCb = int (*)(SSL*, int*, void*);
+#ifdef OPENSSL_IS_BORINGSSL
+  using ClientHelloCb = ssl_select_cert_result_t (*)(const SSL_CLIENT_HELLO*);
+#else
+  using ClientHelloCb = int (*)(SSL*, int*, void*);
+#endif
 
   ~SecureContext() override;
 
@@ -74,6 +79,7 @@ class SecureContext final : public BaseObject {
 
   ncrypto::SSLPointer CreateSSL();
 
+  void SetClientHelloCallback(ClientHelloCb cb);
   void SetGetSessionCallback(GetSessionCb cb);
   void SetKeylogCallback(KeylogCb cb);
   void SetNewSessionCallback(NewSessionCb cb);
diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
index 6418283e7e4e..fa56a302908a 100644
--- a/src/crypto/crypto_dh.cc
+++ b/src/crypto/crypto_dh.cc
@@ -21,6 +21,7 @@ using ncrypto::DataPointer;
 using ncrypto::DHPointer;
 using ncrypto::EVPKeyCtxPointer;
 using ncrypto::EVPKeyPointer;
+using ncrypto::KeyAlgorithm;
 using v8::ArrayBuffer;
 using v8::BackingStoreInitializationMode;
 using v8::BackingStoreOnFailureMode;
@@ -459,17 +460,13 @@ EVPKeyCtxPointer DhKeyGenTraits::Setup(DhKeyPairGenConfig* params) {
 
     key_params = EVPKeyPointer::NewDH(std::move(dh));
   } else if (int* prime_size = std::get_if<int>(&params->params.prime)) {
-    auto param_ctx = EVPKeyCtxPointer::NewFromID(EVP_PKEY_DH);
-#ifndef OPENSSL_IS_BORINGSSL
+    auto param_ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::DH);
     if (!param_ctx.initForParamgen() ||
         !param_ctx.setDhParameters(*prime_size, params->params.generator)) {
       return {};
     }
 
     key_params = param_ctx.paramgen();
-#else
-    return {};
-#endif
   } else {
     UNREACHABLE();
   }
@@ -559,7 +556,7 @@ bool DHBitsTraits::DeriveBits(Environment* env,
 bool GetDhKeyDetail(Environment* env,
                     const KeyObjectData& key,
                     Local<Object> target) {
-  CHECK_EQ(key.GetAsymmetricKey().id(), EVP_PKEY_DH);
+  DCHECK(key.GetAsymmetricKey().isA(KeyAlgorithm::DH));
   return true;
 }
 
diff --git a/src/crypto/crypto_dsa.cc b/src/crypto/crypto_dsa.cc
index c2ae2eceb2cf..cf998c7fb473 100644
--- a/src/crypto/crypto_dsa.cc
+++ b/src/crypto/crypto_dsa.cc
@@ -16,6 +16,7 @@ namespace node {
 
 using ncrypto::Dsa;
 using ncrypto::EVPKeyCtxPointer;
+using ncrypto::KeyAlgorithm;
 using v8::FunctionCallbackInfo;
 using v8::Int32;
 using v8::JustVoid;
@@ -28,7 +29,7 @@ using v8::Value;
 
 namespace crypto {
 EVPKeyCtxPointer DsaKeyGenTraits::Setup(DsaKeyPairGenConfig* params) {
-  auto param_ctx = EVPKeyCtxPointer::NewFromID(EVP_PKEY_DSA);
+  auto param_ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::DSA);
 
   if (!param_ctx || !param_ctx.initForParamgen() ||
       !param_ctx.setDsaParameters(
diff --git a/src/crypto/crypto_ec.cc b/src/crypto/crypto_ec.cc
index 807428d69110..1056f58d0428 100644
--- a/src/crypto/crypto_ec.cc
+++ b/src/crypto/crypto_ec.cc
@@ -6,7 +6,6 @@
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
 #include "node_buffer.h"
-#include "string_bytes.h"
 #include "threadpoolwork-inl.h"
 #include "v8.h"
 
@@ -26,6 +25,7 @@ using ncrypto::ECKeyPointer;
 using ncrypto::ECPointPointer;
 using ncrypto::EVPKeyCtxPointer;
 using ncrypto::EVPKeyPointer;
+using ncrypto::KeyAlgorithm;
 using ncrypto::MarkPopErrorOnReturn;
 using v8::Array;
 using v8::ArrayBuffer;
@@ -136,9 +136,12 @@ void ECDH::GenerateKeys(const FunctionCallbackInfo<Value>& args) {
   ECDH* ecdh;
   ASSIGN_OR_RETURN_UNWRAP(&ecdh, args.This());
 
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  ecdh->has_valid_key_pair_ = false;
   if (!ecdh->key_.generate()) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to generate key");
   }
+  ecdh->MaybeCacheValidKeyPair(generation);
 }
 
 ECPointPointer ECDH::BufferToPoint(Environment* env,
@@ -309,6 +312,7 @@ void ECDH::SetPrivateKey(const FunctionCallbackInfo<Value>& args) {
 
   ecdh->key_ = std::move(new_key);
   ecdh->group_ = ecdh->key_.getGroup();
+  ecdh->has_valid_key_pair_ = false;
 }
 
 void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
@@ -327,6 +331,7 @@ void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
         "Failed to convert Buffer to EC_POINT");
   }
 
+  ecdh->has_valid_key_pair_ = false;
   if (!ecdh->key_.setPublicKey(pub)) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
         "Failed to set EC_POINT as the public key");
@@ -347,9 +352,22 @@ bool ECDH::IsKeyValidForCurve(const BignumPointer& private_key) {
          private_key < order;
 }
 
+void ECDH::MaybeCacheValidKeyPair(uint64_t generation) {
+  has_valid_key_pair_ = generation == ncrypto::getFipsStateGeneration();
+  if (has_valid_key_pair_) valid_key_pair_generation_ = generation;
+}
+
 bool ECDH::IsKeyPairValid() {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (has_valid_key_pair_ && valid_key_pair_generation_ == generation) {
+    return true;
+  }
+  has_valid_key_pair_ = false;
+
   MarkPopErrorOnReturn mark_pop_error_on_return;
-  return key_.checkKey();
+  const bool is_valid = key_.checkKey();
+  if (is_valid) MaybeCacheValidKeyPair(generation);
+  return is_valid;
 }
 
 // Convert the input public key to compressed, uncompressed, or hybrid formats.
@@ -391,31 +409,24 @@ void ECDH::ConvertKey(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+void EcKeyPairParams::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackField("curve_name", curve_name);
+}
+
 EVPKeyCtxPointer EcKeyGenTraits::Setup(EcKeyPairGenConfig* params) {
   EVPKeyCtxPointer key_ctx;
-  switch (params->params.curve_nid) {
-    case EVP_PKEY_ED25519:
-      // Fall through
-    case EVP_PKEY_ED448:
-      // Fall through
-    case EVP_PKEY_X25519:
-      // Fall through
-    case EVP_PKEY_X448:
-      key_ctx = EVPKeyCtxPointer::NewFromID(params->params.curve_nid);
-      break;
-    default: {
-      auto param_ctx = EVPKeyCtxPointer::NewFromID(EVP_PKEY_EC);
-      if (!param_ctx.initForParamgen() ||
-          !param_ctx.setEcParameters(params->params.curve_nid,
-                                     params->params.param_encoding)) {
-        return {};
-      }
-
-      auto key_params = param_ctx.paramgen();
-      if (!key_params) return {};
-
-      key_ctx = key_params.newCtx();
+  if (params->params.algorithm != nullptr) {
+    key_ctx = EVPKeyCtxPointer::NewFromAlgorithm(*params->params.algorithm);
+  } else {
+    auto param_ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::EC);
+    if (!param_ctx.initForParamgen() ||
+        !param_ctx.setEcParameters(params->params.curve_name.c_str(),
+                                   params->params.param_encoding)) {
+      return {};
     }
+    auto key_params = param_ctx.paramgen();
+    if (!key_params) return {};
+    key_ctx = key_params.newCtx();
   }
 
   if (!key_ctx.initForKeygen()) return {};
@@ -441,10 +452,13 @@ Maybe<void> EcKeyGenTraits::AdditionalConfig(
   CHECK(args[*offset]->IsString());  // curve name
 
   Utf8Value curve_name(env->isolate(), args[*offset]);
-  params->params.curve_nid = Ec::GetCurveIdFromName(*curve_name);
-  if (params->params.curve_nid == NID_undef) {
-    THROW_ERR_CRYPTO_INVALID_CURVE(env);
-    return Nothing<void>();
+  params->params.algorithm = ncrypto::Ec::GetNamedKeyAlgorithm(*curve_name);
+  if (params->params.algorithm == nullptr) {
+    if (!Ec::CheckCurveName(*curve_name)) {
+      THROW_ERR_CRYPTO_INVALID_CURVE(env);
+      return Nothing<void>();
+    }
+    params->params.curve_name = *curve_name;
   }
 
   // param encoding
@@ -473,7 +487,7 @@ WebCryptoKeyExportStatus EC_Raw_Export(const KeyObjectData& key_data,
   CHECK(m_pkey);
   Mutex::ScopedLock lock(key_data.mutex());
 
-  if (m_pkey.id() != EVP_PKEY_EC) {
+  if (!m_pkey.isA(KeyAlgorithm::EC)) {
     switch (key_data.GetKeyType()) {
       case kKeyTypePrivate: {
         auto data = m_pkey.rawPrivateKey();
@@ -551,7 +565,7 @@ WebCryptoKeyExportStatus ECKeyExportTraits::DoExport(
         return WebCryptoKeyExportStatus::INVALID_KEY_TYPE;
 
       const auto& m_pkey = key_data.GetAsymmetricKey();
-      if (m_pkey.id() != EVP_PKEY_EC) {
+      if (!m_pkey.isA(KeyAlgorithm::EC)) {
         return PKEY_SPKI_Export(key_data, out);
       } else {
         // Ensure exported key is in uncompressed point format.
@@ -605,32 +619,23 @@ bool ExportJWKEcKey(Environment* env,
                     Local<Object> target) {
   Mutex::ScopedLock lock(key.mutex());
   const auto& m_pkey = key.GetAsymmetricKey();
-  CHECK_EQ(m_pkey.id(), EVP_PKEY_EC);
-
-  ECKeyPointer ec(m_pkey);
-  if (!ec) {
-    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK EC key");
+  DCHECK(m_pkey.isA(KeyAlgorithm::EC));
+
+  BignumPointer x;
+  BignumPointer y;
+  BignumPointer priv;
+  int degree_bits;
+  if (!Ec::GetKeyComponents(
+          m_pkey,
+          &x,
+          &y,
+          key.GetKeyType() == kKeyTypePrivate ? &priv : nullptr,
+          &degree_bits)) {
     return false;
   }
-  // A provider-backed key need not expose its public point.
-  if (ec.getPublicKey() == nullptr) return false;
-
-  const auto pub = ec.getPublicKey();
-  const auto group = ec.getGroup();
-
-  int degree_bits = EC_GROUP_get_degree(group);
   int degree_bytes =
       (degree_bits / CHAR_BIT) + (7 + (degree_bits % CHAR_BIT)) / 8;
 
-  auto x = BignumPointer::New();
-  auto y = BignumPointer::New();
-
-  if (!EC_POINT_get_affine_coordinates(group, pub, x.get(), y.get(), nullptr)) {
-    ThrowCryptoError(env, ERR_get_error(),
-                     "Failed to get elliptic-curve point coordinates");
-    return false;
-  }
-
   if (!target
            ->DefineOwnProperty(
                env->context(), env->jwk_kty_string(), env->jwk_ec_string())
@@ -638,23 +643,15 @@ bool ExportJWKEcKey(Environment* env,
     return false;
   }
 
-  if (SetEncodedValue(
-          env,
-          target,
-          env->jwk_x_string(),
-          x.get(),
-          degree_bytes).IsNothing() ||
-      SetEncodedValue(
-          env,
-          target,
-          env->jwk_y_string(),
-          y.get(),
-          degree_bytes).IsNothing()) {
+  if (SetEncodedValue(env, target, env->jwk_x_string(), x.get(), degree_bytes)
+          .IsNothing() ||
+      SetEncodedValue(env, target, env->jwk_y_string(), y.get(), degree_bytes)
+          .IsNothing()) {
     return false;
   }
 
   Local<String> crv_name;
-  const int nid = EC_GROUP_get_curve_name(group);
+  const int nid = Ec::GetCurveId(m_pkey);
   switch (nid) {
     case NID_X9_62_prime256v1:
       crv_name = env->p256_string();
@@ -681,131 +678,14 @@ bool ExportJWKEcKey(Environment* env,
   }
 
   if (key.GetKeyType() == kKeyTypePrivate) {
-    auto pvt = ec.getPrivateKey();
-    if (pvt == nullptr) return false;
-    return SetEncodedValue(env, target, env->jwk_d_string(), pvt, degree_bytes)
+    return SetEncodedValue(
+               env, target, env->jwk_d_string(), priv.get(), degree_bytes)
         .IsJust();
   }
 
   return true;
 }
 
-bool ExportJWKEdKey(Environment* env,
-                    const KeyObjectData& key,
-                    Local<Object> target) {
-  Mutex::ScopedLock lock(key.mutex());
-  const auto& pkey = key.GetAsymmetricKey();
-
-  const char* curve = ([&] {
-    switch (pkey.id()) {
-      case EVP_PKEY_ED25519:
-        return "Ed25519";
-      case EVP_PKEY_ED448:
-        return "Ed448";
-      case EVP_PKEY_X25519:
-        return "X25519";
-      case EVP_PKEY_X448:
-        return "X448";
-      default:
-        UNREACHABLE();
-    }
-  })();
-
-  static constexpr auto trySetKey = [](Environment* env,
-                                       DataPointer data,
-                                       Local<Object> target,
-                                       Local<String> key) {
-    Local<Value> encoded;
-    if (!data) return false;
-    const ncrypto::Buffer<const char> out = data;
-    return StringBytes::Encode(env->isolate(), out.data, out.len, BASE64URL)
-               .ToLocal(&encoded) &&
-           target->DefineOwnProperty(env->context(), key, encoded)
-               .FromMaybe(false);
-  };
-
-  return !(
-      !target
-           ->DefineOwnProperty(env->context(),
-                               env->jwk_crv_string(),
-                               OneByteString(env->isolate(), curve))
-           .FromMaybe(false) ||
-      (key.GetKeyType() == kKeyTypePrivate &&
-       !trySetKey(env, pkey.rawPrivateKey(), target, env->jwk_d_string())) ||
-      !trySetKey(env, pkey.rawPublicKey(), target, env->jwk_x_string()) ||
-      !target
-           ->DefineOwnProperty(
-               env->context(), env->jwk_kty_string(), env->jwk_okp_string())
-           .FromMaybe(false));
-}
-KeyObjectData ImportJWKEdKey(Environment* env, Local<Object> jwk) {
-  Local<Value> crv_value;
-  Local<Value> x_value;
-  Local<Value> d_value;
-
-  if (!jwk->Get(env->context(), env->jwk_crv_string()).ToLocal(&crv_value) ||
-      !jwk->Get(env->context(), env->jwk_x_string()).ToLocal(&x_value) ||
-      !jwk->Get(env->context(), env->jwk_d_string()).ToLocal(&d_value)) {
-    return {};
-  }
-
-  if (!crv_value->IsString() || !x_value->IsString() ||
-      (!d_value->IsUndefined() && !d_value->IsString())) {
-    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK OKP key");
-    return {};
-  }
-
-  Utf8Value crv(env->isolate(), crv_value.As<String>());
-
-  static constexpr struct {
-    const char* name;
-    int nid;
-  } kCurveToNid[] = {
-      {"Ed25519", EVP_PKEY_ED25519},
-      {"Ed448", EVP_PKEY_ED448},
-      {"X25519", EVP_PKEY_X25519},
-      {"X448", EVP_PKEY_X448},
-  };
-
-  int id = NID_undef;
-  for (const auto& entry : kCurveToNid) {
-    if (strcmp(*crv, entry.name) == 0) {
-      id = entry.nid;
-      break;
-    }
-  }
-
-  if (id == NID_undef) {
-    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK OKP key");
-    return {};
-  }
-
-  KeyType type = d_value->IsString() ? kKeyTypePrivate : kKeyTypePublic;
-
-  ByteSource raw;
-  if (type == kKeyTypePrivate) {
-    raw = ByteSource::FromEncodedString(env, d_value.As<String>());
-  } else {
-    raw = ByteSource::FromEncodedString(env, x_value.As<String>());
-  }
-
-  typedef EVPKeyPointer (*new_key_fn)(
-      int, const ncrypto::Buffer<const unsigned char>&);
-  new_key_fn fn = type == kKeyTypePrivate ? EVPKeyPointer::NewRawPrivate
-                                          : EVPKeyPointer::NewRawPublic;
-
-  auto pkey = fn(id,
-                 ncrypto::Buffer<const unsigned char>{
-                     .data = raw.data<const unsigned char>(),
-                     .len = raw.size(),
-                 });
-  if (!pkey) {
-    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK OKP key");
-    return {};
-  }
-
-  return KeyObjectData::CreateAsymmetric(type, std::move(pkey));
-}
 KeyObjectData ImportJWKEcKey(Environment* env, Local<Object> jwk) {
   Local<Value> crv_value;
   if (!jwk->Get(env->context(), env->jwk_crv_string()).ToLocal(&crv_value) ||
@@ -862,11 +742,19 @@ KeyObjectData ImportJWKEcKey(Environment* env, Local<Object> jwk) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK EC key");
       return {};
     }
+    // Verify that the public point matches the private scalar (d*G == (x,y)).
+    if (!ec.checkPrivateKey()) {
+      THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK EC key");
+      return {};
+    }
   }
 
   auto pkey = EVPKeyPointer::New();
   if (!pkey) return {};
-  CHECK(pkey.set(ec));
+  if (!pkey.set(ec)) {
+    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK EC key");
+    return {};
+  }
 
   return KeyObjectData::CreateAsymmetric(type, std::move(pkey));
 }
@@ -876,19 +764,15 @@ bool GetEcKeyDetail(Environment* env,
                     Local<Object> target) {
   Mutex::ScopedLock lock(key.mutex());
   const auto& m_pkey = key.GetAsymmetricKey();
-  CHECK_EQ(m_pkey.id(), EVP_PKEY_EC);
-
-  ECKeyPointer ec(m_pkey);
-  if (!ec) return true;
+  DCHECK(m_pkey.isA(KeyAlgorithm::EC));
 
-  const auto group = ec.getGroup();
-  int nid = EC_GROUP_get_curve_name(group);
-  if (nid == NID_undef) return true;
+  const auto name = Ec::GetCurveName(m_pkey);
+  if (!name) return true;
 
   return target
       ->Set(env->context(),
             env->named_curve_string(),
-            OneByteString(env->isolate(), OBJ_nid2sn(nid)))
+            OneByteString(env->isolate(), name.value()))
       .IsJust();
 }
 
diff --git a/src/crypto/crypto_ec.h b/src/crypto/crypto_ec.h
index d9f8dcfc8149..6f36a3669039 100644
--- a/src/crypto/crypto_ec.h
+++ b/src/crypto/crypto_ec.h
@@ -13,6 +13,8 @@
 #include "node_internals.h"
 #include "v8.h"
 
+#include <string>
+
 namespace node {
 namespace crypto {
 
@@ -48,17 +50,21 @@ class ECDH final : public BaseObject {
   static void GetPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
 
+  void MaybeCacheValidKeyPair(uint64_t generation);
   bool IsKeyPairValid();
   bool IsKeyValidForCurve(const ncrypto::BignumPointer& private_key);
 
   ncrypto::ECKeyPointer key_;
   const EC_GROUP* group_;
+  bool has_valid_key_pair_ = false;
+  uint64_t valid_key_pair_generation_ = 0;
 };
 
 struct EcKeyPairParams final : public MemoryRetainer {
-  int curve_nid;
+  const ncrypto::KeyAlgorithm* algorithm = nullptr;
+  std::string curve_name;
   int param_encoding;
-  SET_NO_MEMORY_INFO()
+  void MemoryInfo(MemoryTracker* tracker) const override;
   SET_MEMORY_INFO_NAME(EcKeyPairParams)
   SET_SELF_SIZE(EcKeyPairParams)
 };
@@ -110,12 +116,6 @@ bool ExportJWKEcKey(Environment* env,
                     const KeyObjectData& key,
                     v8::Local<v8::Object> target);
 
-bool ExportJWKEdKey(Environment* env,
-                    const KeyObjectData& key,
-                    v8::Local<v8::Object> target);
-
-KeyObjectData ImportJWKEdKey(Environment* env, v8::Local<v8::Object> jwk);
-
 KeyObjectData ImportJWKEcKey(Environment* env, v8::Local<v8::Object> jwk);
 
 bool GetEcKeyDetail(Environment* env,
diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc
index f1a7bab16967..2cf971347b9e 100644
--- a/src/crypto/crypto_hash.cc
+++ b/src/crypto/crypto_hash.cc
@@ -79,59 +79,100 @@ constexpr BoringSSLDigest kBoringSSLDigests[] = {
 };
 #endif
 
-#if OPENSSL_VERSION_MAJOR >= 3
-void PushAliases(const char* name, void* data) {
-  static_cast<std::vector<std::string>*>(data)->push_back(name);
+void ResetHashCache(Environment* env,
+                    uint64_t generation,
+                    Local<Object> algorithm_cache = Local<Object>()) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  ncrypto::DigestCache* cache = env->provider_digest_cache.get();
+  CHECK_NOT_NULL(cache);
+  if (!algorithm_cache.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    Local<Context> context = isolate->GetCurrentContext();
+    for (const auto& entry : cache->aliases()) {
+      if (algorithm_cache
+              ->Set(context,
+                    OneByteString(isolate, entry.first),
+                    Int32::New(isolate, -1))
+              .IsNothing()) {
+        return;
+      }
+    }
+  }
+  cache->reset(generation);
+#endif
+  env->supported_hash_algorithms.clear();
+  env->hash_cache_generation = generation;
 }
 
-EVP_MD* GetCachedMDByID(Environment* env, size_t id) {
-  CHECK_LT(id, env->evp_md_cache.size());
-  EVP_MD* result = env->evp_md_cache[id].get();
-  CHECK_NOT_NULL(result);
-  return result;
+bool SynchronizeHashCache(Environment* env,
+                          Local<Object> algorithm_cache = Local<Object>()) {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (env->hash_cache_generation == generation) return false;
+
+  ResetHashCache(env, generation, algorithm_cache);
+  return true;
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+const EVP_MD* GetCachedMDByID(Environment* env,
+                              int32_t id,
+                              Local<Object> algorithm_cache = Local<Object>()) {
+  if (SynchronizeHashCache(env, algorithm_cache) ||
+      env->provider_digest_cache == nullptr) {
+    return nullptr;
+  }
+  return env->provider_digest_cache->lookup(id, env->hash_cache_generation)
+      .digest;
 }
 
 struct MaybeCachedMD {
-  EVP_MD* explicit_md = nullptr;
-  const EVP_MD* implicit_md = nullptr;
+  const EVP_MD* cached_md = nullptr;
+  ncrypto::Digest digest;
   int32_t cache_id = -1;
 };
 
-MaybeCachedMD FetchAndMaybeCacheMD(Environment* env, const char* search_name) {
-  const EVP_MD* implicit_md = ncrypto::getDigestByName(search_name);
-  if (!implicit_md) return {nullptr, nullptr, -1};
-
-  const char* real_name = EVP_MD_get0_name(implicit_md);
-  if (!real_name) return {nullptr, implicit_md, -1};
-
-  auto it = env->alias_to_md_id_map.find(real_name);
-  if (it != env->alias_to_md_id_map.end()) {
-    size_t id = it->second;
-    return {GetCachedMDByID(env, id), implicit_md, static_cast<int32_t>(id)};
+MaybeCachedMD FetchAndMaybeCacheMD(
+    Environment* env,
+    const char* search_name,
+    Local<Object> algorithm_cache = Local<Object>(),
+    const char* fetch_name = nullptr) {
+  SynchronizeHashCache(env, algorithm_cache);
+  if (env->isolate()->HasPendingException()) return {};
+  ncrypto::DigestCache* cache = env->provider_digest_cache.get();
+  CHECK_NOT_NULL(cache);
+  const uint64_t generation = env->hash_cache_generation;
+  const EVP_MD* legacy = nullptr;
+
+  if (auto cached = cache->lookup(search_name, generation);
+      cached.digest != nullptr) {
+    return {cached.digest, cached.digest, cached.id};
   }
 
-  // EVP_*_fetch() does not support alias names, so we need to pass it the
-  // real/original algorithm name.
-  // We use EVP_*_fetch() as a filter here because it will only return an
-  // instance if the algorithm is supported by the public OpenSSL APIs (some
-  // algorithms are used internally by OpenSSL and are also passed to this
-  // callback).
-  EVP_MD* explicit_md = EVP_MD_fetch(nullptr, real_name, nullptr);
-  if (!explicit_md) return {nullptr, implicit_md, -1};
+  if (fetch_name == nullptr) {
+    legacy = ncrypto::getDigestByName(search_name);
+    if (legacy != nullptr) {
+      if (legacy == EVP_md_null()) return {};
+      fetch_name = EVP_MD_get0_name(legacy);
+      if (fetch_name == nullptr) return {nullptr, legacy, -1};
+    } else {
+      fetch_name = search_name;
+    }
+  }
 
-  // Cache the EVP_MD* fetched.
-  env->evp_md_cache.emplace_back(explicit_md);
-  size_t id = env->evp_md_cache.size() - 1;
+  const ncrypto::Digest digest = ncrypto::Digest::Fetch(fetch_name);
+  if (!digest) {
+    return legacy == nullptr ? MaybeCachedMD{}
+                             : MaybeCachedMD{nullptr, legacy, -1};
+  }
 
-  // Add all the aliases to the map to speed up next lookup.
-  std::vector<std::string> aliases;
-  EVP_MD_names_do_all(explicit_md, PushAliases, &aliases);
-  for (const auto& alias : aliases) {
-    env->alias_to_md_id_map.emplace(alias, id);
+  if (generation == ncrypto::getFipsStateGeneration()) {
+    auto cached = cache->insert(search_name, digest.get(), generation);
+    if (cached.digest != nullptr) {
+      return {cached.digest, cached.digest, cached.id};
+    }
   }
-  env->alias_to_md_id_map.emplace(search_name, id);
 
-  return {explicit_md, implicit_md, static_cast<int32_t>(id)};
+  return {nullptr, digest, -1};
 }
 
 void SaveSupportedHashAlgorithmsAndCacheMD(const EVP_MD* md,
@@ -140,12 +181,57 @@ void SaveSupportedHashAlgorithmsAndCacheMD(const EVP_MD* md,
                                            void* arg) {
   if (!from) return;
   Environment* env = static_cast<Environment*>(arg);
-  auto result = FetchAndMaybeCacheMD(env, from);
-  if (result.explicit_md) {
+  const ncrypto::Digest legacy = ncrypto::Digest::FromName(from);
+  const char* canonical_name = legacy ? EVP_MD_get0_name(legacy) : nullptr;
+  if (canonical_name == nullptr) return;
+
+  auto result = FetchAndMaybeCacheMD(env, from, {}, canonical_name);
+  if (result.cached_md || result.digest) {
     env->supported_hash_algorithms.push_back(from);
   }
 }
 
+struct ProviderHashNameContext {
+  Environment* env;
+};
+
+void SaveSupportedProviderHashName(const char* name, void* arg) {
+  if (name == nullptr) return;
+
+  const std::string_view name_view(name);
+  const bool is_dotted_decimal =
+      name_view.find('.') != std::string_view::npos &&
+      std::all_of(name_view.begin(), name_view.end(), [](unsigned char c) {
+        return (c >= '0' && c <= '9') || c == '.';
+      });
+  if (is_dotted_decimal) return;
+
+  std::string normalized_name(name_view);
+  std::transform(normalized_name.begin(),
+                 normalized_name.end(),
+                 normalized_name.begin(),
+                 [](unsigned char c) {
+                   if (c >= 'A' && c <= 'Z') {
+                     return static_cast<char>(c + ('a' - 'A'));
+                   }
+                   return static_cast<char>(c);
+                 });
+
+  auto* context = static_cast<ProviderHashNameContext*>(arg);
+  auto result = FetchAndMaybeCacheMD(
+      context->env, normalized_name.c_str(), {}, normalized_name.c_str());
+  if (result.cached_md || result.digest) {
+    context->env->supported_hash_algorithms.push_back(normalized_name);
+  }
+}
+
+void SaveSupportedProviderHashAlgorithms(EVP_MD* md, void* arg) {
+  ProviderHashNameContext context = {
+      .env = static_cast<Environment*>(arg),
+  };
+  EVP_MD_names_do_all(md, SaveSupportedProviderHashName, &context);
+}
+
 #else
 void SaveSupportedHashAlgorithms(const EVP_MD* md,
                                  const char* from,
@@ -155,25 +241,34 @@ void SaveSupportedHashAlgorithms(const EVP_MD* md,
   Environment* env = static_cast<Environment*>(arg);
   env->supported_hash_algorithms.push_back(from);
 }
-#endif  // OPENSSL_VERSION_MAJOR >= 3
+#endif  // NCRYPTO_USE_OPENSSL3_PROVIDER
 
 const std::vector<std::string>& GetSupportedHashAlgorithms(Environment* env) {
-  if (env->supported_hash_algorithms.empty()) {
-    MarkPopErrorOnReturn mark_pop_error_on_return;
+  while (true) {
+    SynchronizeHashCache(env);
+    const uint64_t generation = env->hash_cache_generation;
+    if (env->supported_hash_algorithms.empty()) {
+      MarkPopErrorOnReturn mark_pop_error_on_return;
 #if NCRYPTO_USE_BORINGSSL_EVP_DO_ALL_FALLBACK
-    for (const auto& digest : kBoringSSLDigests) {
-      static_cast<void>(digest.get);
-      env->supported_hash_algorithms.emplace_back(digest.name);
-    }
-#elif OPENSSL_VERSION_MAJOR >= 3
-    // Since we'll fetch the EVP_MD*, cache them along the way to speed up
-    // later lookups instead of throwing them away immediately.
-    EVP_MD_do_all_sorted(SaveSupportedHashAlgorithmsAndCacheMD, env);
+      for (const auto& digest : kBoringSSLDigests) {
+        static_cast<void>(digest.get);
+        env->supported_hash_algorithms.emplace_back(digest.name);
+      }
+#elif NCRYPTO_USE_OPENSSL3_PROVIDER
+      // Since we'll fetch the EVP_MD*, cache them along the way to speed up
+      // later lookups instead of throwing them away immediately.
+      EVP_MD_do_all_sorted(SaveSupportedHashAlgorithmsAndCacheMD, env);
+      EVP_MD_do_all_provided(nullptr, SaveSupportedProviderHashAlgorithms, env);
 #else
-    EVP_MD_do_all_sorted(SaveSupportedHashAlgorithms, env);
+      EVP_MD_do_all_sorted(SaveSupportedHashAlgorithms, env);
 #endif
+    }
+    const uint64_t current_generation = ncrypto::getFipsStateGeneration();
+    if (generation == current_generation) {
+      return env->supported_hash_algorithms;
+    }
+    ResetHashCache(env, current_generation);
   }
-  return env->supported_hash_algorithms;
 }
 
 void Hash::GetHashes(const FunctionCallbackInfo<Value>& args) {
@@ -191,18 +286,19 @@ void Hash::GetCachedAliases(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = args.GetIsolate();
   Local<Context> context = args.GetIsolate()->GetCurrentContext();
   Environment* env = Environment::GetCurrent(context);
-  size_t size = env->alias_to_md_id_map.size();
+  SynchronizeHashCache(env);
+  size_t size = 0;
   LocalVector<Name> names(isolate);
   LocalVector<Value> values(isolate);
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const auto& aliases = env->provider_digest_cache->aliases();
+  size = aliases.size();
   names.reserve(size);
   values.reserve(size);
-  for (auto& [alias, id] : env->alias_to_md_id_map) {
+  for (const auto& [alias, id] : aliases) {
     names.push_back(OneByteString(isolate, alias));
-    values.push_back(Uint32::New(isolate, id));
+    values.push_back(Int32::New(isolate, id));
   }
-#else
-  CHECK(env->alias_to_md_id_map.empty());
 #endif
   Local<Value> prototype = Null(isolate);
   Local<Object> result =
@@ -210,18 +306,24 @@ void Hash::GetCachedAliases(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(result);
 }
 
-const EVP_MD* GetDigestImplementation(Environment* env,
-                                      Local<Value> algorithm,
-                                      Local<Value> cache_id_val,
-                                      Local<Value> algorithm_cache) {
+const EVP_MD* GetDigestImplementation(
+    Environment* env,
+    Local<Value> algorithm,
+    Local<Value> cache_id_val,
+    Local<Value> algorithm_cache,
+    std::optional<ncrypto::Digest>& digest_owner) {
   CHECK(algorithm->IsString());
   CHECK(cache_id_val->IsInt32());
   CHECK(algorithm_cache->IsObject());
+  DCHECK(!digest_owner.has_value());
 
-#if OPENSSL_VERSION_MAJOR >= 3
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  Local<Object> cache = algorithm_cache.As<Object>();
   int32_t cache_id = cache_id_val.As<Int32>()->Value();
-  if (cache_id != -1) {  // Alias already cached, return the cached EVP_MD*.
-    return GetCachedMDByID(env, cache_id);
+  if (cache_id != -1) {
+    // Alias already cached, return the cached EVP_MD*.
+    if (const EVP_MD* md = GetCachedMDByID(env, cache_id, cache)) return md;
+    if (env->isolate()->HasPendingException()) return nullptr;
   }
 
   // Only decode the algorithm when we don't have it cached to avoid
@@ -229,11 +331,11 @@ const EVP_MD* GetDigestImplementation(Environment* env,
   Isolate* isolate = env->isolate();
   Utf8Value utf8(isolate, algorithm);
 
-  auto result = FetchAndMaybeCacheMD(env, *utf8);
+  auto result = FetchAndMaybeCacheMD(env, *utf8, cache);
+  if (env->isolate()->HasPendingException()) return nullptr;
   if (result.cache_id != -1) {
-    // Add the alias to both C++ side and JS side to speedup the lookup
-    // next time.
-    env->alias_to_md_id_map.emplace(*utf8, result.cache_id);
+    // Add the alias to the JavaScript side to speed up the next lookup. The
+    // native cache added it while inserting the implementation.
     if (algorithm_cache.As<Object>()
             ->Set(isolate->GetCurrentContext(),
                   algorithm,
@@ -243,7 +345,12 @@ const EVP_MD* GetDigestImplementation(Environment* env,
     }
   }
 
-  return result.explicit_md ? result.explicit_md : result.implicit_md;
+  if (result.cached_md != nullptr) return result.cached_md;
+  if (result.digest) {
+    digest_owner.emplace(result.digest);
+    return digest_owner->get();
+  }
+  return nullptr;
 #else
   Utf8Value utf8(env->isolate(), algorithm);
   return ncrypto::getDigestByName(*utf8);
@@ -257,21 +364,12 @@ void MarkInvalidXofLength() {
   EVPerr(EVP_F_EVP_DIGESTFINALXOF, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
 #endif
 }
-// crypto.digest(algorithm, algorithmId, algorithmCache,
-//               input, outputEncoding, outputEncodingId, outputLength)
-void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
-  CHECK_EQ(args.Length(), 7);
-  CHECK(args[0]->IsString());                                  // algorithm
-  CHECK(args[1]->IsInt32());                                   // algorithmId
-  CHECK(args[2]->IsObject());                                  // algorithmCache
-  CHECK(args[3]->IsString() || args[3]->IsArrayBufferView());  // input
-  CHECK(args[4]->IsString());                                  // outputEncoding
-  CHECK(args[5]->IsUint32() || args[5]->IsUndefined());  // outputEncodingId
-  CHECK(args[6]->IsUint32() || args[6]->IsUndefined());  // outputLength
 
-  const EVP_MD* md = GetDigestImplementation(env, args[0], args[1], args[2]);
+void OneShotDigestWithMD(Environment* env,
+                         const FunctionCallbackInfo<Value>& args,
+                         const EVP_MD* md,
+                         const CShakeOptions* options) {
+  Isolate* isolate = env->isolate();
   if (md == nullptr) [[unlikely]] {
     Utf8Value method(isolate, args[0]);
     std::string message =
@@ -312,7 +410,7 @@ void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  if (output_length == 0) {
+  auto return_empty_output = [&]() {
     if (output_enc == BUFFER) {
       Local<Uint8Array> u8;
       if (Buffer::New(isolate, ArrayBuffer::New(isolate, 0), 0, 0)
@@ -322,28 +420,72 @@ void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
     } else {
       args.GetReturnValue().Set(String::Empty(isolate));
     }
+  };
+
+  const bool has_digest_options = options != nullptr && !options->empty();
+  if (output_length == 0 && !has_digest_options) {
+    return return_empty_output();
+  }
+
+  if (!has_digest_options) {
+    DataPointer output = ([&]() -> DataPointer {
+      if (args[3]->IsString()) {
+        Utf8Value utf8(isolate, args[3]);
+        ncrypto::Buffer<const unsigned char> input = {
+            .data = reinterpret_cast<const unsigned char*>(utf8.out()),
+            .len = static_cast<size_t>(utf8.length()),
+        };
+        return is_xof ? ncrypto::xofHashDigest(input, md, output_length)
+                      : ncrypto::hashDigest(input, md);
+      }
+
+      ArrayBufferViewContents<unsigned char> input(args[3]);
+      ncrypto::Buffer<const unsigned char> buffer = {
+          .data = input.data(),
+          .len = input.length(),
+      };
+      return is_xof ? ncrypto::xofHashDigest(buffer, md, output_length)
+                    : ncrypto::hashDigest(buffer, md);
+    })();
+    if (!output) [[unlikely]] {
+      return ThrowCryptoError(env, ERR_get_error());
+    }
+
+    Local<Value> ret;
+    if (StringBytes::Encode(env->isolate(),
+                            static_cast<const char*>(output.get()),
+                            output.size(),
+                            output_enc)
+            .ToLocal(&ret)) {
+      args.GetReturnValue().Set(ret);
+    }
     return;
   }
 
-  DataPointer output = ([&]() -> DataPointer {
+  EVPMDCtxPointer ctx = EVPMDCtxPointer::New();
+  if (!options->Initialize(&ctx, md)) {
+    return ThrowCryptoError(
+        env, ERR_get_error(), "Digest options are not supported");
+  }
+
+  const bool updated = [&]() {
     if (args[3]->IsString()) {
-      Utf8Value utf8(isolate, args[3]);
-      ncrypto::Buffer<const unsigned char> buf = {
-          .data = reinterpret_cast<const unsigned char*>(utf8.out()),
-          .len = utf8.length(),
-      };
-      return is_xof ? ncrypto::xofHashDigest(buf, md, output_length)
-                    : ncrypto::hashDigest(buf, md);
+      Utf8Value input(isolate, args[3]);
+      return ctx.digestUpdate(ncrypto::Buffer<const void>{
+          .data = input.out(),
+          .len = static_cast<size_t>(input.length()),
+      });
     }
 
     ArrayBufferViewContents<unsigned char> input(args[3]);
-    ncrypto::Buffer<const unsigned char> buf = {
-        .data = reinterpret_cast<const unsigned char*>(input.data()),
+    return ctx.digestUpdate(ncrypto::Buffer<const void>{
+        .data = input.data(),
         .len = input.length(),
-    };
-    return is_xof ? ncrypto::xofHashDigest(buf, md, output_length)
-                  : ncrypto::hashDigest(buf, md);
-  })();
+    });
+  }();
+  if (!updated) return ThrowCryptoError(env, ERR_get_error());
+  if (output_length == 0) return return_empty_output();
+  DataPointer output = ctx.digestFinal(output_length);
 
   if (!output) [[unlikely]] {
     return ThrowCryptoError(env, ERR_get_error());
@@ -359,6 +501,54 @@ void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+// crypto.digest(algorithm, algorithmId, algorithmCache, input, outputEncoding,
+//               outputEncodingId, outputLength[, functionName, customization])
+void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK(args.Length() == 7 || args.Length() == 9);
+  CHECK(args[0]->IsString());                                  // algorithm
+  CHECK(args[1]->IsInt32());                                   // algorithmId
+  CHECK(args[2]->IsObject());                                  // algorithmCache
+  CHECK(args[3]->IsString() || args[3]->IsArrayBufferView());  // input
+  CHECK(args[4]->IsString());                                  // outputEncoding
+  CHECK(args[5]->IsUint32() || args[5]->IsUndefined());  // outputEncodingId
+  CHECK(args[6]->IsUint32() || args[6]->IsUndefined());  // outputLength
+
+  if (args.Length() == 7) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    const int32_t cache_id = args[1].As<Int32>()->Value();
+    if (cache_id != -1) {
+      if (const EVP_MD* md =
+              GetCachedMDByID(env, cache_id, args[2].As<Object>())) {
+        return OneShotDigestWithMD(env, args, md, nullptr);
+      }
+      if (env->isolate()->HasPendingException()) return;
+    }
+#else
+    Utf8Value utf8(env->isolate(), args[0]);
+    return OneShotDigestWithMD(
+        env, args, ncrypto::getDigestByName(*utf8), nullptr);
+#endif
+  }
+
+  if (args.Length() == 9) {
+    CShakeOptions options;
+    if (GetCShakeOptions(args, 7, &options).IsNothing()) return;
+
+    std::optional<ncrypto::Digest> digest_owner;
+    const EVP_MD* md =
+        GetDigestImplementation(env, args[0], args[1], args[2], digest_owner);
+    if (env->isolate()->HasPendingException()) return;
+    return OneShotDigestWithMD(env, args, md, &options);
+  }
+
+  std::optional<ncrypto::Digest> digest_owner;
+  const EVP_MD* md =
+      GetDigestImplementation(env, args[0], args[1], args[2], digest_owner);
+  if (env->isolate()->HasPendingException()) return;
+  OneShotDigestWithMD(env, args, md, nullptr);
+}
+
 void Hash::Initialize(Environment* env, Local<Object> target) {
   Isolate* isolate = env->isolate();
   Local<Context> context = env->context();
@@ -395,30 +585,64 @@ void Hash::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 #endif
 }
 
-// new Hash(algorithm, algorithmId, xofLen, algorithmCache)
+// new Hash(algorithm, xofLen, algorithmId, algorithmCache[, functionName,
+//          customization])
 void Hash::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
+  CHECK(args.Length() == 4 || args.Length() == 6);
+
+  Maybe<unsigned int> xof_md_len = Nothing<unsigned int>();
+  if (!args[1]->IsUndefined()) {
+    CHECK(args[1]->IsUint32());
+    xof_md_len = Just<unsigned int>(args[1].As<Uint32>()->Value());
+  }
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // This is the common path after the first lookup. Avoid constructing a
+  // digest owner when the Environment already owns the cached implementation.
+  if (args.Length() == 4 && args[0]->IsString()) {
+    CHECK(args[2]->IsInt32());
+    const int32_t cache_id = args[2].As<Int32>()->Value();
+    if (cache_id != -1) {
+      if (const EVP_MD* md =
+              GetCachedMDByID(env, cache_id, args[3].As<Object>())) {
+        Hash* hash = new Hash(env, args.This());
+        if (!hash->HashInit(md, xof_md_len)) {
+          return ThrowCryptoError(
+              env, ERR_get_error(), "Digest method not supported");
+        }
+        return;
+      }
+      if (env->isolate()->HasPendingException()) return;
+    }
+  }
+#endif
 
   const Hash* orig = nullptr;
+  std::optional<ncrypto::Digest> digest_owner;
   const EVP_MD* md = nullptr;
   if (args[0]->IsObject()) {
     ASSIGN_OR_RETURN_UNWRAP(&orig, args[0].As<Object>());
     CHECK_NOT_NULL(orig);
     md = orig->mdctx_.getDigest();
   } else {
-    md = GetDigestImplementation(env, args[0], args[2], args[3]);
-  }
-
-  Maybe<unsigned int> xof_md_len = Nothing<unsigned int>();
-  if (!args[1]->IsUndefined()) {
-    CHECK(args[1]->IsUint32());
-    xof_md_len = Just<unsigned int>(args[1].As<Uint32>()->Value());
+    md = GetDigestImplementation(env, args[0], args[2], args[3], digest_owner);
+    if (env->isolate()->HasPendingException()) return;
   }
 
   Hash* hash = new Hash(env, args.This());
-  if (md == nullptr || !hash->HashInit(md, xof_md_len)) {
-    return ThrowCryptoError(env, ERR_get_error(),
-                            "Digest method not supported");
+  if (args.Length() == 4) {
+    if (md == nullptr || !hash->HashInit(md, xof_md_len)) {
+      return ThrowCryptoError(
+          env, ERR_get_error(), "Digest method not supported");
+    }
+  } else {
+    CShakeOptions options;
+    if (GetCShakeOptions(args, 4, &options).IsNothing()) return;
+    if (md == nullptr || !hash->HashInit(md, options, xof_md_len)) {
+      return ThrowCryptoError(
+          env, ERR_get_error(), "Digest method not supported");
+    }
   }
 
   if (orig != nullptr && !orig->mdctx_.copyTo(hash->mdctx_)) {
@@ -426,9 +650,9 @@ void Hash::New(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
+bool Hash::HashInit(const EVP_MD* digest, Maybe<unsigned int> xof_md_len) {
   mdctx_ = EVPMDCtxPointer::New();
-  if (!mdctx_.digestInit(md)) [[unlikely]] {
+  if (!mdctx_.digestInit(digest)) [[unlikely]] {
     mdctx_.reset();
     return false;
   }
@@ -436,7 +660,7 @@ bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
   md_len_ = mdctx_.getDigestSize();
   // TODO(@panva): remove this behaviour when DEP0198 is End-Of-Life
   if (mdctx_.hasXofFlag() && !xof_md_len.IsJust() && md_len_ == 0) {
-    const char* name = OBJ_nid2sn(EVP_MD_type(md));
+    const char* name = OBJ_nid2sn(EVP_MD_type(digest));
     if (name != nullptr) {
       if (strcmp(name, "SHAKE128") == 0) {
         md_len_ = 16;
@@ -460,6 +684,30 @@ bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
   return true;
 }
 
+bool Hash::HashInit(const EVP_MD* digest,
+                    const CShakeOptions& options,
+                    Maybe<unsigned int> xof_md_len) {
+  mdctx_ = EVPMDCtxPointer::New();
+  if (!options.Initialize(&mdctx_, digest)) [[unlikely]] {
+    mdctx_.reset();
+    return false;
+  }
+
+  md_len_ = mdctx_.getDigestSize();
+  if (xof_md_len.IsJust() && xof_md_len.FromJust() != md_len_) {
+    // This is a little hack to cause createHash to fail when an incorrect
+    // hashSize option was passed for a non-XOF hash function.
+    if (!mdctx_.hasXofFlag()) [[unlikely]] {
+      MarkInvalidXofLength();
+      mdctx_.reset();
+      return false;
+    }
+    md_len_ = xof_md_len.FromJust();
+  }
+
+  return true;
+}
+
 bool Hash::HashUpdate(const char* data, size_t len) {
   if (!mdctx_) return false;
   return mdctx_.digestUpdate(ncrypto::Buffer<const void>{
@@ -524,7 +772,10 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
 }
 
 HashConfig::HashConfig(HashConfig&& other) noexcept
-    : in(std::move(other.in)), digest(other.digest), length(other.length) {}
+    : in(std::move(other.in)),
+      digest(other.digest),
+      options(std::move(other.options)),
+      length(other.length) {}
 
 HashConfig& HashConfig::operator=(HashConfig&& other) noexcept {
   if (&other == this) return *this;
@@ -534,6 +785,9 @@ HashConfig& HashConfig::operator=(HashConfig&& other) noexcept {
 
 void HashConfig::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TraitTrackInline(in, "in");
+  if (options.has_value()) {
+    tracker->TrackField("options", *options);
+  }
 }
 
 MaybeLocal<Value> HashTraits::EncodeOutput(Environment* env,
@@ -551,8 +805,8 @@ Maybe<void> HashTraits::AdditionalConfig(
 
   CHECK(args[offset]->IsString());  // Hash algorithm
   Utf8Value digest(env->isolate(), args[offset]);
-  params->digest = ncrypto::getDigestByName(*digest);
-  if (params->digest == nullptr) [[unlikely]] {
+  params->digest = ncrypto::Digest::FromName(*digest);
+  if (!params->digest) [[unlikely]] {
     THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Invalid digest: %s", digest);
     return Nothing<void>();
   }
@@ -564,7 +818,14 @@ Maybe<void> HashTraits::AdditionalConfig(
   }
   params->in = IsCryptoJobAsync(mode) ? data.ToCopy() : data.ToByteSource();
 
-  unsigned int expected = EVP_MD_size(params->digest);
+  if (static_cast<unsigned int>(args.Length()) > offset + 3) {
+    params->options.emplace();
+    if (GetCShakeOptions(args, offset + 3, &*params->options).IsNothing()) {
+      return Nothing<void>();
+    }
+  }
+
+  unsigned int expected = EVP_MD_size(params->digest.get());
   params->length = expected;
   if (args[offset + 2]->IsUint32()) [[unlikely]] {
     // length is expressed in terms of bits
@@ -572,7 +833,8 @@ Maybe<void> HashTraits::AdditionalConfig(
         static_cast<uint32_t>(args[offset + 2].As<Uint32>()->Value()) /
         CHAR_BIT;
     if (params->length != expected) {
-      if ((EVP_MD_flags(params->digest) & EVP_MD_FLAG_XOF) == 0) [[unlikely]] {
+      if ((EVP_MD_flags(params->digest.get()) & EVP_MD_FLAG_XOF) == 0)
+          [[unlikely]] {
         THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Digest method not supported");
         return Nothing<void>();
       }
@@ -588,8 +850,11 @@ bool HashTraits::DeriveBits(Environment* env,
                             CryptoJobMode mode) {
   auto ctx = EVPMDCtxPointer::New();
 
-  if (!ctx.digestInit(params.digest) || !ctx.digestUpdate(params.in))
-      [[unlikely]] {
+  const bool initialized =
+      params.options.has_value()
+          ? params.options->Initialize(&ctx, params.digest.get())
+          : ctx.digestInit(params.digest.get());
+  if (!initialized || !ctx.digestUpdate(params.in)) [[unlikely]] {
     return false;
   }
 
@@ -807,6 +1072,11 @@ Maybe<void> CShakeTraits::AdditionalConfig(
     CShakeConfig* params) {
   Environment* env = Environment::GetCurrent(args);
 
+  if (IsFipsEnabled()) {
+    THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(env);
+    return Nothing<void>();
+  }
+
   CHECK(args[offset]->IsString());  // Algorithm name
   Utf8Value algorithm_name(env->isolate(), args[offset]);
   std::string_view algorithm_str = algorithm_name.ToStringView();
diff --git a/src/crypto/crypto_hash.h b/src/crypto/crypto_hash.h
index 0d90a4045f25..2bab4c24bd5c 100644
--- a/src/crypto/crypto_hash.h
+++ b/src/crypto/crypto_hash.h
@@ -21,7 +21,10 @@ class Hash final : public BaseObject {
   SET_MEMORY_INFO_NAME(Hash)
   SET_SELF_SIZE(Hash)
 
-  bool HashInit(const EVP_MD* md, v8::Maybe<unsigned int> xof_md_len);
+  bool HashInit(const EVP_MD* digest, v8::Maybe<unsigned int> xof_md_len);
+  bool HashInit(const EVP_MD* digest,
+                const CShakeOptions& options,
+                v8::Maybe<unsigned int> xof_md_len);
   bool HashUpdate(const char* data, size_t len);
 
   static void GetHashes(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -43,7 +46,8 @@ class Hash final : public BaseObject {
 
 struct HashConfig final : public MemoryRetainer {
   ByteSource in;
-  const EVP_MD* digest;
+  ncrypto::Digest digest;
+  std::optional<CShakeOptions> options;
   unsigned int length;
 
   HashConfig() = default;
diff --git a/src/crypto/crypto_hmac.cc b/src/crypto/crypto_hmac.cc
index 62a3aa2bacaf..9cf1d11c1263 100644
--- a/src/crypto/crypto_hmac.cc
+++ b/src/crypto/crypto_hmac.cc
@@ -141,6 +141,9 @@ void Hmac::HmacDigest(const FunctionCallbackInfo<Value>& args) {
       return ThrowCryptoError(env, ERR_get_error(), "Failed to finalize HMAC");
     }
     hmac->ctx_.reset();
+  } else {
+    // The context has already been finalized; never emit unwritten bytes.
+    buf.len = 0;
   }
 
   Local<Value> ret;
diff --git a/src/crypto/crypto_keygen.cc b/src/crypto/crypto_keygen.cc
index fd456465e0ee..7e273eb57a59 100644
--- a/src/crypto/crypto_keygen.cc
+++ b/src/crypto/crypto_keygen.cc
@@ -15,7 +15,6 @@ namespace node {
 using ncrypto::DataPointer;
 using ncrypto::EVPKeyCtxPointer;
 using v8::FunctionCallbackInfo;
-using v8::Int32;
 using v8::JustVoid;
 using v8::Local;
 using v8::Maybe;
@@ -25,30 +24,32 @@ using v8::Uint32;
 using v8::Value;
 
 namespace crypto {
-// NidKeyPairGenJob input arguments:
+// NamedKeyPairGenJob input arguments:
 //   1. CryptoJobMode
-//   2. NID
+//   2. Algorithm name
 //   3. Public Format
 //   4. Public Type
 //   5. Private Format
 //   6. Private Type
 //   7. Cipher
 //   8. Passphrase
-Maybe<void> NidKeyPairGenTraits::AdditionalConfig(
+Maybe<void> NamedKeyPairGenTraits::AdditionalConfig(
     CryptoJobMode mode,
     const FunctionCallbackInfo<Value>& args,
     unsigned int* offset,
-    NidKeyPairGenConfig* params) {
-  CHECK(args[*offset]->IsInt32());
-  params->params.id = args[*offset].As<Int32>()->Value();
+    NamedKeyPairGenConfig* params) {
+  CHECK(args[*offset]->IsString());
+  Utf8Value name(args.GetIsolate(), args[*offset]);
+  params->params.algorithm = ncrypto::KeyAlgorithm::FromName(*name);
+  CHECK_NOT_NULL(params->params.algorithm);
 
   *offset += 1;
 
   return JustVoid();
 }
 
-EVPKeyCtxPointer NidKeyPairGenTraits::Setup(NidKeyPairGenConfig* params) {
-  auto ctx = EVPKeyCtxPointer::NewFromID(params->params.id);
+EVPKeyCtxPointer NamedKeyPairGenTraits::Setup(NamedKeyPairGenConfig* params) {
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(*params->params.algorithm);
   if (!ctx || !ctx.initForKeygen()) return {};
   return ctx;
 }
@@ -96,12 +97,12 @@ MaybeLocal<Value> SecretKeyGenTraits::EncodeKey(Environment* env,
 
 namespace Keygen {
 void Initialize(Environment* env, Local<Object> target) {
-  NidKeyPairGenJob::Initialize(env, target);
+  NamedKeyPairGenJob::Initialize(env, target);
   SecretKeyGenJob::Initialize(env, target);
 }
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
-  NidKeyPairGenJob::RegisterExternalReferences(registry);
+  NamedKeyPairGenJob::RegisterExternalReferences(registry);
   SecretKeyGenJob::RegisterExternalReferences(registry);
 }
 }  // namespace Keygen
diff --git a/src/crypto/crypto_keygen.h b/src/crypto/crypto_keygen.h
index 61421bfe5c11..c042edd2b9ad 100644
--- a/src/crypto/crypto_keygen.h
+++ b/src/crypto/crypto_keygen.h
@@ -352,29 +352,29 @@ struct KeyPairGenConfig final : public MemoryRetainer {
   SET_SELF_SIZE(KeyPairGenConfig)
 };
 
-struct NidKeyPairParams final : public MemoryRetainer {
-  int id;
+struct NamedKeyPairParams final : public MemoryRetainer {
+  const ncrypto::KeyAlgorithm* algorithm = nullptr;
   SET_NO_MEMORY_INFO()
-  SET_MEMORY_INFO_NAME(NidKeyPairParams)
-  SET_SELF_SIZE(NidKeyPairParams)
+  SET_MEMORY_INFO_NAME(NamedKeyPairParams)
+  SET_SELF_SIZE(NamedKeyPairParams)
 };
 
-using NidKeyPairGenConfig = KeyPairGenConfig<NidKeyPairParams>;
+using NamedKeyPairGenConfig = KeyPairGenConfig<NamedKeyPairParams>;
 
-struct NidKeyPairGenTraits final {
-  using AdditionalParameters = NidKeyPairGenConfig;
-  static constexpr const char* JobName = "NidKeyPairGenJob";
+struct NamedKeyPairGenTraits final {
+  using AdditionalParameters = NamedKeyPairGenConfig;
+  static constexpr const char* JobName = "NamedKeyPairGenJob";
 
-  static ncrypto::EVPKeyCtxPointer Setup(NidKeyPairGenConfig* params);
+  static ncrypto::EVPKeyCtxPointer Setup(NamedKeyPairGenConfig* params);
 
   static v8::Maybe<void> AdditionalConfig(
       CryptoJobMode mode,
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int* offset,
-      NidKeyPairGenConfig* params);
+      NamedKeyPairGenConfig* params);
 };
 
-using NidKeyPairGenJob = KeyGenJob<KeyPairGenTraits<NidKeyPairGenTraits>>;
+using NamedKeyPairGenJob = KeyGenJob<KeyPairGenTraits<NamedKeyPairGenTraits>>;
 using SecretKeyGenJob = KeyGenJob<SecretKeyGenTraits>;
 }  // namespace node::crypto
 
diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
index c501a64ce8fb..e67594e05352 100644
--- a/src/crypto/crypto_keys.cc
+++ b/src/crypto/crypto_keys.cc
@@ -5,7 +5,6 @@
 #include "crypto/crypto_dh.h"
 #include "crypto/crypto_dsa.h"
 #include "crypto/crypto_ec.h"
-#include "crypto/crypto_pqc.h"
 #include "crypto/crypto_rsa.h"
 #include "crypto/crypto_util.h"
 #include "env-inl.h"
@@ -26,6 +25,7 @@ using ncrypto::ECKeyPointer;
 using ncrypto::ECPointPointer;
 using ncrypto::EVPKeyCtxPointer;
 using ncrypto::EVPKeyPointer;
+using ncrypto::KeyAlgorithm;
 using ncrypto::MarkPopErrorOnReturn;
 using ncrypto::PKCS8Pointer;
 using v8::Array;
@@ -178,28 +178,128 @@ KeyObjectData ImportJWKSecretKey(Environment* env, Local<Object> jwk) {
       ByteSource::FromEncodedString(env, key.As<String>()));
 }
 
+static bool ExportJWKRawKey(Environment* env,
+                            const KeyObjectData& key,
+                            Local<Object> target) {
+  Mutex::ScopedLock lock(key.mutex());
+  auto result =
+      key.GetAsymmetricKey().exportRawJwk(key.GetKeyType() == kKeyTypePrivate);
+  if (!result) {
+    if (result.error == EVPKeyPointer::RawExportError::MISSING_SEED) {
+      THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                        "key does not have an available seed");
+    }
+    return false;
+  }
+  const auto& data = result.value;
+  const bool is_akp = data.algorithm->isPqc();
+  const auto name_field =
+      is_akp ? env->jwk_alg_string() : env->jwk_crv_string();
+  const auto public_field =
+      is_akp ? env->jwk_pub_string() : env->jwk_x_string();
+  const auto private_field =
+      is_akp ? env->jwk_priv_string() : env->jwk_d_string();
+  const auto kty = is_akp ? env->jwk_akp_string() : env->jwk_okp_string();
+  const auto context = env->context();
+  const auto set_key = [&](const ncrypto::DataPointer& bytes,
+                           Local<String> field) {
+    Local<Value> encoded;
+    return StringBytes::Encode(
+               env->isolate(), bytes.get<const char>(), bytes.size(), BASE64URL)
+               .ToLocal(&encoded) &&
+           target->DefineOwnProperty(context, field, encoded).FromMaybe(false);
+  };
+  return target->DefineOwnProperty(context, env->jwk_kty_string(), kty)
+             .FromMaybe(false) &&
+         target
+             ->DefineOwnProperty(
+                 context,
+                 name_field,
+                 OneByteString(env->isolate(), data.algorithm->name()))
+             .FromMaybe(false) &&
+         set_key(data.public_key, public_field) &&
+         (!data.private_key || set_key(data.private_key, private_field));
+}
+
+static KeyObjectData ImportJWKRawKey(Environment* env,
+                                     Local<Object> jwk,
+                                     bool is_akp) {
+  const auto name_field =
+      is_akp ? env->jwk_alg_string() : env->jwk_crv_string();
+  const auto public_field =
+      is_akp ? env->jwk_pub_string() : env->jwk_x_string();
+  const auto private_field =
+      is_akp ? env->jwk_priv_string() : env->jwk_d_string();
+  const char* invalid_key =
+      is_akp ? "Invalid JWK AKP key" : "Invalid JWK OKP key";
+  Local<Value> name_value;
+  Local<Value> public_value;
+  Local<Value> private_value;
+  if (!jwk->Get(env->context(), name_field).ToLocal(&name_value) ||
+      !jwk->Get(env->context(), public_field).ToLocal(&public_value) ||
+      !jwk->Get(env->context(), private_field).ToLocal(&private_value)) {
+    return {};
+  }
+  const bool valid_material =
+      public_value->IsString() &&
+      (private_value->IsUndefined() || private_value->IsString());
+  // OKP validates the field types first; AKP validates its algorithm first.
+  if (!is_akp && (!name_value->IsString() || !valid_material)) {
+    THROW_ERR_CRYPTO_INVALID_JWK(env, invalid_key);
+    return {};
+  }
+  Utf8Value name(env->isolate(),
+                 name_value->IsString() ? name_value.As<String>()
+                                        : String::Empty(env->isolate()));
+  const auto* algorithm = KeyAlgorithm::FromName(*name);
+  if (algorithm == nullptr ||
+      (is_akp ? !algorithm->isPqc() || !algorithm->isAvailable()
+              : !algorithm->isOkp()) ||
+      strcmp(*name, algorithm->name()) != 0) {
+    THROW_ERR_CRYPTO_INVALID_JWK(
+        env, is_akp ? "Unsupported JWK AKP \"alg\"" : invalid_key);
+    return {};
+  }
+  if (!valid_material) {
+    THROW_ERR_CRYPTO_INVALID_JWK(env, invalid_key);
+    return {};
+  }
+  ByteSource private_bytes;
+  std::optional<ncrypto::Buffer<const unsigned char>> private_key;
+  const KeyType type =
+      private_value->IsString() ? kKeyTypePrivate : kKeyTypePublic;
+  if (type == kKeyTypePrivate) {
+    private_bytes =
+        ByteSource::FromEncodedString(env, private_value.As<String>());
+    private_key = ncrypto::Buffer<const unsigned char>{
+        private_bytes.data<const unsigned char>(), private_bytes.size()};
+  }
+  const auto public_bytes =
+      ByteSource::FromEncodedString(env, public_value.As<String>());
+  auto pkey = EVPKeyPointer::NewRawJwk(
+      *algorithm,
+      {public_bytes.data<const unsigned char>(), public_bytes.size()},
+      private_key);
+  if (!pkey) {
+    THROW_ERR_CRYPTO_INVALID_JWK(env, invalid_key);
+    return {};
+  }
+  return KeyObjectData::CreateAsymmetric(type, std::move(pkey));
+}
+
 bool ExportJWKAsymmetricKey(Environment* env,
                             const KeyObjectData& key,
                             Local<Object> target,
                             bool handleRsaPss) {
-  const int id = key.GetAsymmetricKey().id();
-#if OPENSSL_WITH_PQC
-  if (IsPqcKeyId(id)) return ExportJwkPqcKey(env, key, target);
-#endif
-  switch (id) {
-    case EVP_PKEY_RSA_PSS: {
-      if (handleRsaPss) return ExportJWKRsaKey(env, key, target);
-      break;
-    }
-    case EVP_PKEY_RSA:
-      return ExportJWKRsaKey(env, key, target);
-    case EVP_PKEY_EC:
-      return ExportJWKEcKey(env, key, target);
-    case EVP_PKEY_ED25519:
-    case EVP_PKEY_ED448:
-    case EVP_PKEY_X25519:
-    case EVP_PKEY_X448:
-      return ExportJWKEdKey(env, key, target);
+  const auto& pkey = key.GetAsymmetricKey();
+  const auto* algorithm = pkey.getAlgorithm();
+  if (algorithm == &KeyAlgorithm::RSA ||
+      (handleRsaPss && algorithm == &KeyAlgorithm::RSA_PSS)) {
+    return ExportJWKRsaKey(env, key, target);
+  }
+  if (algorithm == &KeyAlgorithm::EC) return ExportJWKEcKey(env, key, target);
+  if (algorithm != nullptr && (algorithm->isOkp() || algorithm->isPqc())) {
+    return ExportJWKRawKey(env, key, target);
   }
   THROW_ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE(env);
   return false;
@@ -226,16 +326,15 @@ bool GetAsymmetricKeyDetail(Environment* env,
     THROW_ERR_CRYPTO_OPERATION_FAILED(env);
     return false;
   }
-  switch (key.GetAsymmetricKey().id()) {
-    case EVP_PKEY_RSA:
-      // Fall through
-    case EVP_PKEY_RSA2:
-      // Fall through
-    case EVP_PKEY_RSA_PSS: return GetRsaKeyDetail(env, key, target);
-    case EVP_PKEY_DSA: return GetDsaKeyDetail(env, key, target);
-    case EVP_PKEY_EC: return GetEcKeyDetail(env, key, target);
-    case EVP_PKEY_DH: return GetDhKeyDetail(env, key, target);
+  const auto& pkey = key.GetAsymmetricKey();
+  const auto* algorithm = pkey.getAlgorithm();
+  // Preserve RSA2 support on legacy backends without exposing its numeric ID.
+  if (algorithm != nullptr ? algorithm->isRsa() : pkey.isRsaVariant()) {
+    return GetRsaKeyDetail(env, key, target);
   }
+  if (algorithm == &KeyAlgorithm::DSA) return GetDsaKeyDetail(env, key, target);
+  if (algorithm == &KeyAlgorithm::EC) return GetEcKeyDetail(env, key, target);
+  if (algorithm == &KeyAlgorithm::DH) return GetDhKeyDetail(env, key, target);
   THROW_ERR_CRYPTO_INVALID_KEYTYPE(env);
   return false;
 }
@@ -269,103 +368,30 @@ bool ExportJWKInner(Environment* env,
                    env, key, result.As<Object>(), handleRsaPss);
 }
 
-int GetNidFromName(const char* name) {
-  static constexpr struct {
-    const char* name;
-    int nid;
-  } kNameToNid[] = {
-      {"Ed25519", EVP_PKEY_ED25519},
-      {"Ed448", EVP_PKEY_ED448},
-      {"X25519", EVP_PKEY_X25519},
-      {"X448", EVP_PKEY_X448},
-  };
-  for (const auto& entry : kNameToNid) {
-    if (StringEqualNoCase(name, entry.name)) return entry.nid;
-  }
-#if OPENSSL_WITH_PQC
-  return GetPqcNidFromName(name);
-#else
-  return NID_undef;
-#endif
-}
-
-bool IsUnavailablePqcKeyType(Environment* env, Local<String> key_type) {
-  return key_type->StringEquals(env->crypto_ml_dsa_44_string()) ||
-         key_type->StringEquals(env->crypto_ml_dsa_65_string()) ||
-         key_type->StringEquals(env->crypto_ml_dsa_87_string()) ||
-         key_type->StringEquals(env->crypto_ml_kem_512_string()) ||
-         key_type->StringEquals(env->crypto_ml_kem_768_string()) ||
-         key_type->StringEquals(env->crypto_ml_kem_1024_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_sha2_128f_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_sha2_128s_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_sha2_192f_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_sha2_192s_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_sha2_256f_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_sha2_256s_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_shake_128f_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_shake_128s_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_shake_192f_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_shake_192s_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_shake_256f_string()) ||
-         key_type->StringEquals(env->crypto_slh_dsa_shake_256s_string());
-}
-
-bool IsUnsupportedRawKeyType(Environment* env, Local<String> key_type) {
-  return key_type->StringEquals(env->crypto_rsa_string()) ||
-         key_type->StringEquals(env->crypto_rsa_pss_string()) ||
-         key_type->StringEquals(env->crypto_dsa_string()) ||
-         key_type->StringEquals(env->crypto_dh_string());
-}
-
 void ValidateRawKeyImportFormat(Environment* env,
-                                Local<String> key_type,
                                 const char* key_type_name,
-                                int id,
+                                const KeyAlgorithm* algorithm,
                                 EVPKeyPointer::PKFormatType format) {
-  auto validate_raw_format =
-      [&](EVPKeyPointer::PKFormatType expected_private_format) {
-        if (format == EVPKeyPointer::PKFormatType::RAW_PUBLIC ||
-            format == expected_private_format) {
-          return;
-        }
-        THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-      };
-
-  if (key_type->StringEquals(env->crypto_ec_string())) {
-    return validate_raw_format(EVPKeyPointer::PKFormatType::RAW_PRIVATE);
-  }
-
-  switch (id) {
-    case EVP_PKEY_X25519:
-    case EVP_PKEY_X448:
-    case EVP_PKEY_ED25519:
-    case EVP_PKEY_ED448:
-      return validate_raw_format(EVPKeyPointer::PKFormatType::RAW_PRIVATE);
-    default:
-      break;
-  }
-
-#if OPENSSL_WITH_PQC
-  if (IsPqcSeedKeyId(id)) {
-    return validate_raw_format(EVPKeyPointer::PKFormatType::RAW_SEED);
-  }
-  if (IsPqcRawPrivateKeyId(id)) {
-    return validate_raw_format(EVPKeyPointer::PKFormatType::RAW_PRIVATE);
+  if (algorithm == nullptr) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env, "Invalid asymmetricKeyType: %s", key_type_name);
+    return;
   }
-#endif
-
-  if (IsUnavailablePqcKeyType(env, key_type)) {
+  if (algorithm->isPqc() && !algorithm->isAvailable()) {
     THROW_ERR_INVALID_ARG_VALUE(env, "Unsupported key type");
     return;
   }
 
-  if (IsUnsupportedRawKeyType(env, key_type)) {
-    THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
+  const auto private_format = algorithm->seedSize() != 0
+                                  ? EVPKeyPointer::PKFormatType::RAW_SEED
+                                  : EVPKeyPointer::PKFormatType::RAW_PRIVATE;
+  const bool supports_raw =
+      algorithm == &KeyAlgorithm::EC || algorithm->supportsRawPublic();
+  if (supports_raw && (format == EVPKeyPointer::PKFormatType::RAW_PUBLIC ||
+                       format == private_format)) {
     return;
   }
-
-  THROW_ERR_INVALID_ARG_VALUE(
-      env, "Invalid asymmetricKeyType: %s", key_type_name);
+  THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
 }
 }  // namespace
 
@@ -386,29 +412,29 @@ bool KeyObjectData::ToEncodedPublicKey(
   } else if (config.format == EVPKeyPointer::PKFormatType::RAW_PUBLIC) {
     Mutex::ScopedLock lock(mutex());
     const auto& pkey = GetAsymmetricKey();
-    if (pkey.id() == EVP_PKEY_EC) {
+    const auto* algorithm = pkey.getAlgorithm();
+    if (algorithm == &KeyAlgorithm::EC) {
+      auto form = static_cast<point_conversion_form_t>(config.ec_point_form);
+      auto bytes = ncrypto::Ec::TryExportPublic(pkey, form);
+      if (bytes)
+        return Buffer::Copy(env, bytes.get<const char>(), bytes.size())
+            .ToLocal(out);
       ECKeyPointer ec_key(pkey);
       if (!ec_key) {
         THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
         return false;
       }
-      // A provider-backed key need not expose its public point.
       if (ec_key.getPublicKey() == nullptr) {
         THROW_ERR_CRYPTO_OPERATION_FAILED(env,
                                           "Failed to export EC public key");
         return false;
       }
-      auto form = static_cast<point_conversion_form_t>(config.ec_point_form);
-      const auto group = ec_key.getGroup();
-      const auto point = ec_key.getPublicKey();
-      return ECPointToBuffer(env, group, point, form).ToLocal(out);
+      return ECPointToBuffer(
+                 env, ec_key.getGroup(), ec_key.getPublicKey(), form)
+          .ToLocal(out);
     }
-    const int id = pkey.id();
-    bool is_raw_supported = id == EVP_PKEY_ED25519 || id == EVP_PKEY_ED448 ||
-                            id == EVP_PKEY_X25519 || id == EVP_PKEY_X448;
-#if OPENSSL_WITH_PQC
-    is_raw_supported = is_raw_supported || IsPqcKeyId(id);
-#endif
+    const bool is_raw_supported =
+        algorithm != nullptr && algorithm->supportsRawPublic();
     if (!is_raw_supported) {
       THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
       return false;
@@ -441,26 +467,9 @@ bool KeyObjectData::ToEncodedPrivateKey(
   } else if (config.format == EVPKeyPointer::PKFormatType::RAW_PRIVATE) {
     Mutex::ScopedLock lock(mutex());
     const auto& pkey = GetAsymmetricKey();
-    if (pkey.id() == EVP_PKEY_EC) {
-      ECKeyPointer ec_key(pkey);
-      if (!ec_key) {
-        THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-        return false;
-      }
-      const BIGNUM* private_key = ec_key.getPrivateKey();
-      if (private_key == nullptr) {
-        THROW_ERR_CRYPTO_OPERATION_FAILED(env,
-                                          "Failed to export EC private key");
-        return false;
-      }
-      const auto group = ec_key.getGroup();
-      auto order = BignumPointer::New();
-      if (!order || !EC_GROUP_get_order(group, order.get(), nullptr)) {
-        THROW_ERR_CRYPTO_OPERATION_FAILED(env,
-                                          "Failed to export EC private key");
-        return false;
-      }
-      auto buf = BignumPointer::EncodePadded(private_key, order.byteLength());
+    const auto* algorithm = pkey.getAlgorithm();
+    if (algorithm == &KeyAlgorithm::EC) {
+      auto buf = ncrypto::Ec::ExportPrivate(pkey);
       if (!buf) {
         THROW_ERR_CRYPTO_OPERATION_FAILED(env,
                                           "Failed to export EC private key");
@@ -468,12 +477,8 @@ bool KeyObjectData::ToEncodedPrivateKey(
       }
       return Buffer::Copy(env, buf.get<const char>(), buf.size()).ToLocal(out);
     }
-    const int id = pkey.id();
-    bool is_raw_supported = id == EVP_PKEY_ED25519 || id == EVP_PKEY_ED448 ||
-                            id == EVP_PKEY_X25519 || id == EVP_PKEY_X448;
-#if OPENSSL_WITH_PQC
-    is_raw_supported = is_raw_supported || IsPqcRawPrivateKeyId(id);
-#endif
+    const bool is_raw_supported =
+        algorithm != nullptr && algorithm->supportsRawPrivate();
     if (!is_raw_supported) {
       THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
       return false;
@@ -486,24 +491,21 @@ bool KeyObjectData::ToEncodedPrivateKey(
     return Buffer::Copy(env, raw_data.get<const char>(), raw_data.size())
         .ToLocal(out);
   } else if (config.format == EVPKeyPointer::PKFormatType::RAW_SEED) {
-#if OPENSSL_WITH_PQC
     Mutex::ScopedLock lock(mutex());
     const auto& pkey = GetAsymmetricKey();
-    if (!IsPqcSeedKeyId(pkey.id())) {
-      THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-      return false;
-    }
     auto raw_data = pkey.rawSeed();
     if (!raw_data) {
-      THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to get raw seed");
+      if (raw_data.error ==
+          EVPKeyPointer::RawExportError::UNSUPPORTED_KEY_TYPE) {
+        THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
+      } else {
+        THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to get raw seed");
+      }
       return false;
     }
-    return Buffer::Copy(env, raw_data.get<const char>(), raw_data.size())
+    return Buffer::Copy(
+               env, raw_data.value.get<const char>(), raw_data.value.size())
         .ToLocal(out);
-#else
-    THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-    return false;
-#endif
   }
 
   return WritePrivateKey(env, GetAsymmetricKey(), config).ToLocal(out);
@@ -537,8 +539,8 @@ KeyObjectData::GetPrivateKeyEncodingFromJs(
     if (context != kKeyContextInput) {
       if (args[*offset]->IsString()) {
         Utf8Value cipher_name(env->isolate(), args[*offset]);
-        config.cipher = ncrypto::getCipherByName(*cipher_name);
-        if (config.cipher == nullptr) {
+        config.cipher = ncrypto::Cipher::FromNameForKeyEncoding(*cipher_name);
+        if (!config.cipher) {
           THROW_ERR_CRYPTO_UNKNOWN_CIPHER(env);
           return Nothing<EVPKeyPointer::PrivateKeyEncodingConfig>();
         }
@@ -551,7 +553,7 @@ KeyObjectData::GetPrivateKeyEncodingFromJs(
     }
 
     if (IsAnyBufferSource(args[*offset])) {
-      CHECK_IMPLIES(context != kKeyContextInput, config.cipher != nullptr);
+      CHECK_IMPLIES(context != kKeyContextInput, config.cipher);
       ArrayBufferOrViewContents<char> passphrase(args[*offset]);
       if (!passphrase.CheckSizeInt32()) [[unlikely]] {
         THROW_ERR_OUT_OF_RANGE(env, "passphrase is too big");
@@ -581,7 +583,7 @@ static KeyObjectData ImportRawKey(Environment* env,
                                   const unsigned char* key_data,
                                   size_t key_data_len,
                                   EVPKeyPointer::PKFormatType format,
-                                  Local<String> key_type,
+                                  const KeyAlgorithm* algorithm,
                                   const char* key_type_name,
                                   const char* named_curve,
                                   KeyType target_type) {
@@ -591,14 +593,13 @@ static KeyObjectData ImportRawKey(Environment* env,
     }
   };
 
-  const int id = GetNidFromName(key_type_name);
-  ValidateRawKeyImportFormat(env, key_type, key_type_name, id, format);
+  ValidateRawKeyImportFormat(env, key_type_name, algorithm, format);
   if (env->isolate()->HasPendingException()) {
     return {};
   }
 
   // EC keys
-  if (key_type->StringEquals(env->crypto_ec_string())) {
+  if (algorithm == &KeyAlgorithm::EC) {
     int curve_nid = ncrypto::Ec::GetCurveIdFromName(named_curve);
     if (curve_nid == NID_undef) {
       THROW_ERR_CRYPTO_INVALID_CURVE(env);
@@ -656,45 +657,23 @@ static KeyObjectData ImportRawKey(Environment* env,
     return KeyObjectData::CreateAsymmetric(target_type, std::move(pkey));
   }
 
-  typedef EVPKeyPointer (*new_key_fn)(
-      int, const ncrypto::Buffer<const unsigned char>&);
-  new_key_fn fn = nullptr;
-  switch (id) {
-    case EVP_PKEY_X25519:
-    case EVP_PKEY_X448:
-    case EVP_PKEY_ED25519:
-    case EVP_PKEY_ED448:
-      fn = target_type == kKeyTypePrivate ? EVPKeyPointer::NewRawPrivate
-                                          : EVPKeyPointer::NewRawPublic;
-      break;
-    default:
-#if OPENSSL_WITH_PQC
-      if (IsPqcKeyId(id)) {
-        if (target_type == kKeyTypePrivate) {
-          fn = IsPqcSeedKeyId(id) ? EVPKeyPointer::NewRawSeed
-                                  : EVPKeyPointer::NewRawPrivate;
-        } else {
-          fn = EVPKeyPointer::NewRawPublic;
-        }
-      }
-#endif
-      break;
+  const ncrypto::Buffer<const unsigned char> buffer{
+      .data = key_data,
+      .len = key_data_len,
+  };
+  EVPKeyPointer pkey;
+  if (target_type == kKeyTypePublic) {
+    pkey = EVPKeyPointer::NewRawPublic(*algorithm, buffer);
+  } else if (algorithm->seedSize() != 0) {
+    pkey = EVPKeyPointer::NewRawSeed(*algorithm, buffer);
+  } else {
+    pkey = EVPKeyPointer::NewRawPrivate(*algorithm, buffer);
   }
-
-  if (fn != nullptr) {
-    auto pkey = fn(id,
-                   ncrypto::Buffer<const unsigned char>{
-                       .data = key_data,
-                       .len = key_data_len,
-                   });
-    if (!pkey) {
-      throw_invalid();
-      return {};
-    }
-    return KeyObjectData::CreateAsymmetric(target_type, std::move(pkey));
+  if (!pkey) {
+    throw_invalid();
+    return {};
   }
-
-  return {};
+  return KeyObjectData::CreateAsymmetric(target_type, std::move(pkey));
 }
 
 // Shared helper for importing a JWK asymmetric key.  Extracts kty from the
@@ -712,14 +691,9 @@ static KeyObjectData ImportJWKFromArgs(Environment* env, Local<Object> jwk) {
   } else if (*kty_string == std::string_view("EC")) {
     return ImportJWKEcKey(env, jwk);
   } else if (*kty_string == std::string_view("OKP")) {
-    return ImportJWKEdKey(env, jwk);
+    return ImportJWKRawKey(env, jwk, /* is_akp */ false);
   } else if (*kty_string == std::string_view("AKP")) {
-#if OPENSSL_WITH_PQC
-    return ImportJWKPqcKey(env, jwk);
-#else
-    THROW_ERR_INVALID_ARG_VALUE(env, "Unsupported key type");
-    return {};
-#endif
+    return ImportJWKRawKey(env, jwk, /* is_akp */ true);
   }
 
   THROW_ERR_CRYPTO_INVALID_JWK(
@@ -748,11 +722,16 @@ static KeyObjectData ImportRawKeyFromArgs(
   }
 
   CHECK(args[offset + 2]->IsString());
-  Local<String> key_type = args[offset + 2].As<String>();
-  Utf8Value key_type_name(env->isolate(), key_type);
+  Utf8Value key_type_name(env->isolate(), args[offset + 2]);
+  const auto* algorithm = KeyAlgorithm::FromName(*key_type_name);
+  // Raw key types require their exact public spelling.
+  if (algorithm != nullptr &&
+      (algorithm->keyTypeName() == nullptr ||
+       key_type_name.ToStringView() != algorithm->keyTypeName())) {
+    algorithm = nullptr;
+  }
 
-  DCHECK_IMPLIES(key_type->StringEquals(env->crypto_ec_string()),
-                 args[offset + 4]->IsString());
+  DCHECK_IMPLIES(algorithm == &KeyAlgorithm::EC, args[offset + 4]->IsString());
   Utf8Value curve(env->isolate(),
                   args[offset + 4]->IsString() ? args[offset + 4].As<String>()
                                                : String::Empty(env->isolate()));
@@ -761,7 +740,7 @@ static KeyObjectData ImportRawKeyFromArgs(
                       key_data.data(),
                       key_data.size(),
                       format,
-                      key_type,
+                      algorithm,
                       *key_type_name,
                       *curve,
                       type);
@@ -1379,33 +1358,10 @@ void KeyObjectHandle::GetKeyDetail(const FunctionCallbackInfo<Value>& args) {
 }
 
 Local<Value> KeyObjectHandle::GetAsymmetricKeyType() const {
-  switch (data_.GetAsymmetricKey().id()) {
-    case EVP_PKEY_RSA:
-      return env()->crypto_rsa_string();
-    case EVP_PKEY_RSA_PSS:
-      return env()->crypto_rsa_pss_string();
-    case EVP_PKEY_DSA:
-      return env()->crypto_dsa_string();
-    case EVP_PKEY_DH:
-      return env()->crypto_dh_string();
-    case EVP_PKEY_EC:
-      return env()->crypto_ec_string();
-    case EVP_PKEY_ED25519:
-      return env()->crypto_ed25519_string();
-    case EVP_PKEY_ED448:
-      return env()->crypto_ed448_string();
-    case EVP_PKEY_X25519:
-      return env()->crypto_x25519_string();
-    case EVP_PKEY_X448:
-      return env()->crypto_x448_string();
-#if OPENSSL_WITH_PQC
-    default:
-      return GetPqcAsymmetricKeyType(env(), data_.GetAsymmetricKey().id());
-#else
-    default:
-      return Undefined(env()->isolate());
-#endif
-  }
+  const char* name = data_.GetAsymmetricKey().getKeyTypeName();
+  if (name == nullptr) return Undefined(env()->isolate());
+  return OneByteString(
+      env()->isolate(), name, -1, NewStringType::kInternalized);
 }
 
 void KeyObjectHandle::GetAsymmetricKeyType(
@@ -1422,7 +1378,7 @@ bool KeyObjectHandle::CheckEcKeyData() const {
   const auto& key = data_.GetAsymmetricKey();
   EVPKeyCtxPointer ctx = key.newCtx();
   CHECK(ctx);
-  CHECK_EQ(key.id(), EVP_PKEY_EC);
+  DCHECK(key.isA(KeyAlgorithm::EC));
 
   return data_.GetKeyType() == kKeyTypePrivate ? ctx.privateCheck()
                                                : ctx.publicCheck();
@@ -1513,12 +1469,7 @@ void KeyObjectHandle::RawPublicKey(
   Mutex::ScopedLock lock(data.mutex());
   const auto& pkey = data.GetAsymmetricKey();
 
-  const int id = pkey.id();
-  bool is_raw_supported = id == EVP_PKEY_ED25519 || id == EVP_PKEY_ED448 ||
-                          id == EVP_PKEY_X25519 || id == EVP_PKEY_X448;
-#if OPENSSL_WITH_PQC
-  is_raw_supported = is_raw_supported || IsPqcKeyId(id);
-#endif
+  const bool is_raw_supported = pkey.supportsRawPublic();
   if (!is_raw_supported) {
     return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
   }
@@ -1546,12 +1497,7 @@ void KeyObjectHandle::RawPrivateKey(
   Mutex::ScopedLock lock(data.mutex());
   const auto& pkey = data.GetAsymmetricKey();
 
-  const int id = pkey.id();
-  bool is_raw_supported = id == EVP_PKEY_ED25519 || id == EVP_PKEY_ED448 ||
-                          id == EVP_PKEY_X25519 || id == EVP_PKEY_X448;
-#if OPENSSL_WITH_PQC
-  is_raw_supported = is_raw_supported || IsPqcRawPrivateKeyId(id);
-#endif
+  const bool is_raw_supported = pkey.supportsRawPrivate();
   if (!is_raw_supported) {
     return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
   }
@@ -1578,28 +1524,31 @@ void KeyObjectHandle::ExportECPublicRaw(
 
   Mutex::ScopedLock lock(data.mutex());
   const auto& m_pkey = data.GetAsymmetricKey();
-  if (m_pkey.id() != EVP_PKEY_EC) {
+  if (!m_pkey.isA(KeyAlgorithm::EC)) {
     return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
   }
 
+  CHECK(args[0]->IsInt32());
+  auto form =
+      static_cast<point_conversion_form_t>(args[0].As<Int32>()->Value());
+
+  auto bytes = ncrypto::Ec::TryExportPublic(m_pkey, form);
+  if (bytes) {
+    args.GetReturnValue().Set(
+        Buffer::Copy(env, bytes.get<const char>(), bytes.size())
+            .FromMaybe(Local<Value>()));
+    return;
+  }
   ECKeyPointer ec_key(m_pkey);
   if (!ec_key) return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-  // A provider-backed key need not expose its public point.
   if (ec_key.getPublicKey() == nullptr) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
                                              "Failed to export EC public key");
   }
-
-  CHECK(args[0]->IsInt32());
-  auto form =
-      static_cast<point_conversion_form_t>(args[0].As<Int32>()->Value());
-
-  const auto group = ec_key.getGroup();
-  const auto point = ec_key.getPublicKey();
-
   Local<Object> buf;
-  if (!ECPointToBuffer(env, group, point, form).ToLocal(&buf)) return;
-
+  if (!ECPointToBuffer(env, ec_key.getGroup(), ec_key.getPublicKey(), form)
+           .ToLocal(&buf))
+    return;
   args.GetReturnValue().Set(buf);
 }
 
@@ -1614,27 +1563,11 @@ void KeyObjectHandle::ExportECPrivateRaw(
 
   Mutex::ScopedLock lock(data.mutex());
   const auto& m_pkey = data.GetAsymmetricKey();
-  if (m_pkey.id() != EVP_PKEY_EC) {
+  if (!m_pkey.isA(KeyAlgorithm::EC)) {
     return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
   }
 
-  ECKeyPointer ec_key(m_pkey);
-  if (!ec_key) return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-
-  const BIGNUM* private_key = ec_key.getPrivateKey();
-  if (private_key == nullptr) {
-    return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
-                                             "Failed to export EC private key");
-  }
-
-  const auto group = ec_key.getGroup();
-  auto order = BignumPointer::New();
-  if (!order || !EC_GROUP_get_order(group, order.get(), nullptr)) {
-    return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
-                                             "Failed to export EC private key");
-  }
-
-  auto buf = BignumPointer::EncodePadded(private_key, order.byteLength());
+  auto buf = ncrypto::Ec::ExportPrivate(m_pkey);
   if (!buf) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
                                              "Failed to export EC private key");
@@ -1652,25 +1585,20 @@ void KeyObjectHandle::RawSeed(const v8::FunctionCallbackInfo<v8::Value>& args) {
   const KeyObjectData& data = key->Data();
   CHECK_EQ(data.GetKeyType(), kKeyTypePrivate);
 
-#if OPENSSL_WITH_PQC
   Mutex::ScopedLock lock(data.mutex());
   const auto& pkey = data.GetAsymmetricKey();
 
-  if (!IsPqcSeedKeyId(pkey.id())) {
-    return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-  }
-
   auto raw_data = pkey.rawSeed();
   if (!raw_data) {
+    if (raw_data.error == EVPKeyPointer::RawExportError::UNSUPPORTED_KEY_TYPE) {
+      return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
+    }
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to get raw seed");
   }
 
   args.GetReturnValue().Set(
-      Buffer::Copy(env, raw_data.get<const char>(), raw_data.size())
+      Buffer::Copy(env, raw_data.value.get<const char>(), raw_data.value.size())
           .FromMaybe(Local<Value>()));
-#else
-  return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-#endif
 }
 
 void KeyObjectHandle::ExportJWK(
@@ -1696,12 +1624,15 @@ void NativeKeyObject::Initialize(Environment* env, Local<Object> target) {
             NativeKeyObject::CreateNativeKeyObjectClass);
   SetMethod(
       env->context(), target, "getKeyObjectSlots", NativeKeyObject::GetSlots);
+  SetMethodNoSideEffect(
+      env->context(), target, "isKeyObject", NativeKeyObject::IsKeyObject);
 }
 
 void NativeKeyObject::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(NativeKeyObject::CreateNativeKeyObjectClass);
   registry->Register(NativeKeyObject::GetSlots);
+  registry->Register(NativeKeyObject::IsKeyObject);
   registry->Register(NativeKeyObject::New);
 }
 
@@ -1710,6 +1641,12 @@ bool NativeKeyObject::HasInstance(Environment* env, Local<Value> value) {
   return !t.IsEmpty() && t->HasInstance(value);
 }
 
+void NativeKeyObject::IsKeyObject(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  args.GetReturnValue().Set(HasInstance(env, args[0]));
+}
+
 void NativeKeyObject::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 1);
@@ -1866,12 +1803,15 @@ void NativeCryptoKey::Initialize(Environment* env, Local<Object> target) {
             NativeCryptoKey::CreateCryptoKeyClass);
   SetMethod(
       env->context(), target, "getCryptoKeySlots", NativeCryptoKey::GetSlots);
+  SetMethodNoSideEffect(
+      env->context(), target, "isCryptoKey", NativeCryptoKey::IsCryptoKey);
 }
 
 void NativeCryptoKey::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(NativeCryptoKey::CreateCryptoKeyClass);
   registry->Register(NativeCryptoKey::GetSlots);
+  registry->Register(NativeCryptoKey::IsCryptoKey);
   registry->Register(NativeCryptoKey::New);
 }
 
@@ -1888,6 +1828,12 @@ bool NativeCryptoKey::HasInstance(Environment* env, Local<Value> value) {
   return IsNativeCryptoKey(env, value);
 }
 
+void NativeCryptoKey::IsCryptoKey(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  args.GetReturnValue().Set(HasInstance(env, args[0]));
+}
+
 MaybeLocal<Value> NativeCryptoKey::Create(Environment* env,
                                           const KeyObjectData& data,
                                           Local<Value> algorithm,
@@ -1922,11 +1868,15 @@ MaybeLocal<Value> NativeCryptoKey::Create(Environment* env,
 
 void NativeCryptoKey::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
-  CHECK_EQ(args.Length(), 4);
+  CHECK_GE(args.Length(), 4);
+  CHECK_LE(args.Length(), 6);
   // args[0] is a KeyObjectHandle; we keep its KeyObjectData directly.
   // args[1] is the algorithm dictionary object.
   // args[2] is the usages mask.
   // args[3] is the extractable boolean.
+  // args[4], when present, is an optional secondary KeyObjectHandle for
+  // Hybrid KEM CryptoKeys.
+  // args[5], when present, is optional seed_data for Hybrid KEM CryptoKeys.
   //
   // args[1] is undefined only when called from
   // CryptoKeyTransferData::Deserialize for a partially-initialized
@@ -1940,7 +1890,24 @@ void NativeCryptoKey::New(const FunctionCallbackInfo<Value>& args) {
   KeyObjectHandle* handle = Unwrap<KeyObjectHandle>(args[0].As<Object>());
   CHECK_NOT_NULL(handle);
 
-  auto* native = new NativeCryptoKey(env, args.This(), handle->Data());
+  KeyObjectData secondary_data;
+  if (args.Length() >= 5 && !args[4]->IsUndefined()) {
+    CHECK(KeyObjectHandle::HasInstance(env, args[4]));
+    KeyObjectHandle* secondary_handle =
+        Unwrap<KeyObjectHandle>(args[4].As<Object>());
+    CHECK_NOT_NULL(secondary_handle);
+    secondary_data = secondary_handle->Data();
+  }
+
+  ByteSource seed_data;
+  if (args.Length() == 6 && !args[5]->IsUndefined()) {
+    CHECK(IsAnyBufferSource(args[5]));
+    ArrayBufferOrViewContents<char> buf(args[5]);
+    seed_data = buf.ToCopy();
+  }
+
+  auto* native = new NativeCryptoKey(
+      env, args.This(), handle->Data(), secondary_data, std::move(seed_data));
 
   if (!args[1]->IsUndefined()) {
     CHECK(args[1]->IsObject());
@@ -1988,9 +1955,10 @@ void NativeCryptoKey::CreateCryptoKeyClass(
 }
 
 // Returns all of the key's internal slot values as a single Array:
-// [type enum, extractable, algorithm, usages mask, handle]. JS-side helpers
-// call this once per key to prime a per-instance cache, so subsequent
-// reads don't need to cross into C++ at all.
+// [type enum, extractable, algorithm, usages mask, handle, secondary handle,
+// seed data]. JS-side helpers call this once per key to prime a per-instance
+// cache, so subsequent reads don't need to cross into C++ at all. The
+// secondary handle and seed data slots are only used by Hybrid KEM CryptoKeys.
 void NativeCryptoKey::GetSlots(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 1);
@@ -2007,15 +1975,38 @@ void NativeCryptoKey::GetSlots(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  Isolate* isolate = env->isolate();
+  Local<Value> secondary_handle = Undefined(isolate);
+  if (native->secondary_handle_data_) {
+    Local<Object> secondary_handle_object;
+    if (!KeyObjectHandle::Create(env, native->secondary_handle_data_)
+             .ToLocal(&secondary_handle_object)) {
+      return;
+    }
+    secondary_handle = secondary_handle_object;
+  }
+
+  Local<Value> seed_data = Undefined(isolate);
+  if (native->seed_data_) {
+    Local<Object> buf;
+    if (!Buffer::Copy(
+             env, native->seed_data_.data<char>(), native->seed_data_.size())
+             .ToLocal(&buf)) {
+      return;
+    }
+    seed_data = buf;
+  }
+
   Local<Value> algorithm = obj->GetInternalField(kAlgorithmField).As<Value>();
   CHECK(algorithm->IsObject());
-  Isolate* isolate = env->isolate();
   Local<Value> slots[] = {
       Uint32::NewFromUnsigned(isolate, native->handle_data_.GetKeyType()),
       v8::Boolean::New(isolate, native->extractable_),
       algorithm,
       Uint32::NewFromUnsigned(isolate, native->usages_mask_),
       handle,
+      secondary_handle,
+      seed_data,
   };
   args.GetReturnValue().Set(Array::New(isolate, slots, arraysize(slots)));
 }
@@ -2031,8 +2022,12 @@ std::unique_ptr<worker::TransferData> NativeCryptoKey::CloneForMessaging()
   Local<Value> algorithm_v = obj->GetInternalField(kAlgorithmField).As<Value>();
   CHECK(algorithm_v->IsObject());
   v8::Global<Object> algorithm_copy(isolate, algorithm_v.As<Object>());
-  return std::make_unique<CryptoKeyTransferData>(
-      handle_data_, std::move(algorithm_copy), usages_mask_, extractable_);
+  return std::make_unique<CryptoKeyTransferData>(handle_data_,
+                                                 secondary_handle_data_,
+                                                 seed_data_.ToCopy(),
+                                                 std::move(algorithm_copy),
+                                                 usages_mask_,
+                                                 extractable_);
 }
 
 Maybe<void> NativeCryptoKey::FinalizeTransferRead(
@@ -2112,9 +2107,29 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
   Local<Object> handle;
   if (!KeyObjectHandle::Create(env, data_).ToLocal(&handle)) return {};
 
+  Isolate* isolate = env->isolate();
+  Local<Value> secondary_handle = Undefined(isolate);
+  if (secondary_data_) {
+    Local<Object> secondary_handle_object;
+    if (!KeyObjectHandle::Create(env, secondary_data_)
+             .ToLocal(&secondary_handle_object)) {
+      return {};
+    }
+    secondary_handle = secondary_handle_object;
+  }
+
+  Local<Value> seed_data = Undefined(isolate);
+  if (seed_data_) {
+    Local<Object> buf;
+    if (!Buffer::Copy(env, seed_data_.data<char>(), seed_data_.size())
+             .ToLocal(&buf)) {
+      return {};
+    }
+    seed_data = buf;
+  }
+
   // Make sure internal/crypto/keys has been loaded so that the
   // CryptoKey constructor is registered with the Environment.
-  Isolate* isolate = env->isolate();
   Local<Value> arg = env->internal_crypto_keys_string();
   if (env->builtin_module_require()
           ->Call(context, Null(isolate), 1, &arg)
@@ -2131,9 +2146,11 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
       Undefined(isolate),
       Undefined(isolate),
       Undefined(isolate),
+      secondary_handle,
+      seed_data,
   };
   Local<Value> cryptokey;
-  if (!cryptokey_ctor->NewInstance(context, 4, ctor_args).ToLocal(&cryptokey)) {
+  if (!cryptokey_ctor->NewInstance(context, 6, ctor_args).ToLocal(&cryptokey)) {
     return {};
   }
 
@@ -2143,16 +2160,25 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
 
 void NativeCryptoKey::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackField("handle_data", handle_data_);
+  if (secondary_handle_data_) {
+    tracker->TrackField("secondary_handle_data", secondary_handle_data_);
+  }
+  tracker->TrackFieldWithSize("seed_data", seed_data_.size());
 }
 
 void NativeCryptoKey::CryptoKeyTransferData::MemoryInfo(
     MemoryTracker* tracker) const {
   tracker->TrackField("data", data_);
+  if (secondary_data_) {
+    tracker->TrackField("secondary_data", secondary_data_);
+  }
+  tracker->TrackFieldWithSize("seed_data", seed_data_.size());
   tracker->TrackField("algorithm", algorithm_);
 }
 
 namespace Keys {
 void Initialize(Environment* env, Local<Object> target) {
+  Local<Context> context = env->context();
   target->Set(env->context(),
               FIXED_ONE_BYTE_STRING(env->isolate(), "KeyObjectHandle"),
               KeyObjectHandle::Initialize(env)).Check();
@@ -2187,34 +2213,7 @@ void Initialize(Environment* env, Local<Object> target) {
   NODE_DEFINE_CONSTANT(target, kWebCryptoKeyFormatPKCS8);
   NODE_DEFINE_CONSTANT(target, kWebCryptoKeyFormatSPKI);
   NODE_DEFINE_CONSTANT(target, kWebCryptoKeyFormatJWK);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ED25519);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ED448);
-#if OPENSSL_WITH_PQC
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_DSA_44);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_DSA_65);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_DSA_87);
-#if OPENSSL_WITH_PQC_ML_KEM_512
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_KEM_512);
-#endif
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_KEM_768);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_ML_KEM_1024);
-#if OPENSSL_WITH_PQC_SLH_DSA
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHA2_128F);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHA2_128S);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHA2_192F);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHA2_192S);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHA2_256F);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHA2_256S);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHAKE_128F);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHAKE_128S);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHAKE_192F);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHAKE_192S);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHAKE_256F);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_SLH_DSA_SHAKE_256S);
-#endif
-#endif
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_X25519);
-  NODE_DEFINE_CONSTANT(target, EVP_PKEY_X448);
+  SetMethod(context, target, "getPqcKeyTypes", GetPqcKeyTypes);
   NODE_DEFINE_CONSTANT(target, kKeyEncodingPKCS1);
   NODE_DEFINE_CONSTANT(target, kKeyEncodingPKCS8);
   NODE_DEFINE_CONSTANT(target, kKeyEncodingSPKI);
@@ -2235,6 +2234,7 @@ void Initialize(Environment* env, Local<Object> target) {
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   KeyObjectHandle::RegisterExternalReferences(registry);
+  registry->Register(GetPqcKeyTypes);
 }
 }  // namespace Keys
 
diff --git a/src/crypto/crypto_keys.h b/src/crypto/crypto_keys.h
index 00ff1d4402fa..9556447c5a52 100644
--- a/src/crypto/crypto_keys.h
+++ b/src/crypto/crypto_keys.h
@@ -209,6 +209,7 @@ class NativeKeyObject : public BaseObject {
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void CreateNativeKeyObjectClass(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsKeyObject(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   // True if `value` is a real NativeKeyObject instance. Uses the
   // FunctionTemplate stored on the Environment as a brand check.
@@ -257,9 +258,12 @@ class NativeKeyObject : public BaseObject {
 
 // NativeCryptoKey is the native base class for the Web Crypto
 // `CryptoKey`. It holds the internal slots - `[[type]]` as an enum,
-// `[[extractable]]`, `[[algorithm]]`, `[[usages]]` as a mask, and the
-// underlying KeyObjectData. The public `type`, `extractable`,
-// `algorithm`, and `usages` accessors on `CryptoKey.prototype` are
+// `[[extractable]]`, `[[algorithm]]`, `[[usages]]` as a mask, the
+// primary underlying KeyObjectData. Hybrid KEM CryptoKeys may also store an
+// optional secondary KeyObjectData and optional seed_data, both of which are
+// only used to reconstruct their hybrid key material. The public `type`,
+// `extractable`, `algorithm`, and `usages` accessors on `CryptoKey.prototype`
+// are
 // user-configurable per Web IDL, so internal consumers read these
 // values directly from the C++ side via a single `GetSlots` call
 // which returns all slots at once; JS primes a per-instance cache
@@ -277,6 +281,7 @@ class NativeCryptoKey : public BaseObject {
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void CreateCryptoKeyClass(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsCryptoKey(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static v8::MaybeLocal<v8::Value> Create(Environment* env,
                                           const KeyObjectData& data,
@@ -289,8 +294,10 @@ class NativeCryptoKey : public BaseObject {
   // Used by `GetSlots` to validate its receiver.
   static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
 
-  // Returns [type, extractable, algorithm, usages mask, handle] in one call
-  // so JS can prime a per-instance cache on first access.
+  // Returns [type, extractable, algorithm, usages mask, handle,
+  // secondary handle, seed data] in one call so JS can prime a per-instance
+  // cache on first access. The secondary handle and seed data slots are only
+  // used by Hybrid KEM CryptoKeys.
   static void GetSlots(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   void MemoryInfo(MemoryTracker* tracker) const override;
@@ -300,10 +307,15 @@ class NativeCryptoKey : public BaseObject {
   class CryptoKeyTransferData : public worker::TransferData {
    public:
     CryptoKeyTransferData(const KeyObjectData& data,
+                          const KeyObjectData& secondary_data,
+                          ByteSource&& seed_data,
                           v8::Global<v8::Object>&& algorithm,
                           uint32_t usages_mask,
                           bool extractable)
         : data_(data.addRef()),
+          secondary_data_(secondary_data ? secondary_data.addRef()
+                                         : KeyObjectData()),
+          seed_data_(std::move(seed_data)),
           algorithm_(std::move(algorithm)),
           usages_mask_(usages_mask),
           extractable_(extractable) {}
@@ -323,6 +335,8 @@ class NativeCryptoKey : public BaseObject {
 
    private:
     KeyObjectData data_;
+    KeyObjectData secondary_data_;
+    ByteSource seed_data_;
     v8::Global<v8::Object> algorithm_;
     uint32_t usages_mask_;
     bool extractable_;
@@ -335,16 +349,28 @@ class NativeCryptoKey : public BaseObject {
       v8::ValueDeserializer* deserializer) override;
 
   const KeyObjectData& handle_data() const { return handle_data_; }
+  const KeyObjectData& secondary_handle_data() const {
+    return secondary_handle_data_;
+  }
 
  private:
   NativeCryptoKey(Environment* env,
                   v8::Local<v8::Object> wrap,
-                  const KeyObjectData& handle_data)
-      : BaseObject(env, wrap), handle_data_(handle_data.addRef()) {
+                  const KeyObjectData& handle_data,
+                  const KeyObjectData& secondary_handle_data,
+                  ByteSource&& seed_data)
+      : BaseObject(env, wrap),
+        handle_data_(handle_data.addRef()),
+        secondary_handle_data_(secondary_handle_data
+                                   ? secondary_handle_data.addRef()
+                                   : KeyObjectData()),
+        seed_data_(std::move(seed_data)) {
     MakeWeak();
   }
 
   KeyObjectData handle_data_;
+  KeyObjectData secondary_handle_data_;
+  ByteSource seed_data_;
   uint32_t usages_mask_ = 0;
   bool extractable_ = false;
 };
diff --git a/src/crypto/crypto_kmac.cc b/src/crypto/crypto_kmac.cc
index f728defee7cf..d346d50fc070 100644
--- a/src/crypto/crypto_kmac.cc
+++ b/src/crypto/crypto_kmac.cc
@@ -151,6 +151,8 @@ bool DeriveBitsWithCShake(const KmacConfig& params,
                           const void* key_data,
                           size_t key_size,
                           ByteSource* out) {
+  if (IsFipsEnabled()) return false;
+
   const size_t key_length_bytes = NumBitsToBytes(params.key_length);
   if (key_size < key_length_bytes) return false;
 
diff --git a/src/crypto/crypto_mac.cc b/src/crypto/crypto_mac.cc
new file mode 100644
index 000000000000..7f43e760ccf7
--- /dev/null
+++ b/src/crypto/crypto_mac.cc
@@ -0,0 +1,656 @@
+#include "crypto/crypto_mac.h"
+#include "base_object-inl.h"
+#include "env-inl.h"
+#include "memory_tracker-inl.h"
+#include "node_buffer.h"
+#include "node_errors.h"
+#include "string_bytes.h"
+#include "v8.h"
+
+#if OPENSSL_WITH_EVP_MAC
+#include <openssl/core_names.h>
+#include <openssl/evp.h>
+#include <openssl/params.h>
+
+#include <algorithm>
+#include <array>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+#endif
+
+namespace node {
+
+using v8::Array;
+using v8::Context;
+using v8::FunctionCallbackInfo;
+using v8::FunctionTemplate;
+using v8::Int32;
+using v8::Isolate;
+using v8::Local;
+using v8::LocalVector;
+using v8::Name;
+using v8::Null;
+using v8::Object;
+using v8::Uint32;
+using v8::Value;
+
+namespace crypto {
+
+#if OPENSSL_WITH_EVP_MAC
+namespace {
+
+struct InitializedMac final {
+  ncrypto::EVPMacCtxPointer context;
+  size_t output_size = 0;
+  bool has_output_length = false;
+};
+
+struct MaybeCachedMac final {
+  EVP_MAC* cached_mac = nullptr;
+  ncrypto::EVPMacPointer mac;
+  int32_t cache_id = -1;
+  ncrypto::MacKind kind = ncrypto::MacKind::kOther;
+};
+
+bool MaybeThrowCryptoError(Environment* env, const char* message) {
+  const unsigned long error = ERR_get_error();  // NOLINT(runtime/int)
+  if (error == 0) return false;
+  ThrowCryptoError(env, error, message);
+  return true;
+}
+
+void ThrowMacError(Environment* env, const char* message) {
+  if (!MaybeThrowCryptoError(env, message)) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, message);
+  }
+}
+
+void ResetMacCache(Environment* env,
+                   uint64_t generation,
+                   Local<Object> algorithm_cache = Local<Object>()) {
+  ncrypto::MacCache* cache = env->provider_mac_cache.get();
+  CHECK_NOT_NULL(cache);
+  if (!algorithm_cache.IsEmpty()) {
+    Isolate* isolate = env->isolate();
+    Local<Context> context = env->context();
+    for (const auto& entry : cache->aliases()) {
+      if (algorithm_cache
+              ->Set(context,
+                    OneByteString(isolate, entry.first),
+                    Int32::New(isolate, -1))
+              .IsNothing()) {
+        return;
+      }
+    }
+  }
+  cache->reset(generation);
+  env->supported_mac_algorithms.clear();
+  env->supported_mac_algorithms_initialized = false;
+  env->mac_cache_generation = generation;
+}
+
+bool SynchronizeMacCache(Environment* env,
+                         Local<Object> algorithm_cache = Local<Object>()) {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (env->mac_cache_generation == generation) return false;
+  ResetMacCache(env, generation, algorithm_cache);
+  return true;
+}
+
+ncrypto::MacCache::Result GetCachedMacByID(
+    Environment* env,
+    int32_t id,
+    Local<Object> algorithm_cache = Local<Object>()) {
+  if (SynchronizeMacCache(env, algorithm_cache) ||
+      env->provider_mac_cache == nullptr) {
+    return {};
+  }
+  return env->provider_mac_cache->lookup(id, env->mac_cache_generation);
+}
+
+MaybeCachedMac FetchAndMaybeCacheMac(
+    Environment* env,
+    const char* name,
+    Local<Object> algorithm_cache = Local<Object>()) {
+  SynchronizeMacCache(env, algorithm_cache);
+  if (env->isolate()->HasPendingException()) return {};
+  ncrypto::MacCache* cache = env->provider_mac_cache.get();
+  CHECK_NOT_NULL(cache);
+  const uint64_t generation = env->mac_cache_generation;
+
+  if (auto cached = cache->lookup(name, generation); cached.mac != nullptr) {
+    return {cached.mac, {}, cached.id, cached.kind};
+  }
+
+  ncrypto::EVPMacPointer mac;
+  {
+    ncrypto::MarkPopErrorOnReturn mark_pop_error_on_return;
+    mac = ncrypto::EVPMacPointer::Fetch(name);
+  }
+  if (!mac) return {};
+
+  if (generation == ncrypto::getFipsStateGeneration()) {
+    auto cached = cache->insert(name, std::move(mac), generation);
+    if (cached.mac != nullptr) {
+      return {cached.mac, {}, cached.id, cached.kind};
+    }
+  }
+
+  const ncrypto::MacKind kind = ncrypto::MacCache::GetKind(mac.get());
+  return {nullptr, std::move(mac), -1, kind};
+}
+
+EVP_MAC* GetMacImplementation(Environment* env,
+                              Local<Value> algorithm,
+                              Local<Value> cache_id_value,
+                              Local<Value> algorithm_cache,
+                              ncrypto::EVPMacPointer* mac_owner,
+                              ncrypto::MacKind* kind) {
+  CHECK(algorithm->IsString());
+  CHECK(cache_id_value->IsInt32());
+  CHECK(algorithm_cache->IsObject());
+  CHECK_NOT_NULL(mac_owner);
+  CHECK_NOT_NULL(kind);
+
+  Local<Object> cache = algorithm_cache.As<Object>();
+  const int32_t cache_id = cache_id_value.As<Int32>()->Value();
+  if (cache_id != -1) {
+    auto cached = GetCachedMacByID(env, cache_id, cache);
+    if (cached.mac != nullptr) {
+      *kind = cached.kind;
+      return cached.mac;
+    }
+    if (env->isolate()->HasPendingException()) return nullptr;
+  }
+
+  Isolate* isolate = env->isolate();
+  Utf8Value utf8(isolate, algorithm);
+  MaybeCachedMac result = FetchAndMaybeCacheMac(env, *utf8, cache);
+  if (env->isolate()->HasPendingException()) return nullptr;
+  if (result.cache_id != -1) {
+    if (cache
+            ->Set(
+                env->context(), algorithm, Int32::New(isolate, result.cache_id))
+            .IsNothing()) {
+      return nullptr;
+    }
+  }
+
+  if (result.cached_mac != nullptr) {
+    *kind = result.kind;
+    return result.cached_mac;
+  }
+  if (result.mac) {
+    *mac_owner = std::move(result.mac);
+    *kind = result.kind;
+    return mac_owner->get();
+  }
+  return nullptr;
+}
+
+bool IsSettableParameter(const ncrypto::EVPMacCtxPointer& context,
+                         const char* name,
+                         unsigned int type) {
+  const OSSL_PARAM* settable = context.getSettableParams();
+  const OSSL_PARAM* descriptor =
+      settable == nullptr ? nullptr : OSSL_PARAM_locate_const(settable, name);
+  return descriptor != nullptr && descriptor->data_type == type;
+}
+
+bool RequireSettableParameter(Environment* env,
+                              const ncrypto::EVPMacCtxPointer& context,
+                              Local<Value> algorithm,
+                              const char* option,
+                              const char* parameter,
+                              unsigned int type) {
+  if (IsSettableParameter(context, parameter, type)) return true;
+  Utf8Value name(env->isolate(), algorithm);
+  THROW_ERR_INVALID_ARG_VALUE(
+      env,
+      "The property 'options.%s' is not supported by MAC %s",
+      option,
+      *name);
+  return false;
+}
+
+bool InitializeMacContext(Environment* env,
+                          const FunctionCallbackInfo<Value>& args,
+                          InitializedMac* output) {
+  CHECK(args.Length() == 5 || args.Length() == 10);
+  CHECK(args[0]->IsString());
+  CHECK(args[1]->IsInt32());
+  CHECK(args[2]->IsObject());
+
+  Isolate* isolate = env->isolate();
+  ByteSource key = ByteSource::FromSecretKeyBytes(env, args[3]);
+
+  std::optional<Utf8Value> digest;
+  if (!args[4]->IsUndefined()) {
+    CHECK(args[4]->IsString());
+    digest.emplace(isolate, args[4]);
+  }
+  std::optional<Utf8Value> cipher;
+  if (!args[5]->IsUndefined()) {
+    CHECK(args[5]->IsString());
+    cipher.emplace(isolate, args[5]);
+  }
+
+  const bool has_iv = !args[6]->IsUndefined();
+  ByteSource iv;
+  if (has_iv) iv = ByteSource::FromBuffer(args[6]);
+  const bool has_customization = !args[7]->IsUndefined();
+  ByteSource customization;
+  if (has_customization) customization = ByteSource::FromBuffer(args[7]);
+  const bool has_salt = !args[8]->IsUndefined();
+  ByteSource salt;
+  if (has_salt) salt = ByteSource::FromBuffer(args[8]);
+
+  const bool has_output_length = !args[9]->IsUndefined();
+  size_t output_length = 0;
+  if (has_output_length) {
+    CHECK(args[9]->IsUint32());
+    output_length = args[9].As<Uint32>()->Value();
+  }
+
+  ncrypto::EVPMacPointer mac_owner;
+  ncrypto::MacKind kind = ncrypto::MacKind::kOther;
+  EVP_MAC* mac =
+      GetMacImplementation(env, args[0], args[1], args[2], &mac_owner, &kind);
+  if (mac == nullptr) {
+    if (env->isolate()->IsExecutionTerminating() ||
+        env->isolate()->HasPendingException()) {
+      return false;
+    }
+    Utf8Value name(env->isolate(), args[0]);
+    THROW_ERR_CRYPTO_INVALID_MAC(env, "Invalid MAC: %s", *name);
+    return false;
+  }
+
+  if (kind == ncrypto::MacKind::kHmac && !digest.has_value()) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env, "The property 'options.digest' is required for HMAC");
+    return false;
+  }
+  if (kind == ncrypto::MacKind::kCmac && !cipher.has_value()) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env, "The property 'options.cipher' is required for CMAC");
+    return false;
+  }
+  if (kind == ncrypto::MacKind::kGmac) {
+    if (!cipher.has_value()) {
+      THROW_ERR_INVALID_ARG_VALUE(
+          env, "The property 'options.cipher' is required for GMAC");
+      return false;
+    }
+    if (!has_iv || iv.empty()) {
+      THROW_ERR_INVALID_ARG_VALUE(
+          env, "The property 'options.iv' must be non-empty for GMAC");
+      return false;
+    }
+  }
+
+  ncrypto::EVPMacCtxPointer context = ncrypto::EVPMacCtxPointer::New(mac);
+  if (!context) {
+    ThrowMacError(env, "Failed to create MAC context");
+    return false;
+  }
+
+  std::array<OSSL_PARAM, 7> params;
+  size_t count = 0;
+  if (digest.has_value()) {
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  "digest",
+                                  OSSL_MAC_PARAM_DIGEST,
+                                  OSSL_PARAM_UTF8_STRING)) {
+      return false;
+    }
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_MAC_PARAM_DIGEST, const_cast<char*>(digest->out()), 0);
+  }
+  if (cipher.has_value()) {
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  "cipher",
+                                  OSSL_MAC_PARAM_CIPHER,
+                                  OSSL_PARAM_UTF8_STRING)) {
+      return false;
+    }
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_MAC_PARAM_CIPHER, const_cast<char*>(cipher->out()), 0);
+  }
+
+  unsigned char empty_parameter = 0;
+  auto add_bytes = [&](bool present,
+                       const ByteSource& value,
+                       const char* option,
+                       const char* parameter) {
+    if (!present) return true;
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  option,
+                                  parameter,
+                                  OSSL_PARAM_OCTET_STRING)) {
+      return false;
+    }
+    void* data = value.empty() ? static_cast<void*>(&empty_parameter)
+                               : const_cast<void*>(value.data());
+    params[count++] =
+        OSSL_PARAM_construct_octet_string(parameter, data, value.size());
+    return true;
+  };
+
+  if (!add_bytes(has_iv, iv, "iv", OSSL_MAC_PARAM_IV) ||
+      !add_bytes(has_customization,
+                 customization,
+                 "customization",
+                 OSSL_MAC_PARAM_CUSTOM) ||
+      !add_bytes(has_salt, salt, "salt", OSSL_MAC_PARAM_SALT)) {
+    return false;
+  }
+
+  if (has_output_length) {
+    if (output_length > Buffer::kMaxLength) {
+      env->isolate()->ThrowException(ERR_BUFFER_TOO_LARGE(env->isolate()));
+      return false;
+    }
+    if (!RequireSettableParameter(env,
+                                  context,
+                                  args[0],
+                                  "outputLength",
+                                  OSSL_MAC_PARAM_SIZE,
+                                  OSSL_PARAM_UNSIGNED_INTEGER)) {
+      return false;
+    }
+    params[count++] =
+        OSSL_PARAM_construct_size_t(OSSL_MAC_PARAM_SIZE, &output_length);
+  }
+  params[count] = OSSL_PARAM_construct_end();
+
+  if (!context.init(key, params.data())) {
+    ThrowMacError(env, "Failed to initialize MAC");
+    return false;
+  }
+
+  const size_t output_size = context.getSize();
+  if (output_size > Buffer::kMaxLength) {
+    ERR_clear_error();
+    env->isolate()->ThrowException(ERR_BUFFER_TOO_LARGE(env->isolate()));
+    return false;
+  }
+  if (has_output_length && output_size != output_length) {
+    ERR_clear_error();
+    Utf8Value name(env->isolate(), args[0]);
+    THROW_ERR_INVALID_ARG_VALUE(
+        env,
+        "The property 'options.outputLength' was not honored by MAC %s",
+        *name);
+    return false;
+  }
+  if (!has_output_length && output_size == 0) {
+    ERR_clear_error();
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "MAC did not report an output size");
+    return false;
+  }
+
+  output->context = std::move(context);
+  output->output_size = output_size;
+  output->has_output_length = has_output_length;
+  return true;
+}
+
+v8::MaybeLocal<Value> FinalizeMac(Environment* env,
+                                  ncrypto::EVPMacCtxPointer* context,
+                                  size_t output_size,
+                                  bool has_output_length,
+                                  enum encoding encoding) {
+  ncrypto::DataPointer result = context->final(output_size);
+  if (!result) {
+    ThrowMacError(env, "Failed to finalize MAC");
+    context->reset();
+    return {};
+  }
+  context->reset();
+  if (has_output_length && result.size() != output_size) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(
+        env, "MAC returned an unexpected output length");
+    return {};
+  }
+  if (encoding != BUFFER) {
+    return StringBytes::Encode(env->isolate(),
+                               static_cast<const char*>(result.get()),
+                               result.size(),
+                               encoding);
+  }
+  if (result.size() == 0) return Buffer::New(env, 0);
+
+  ByteSource bytes = ByteSource::Allocated(result.release());
+  return bytes.ToBuffer(env);
+}
+
+void SaveMacName(const char* name, void* arg) {
+  if (name == nullptr) return;
+  const std::string_view view(name);
+  const bool is_dotted_decimal =
+      view.find('.') != std::string_view::npos &&
+      std::all_of(view.begin(), view.end(), [](unsigned char c) {
+        return (c >= '0' && c <= '9') || c == '.';
+      });
+  if (is_dotted_decimal) return;
+
+  std::string normalized(view);
+  std::transform(normalized.begin(),
+                 normalized.end(),
+                 normalized.begin(),
+                 [](unsigned char c) {
+                   if (c >= 'A' && c <= 'Z') {
+                     return static_cast<char>(c + ('a' - 'A'));
+                   }
+                   return static_cast<char>(c);
+                 });
+  static_cast<Environment*>(arg)->supported_mac_algorithms.push_back(
+      std::move(normalized));
+}
+
+void SaveSupportedProviderMac(EVP_MAC* enumerated, void* arg) {
+  Environment* env = static_cast<Environment*>(arg);
+  const char* name = EVP_MAC_get0_name(enumerated);
+  if (name == nullptr) return;
+
+  MaybeCachedMac result = FetchAndMaybeCacheMac(env, name);
+  EVP_MAC* fetched =
+      result.cached_mac != nullptr ? result.cached_mac : result.mac.get();
+  if (fetched == nullptr) return;
+  EVP_MAC_names_do_all(fetched, SaveMacName, env);
+}
+
+const std::vector<std::string>& GetSupportedMacAlgorithms(Environment* env) {
+  while (true) {
+    SynchronizeMacCache(env);
+    const uint64_t generation = env->mac_cache_generation;
+    if (!env->supported_mac_algorithms_initialized) {
+      ncrypto::MarkPopErrorOnReturn mark_pop_error_on_return;
+      EVP_MAC_do_all_provided(nullptr, SaveSupportedProviderMac, env);
+      std::sort(env->supported_mac_algorithms.begin(),
+                env->supported_mac_algorithms.end());
+      env->supported_mac_algorithms.erase(
+          std::unique(env->supported_mac_algorithms.begin(),
+                      env->supported_mac_algorithms.end()),
+          env->supported_mac_algorithms.end());
+      env->supported_mac_algorithms_initialized = true;
+    }
+
+    const uint64_t current_generation = ncrypto::getFipsStateGeneration();
+    if (generation == current_generation) {
+      return env->supported_mac_algorithms;
+    }
+    ResetMacCache(env, current_generation);
+  }
+}
+
+}  // namespace
+#endif  // OPENSSL_WITH_EVP_MAC
+
+#if OPENSSL_WITH_EVP_MAC
+bool Mac::MacUpdate(const char* data, size_t length) {
+  if (!context_) return false;
+  if (length == 0) return true;
+  if (EVP_MAC_update(context_.get(),
+                     reinterpret_cast<const unsigned char*>(data),
+                     length) == 1) {
+    return true;
+  }
+  MaybeThrowCryptoError(env(), "Failed to update MAC");
+  context_.reset();
+  return false;
+}
+
+Mac::Mac(Environment* env,
+         Local<Object> wrap,
+         ncrypto::EVPMacCtxPointer&& context,
+         size_t output_size,
+         bool has_output_length)
+    : BaseObject(env, wrap),
+      context_(std::move(context)),
+      output_size_(output_size),
+      has_output_length_(has_output_length) {
+  MakeWeak();
+}
+#else
+Mac::Mac(Environment* env, Local<Object> wrap) : BaseObject(env, wrap) {
+  MakeWeak();
+}
+#endif
+
+void Mac::MemoryInfo(MemoryTracker* tracker) const {
+#if OPENSSL_WITH_EVP_MAC
+  tracker->TrackFieldWithSize("context", context_ ? kSizeOf_EVP_MAC_CTX : 0);
+#else
+  static_cast<void>(tracker);
+#endif
+}
+
+void Mac::Initialize(Environment* env, Local<Object> target) {
+  Isolate* isolate = env->isolate();
+  Local<Context> context = env->context();
+  Local<FunctionTemplate> t = NewFunctionTemplate(isolate, New);
+  t->InstanceTemplate()->SetInternalFieldCount(Mac::kInternalFieldCount);
+  SetProtoMethod(isolate, t, "update", MacUpdate);
+  SetProtoMethod(isolate, t, "final", MacFinal);
+  SetConstructorFunction(context, target, "Mac", t);
+
+  SetMethodNoSideEffect(context, target, "getMacs", GetMacs);
+  SetMethodNoSideEffect(
+      context, target, "getCachedMacAliases", GetCachedAliases);
+}
+
+void Mac::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
+  registry->Register(New);
+  registry->Register(MacUpdate);
+  registry->Register(MacFinal);
+  registry->Register(GetMacs);
+  registry->Register(GetCachedAliases);
+}
+
+void Mac::New(const FunctionCallbackInfo<Value>& args) {
+  CHECK(args.IsConstructCall());
+#if OPENSSL_WITH_EVP_MAC
+  CHECK(args.Length() == 5 || args.Length() == 10);
+  Environment* env = Environment::GetCurrent(args);
+  InitializedMac initialized;
+  if (!InitializeMacContext(env, args, &initialized)) return;
+  new Mac(env,
+          args.This(),
+          std::move(initialized.context),
+          initialized.output_size,
+          initialized.has_output_length);
+#else
+  THROW_ERR_CRYPTO_MAC_NOT_SUPPORTED(Environment::GetCurrent(args),
+                                     "MAC is not supported");
+#endif
+}
+
+void Mac::MacUpdate(const FunctionCallbackInfo<Value>& args) {
+#if OPENSSL_WITH_EVP_MAC
+  Decode<Mac>(args,
+              [](Mac* mac,
+                 const FunctionCallbackInfo<Value>& args,
+                 const char* data,
+                 size_t length) {
+                args.GetReturnValue().Set(mac->MacUpdate(data, length));
+              });
+#else
+  THROW_ERR_CRYPTO_MAC_NOT_SUPPORTED(Environment::GetCurrent(args),
+                                     "MAC is not supported");
+#endif
+}
+
+void Mac::MacFinal(const FunctionCallbackInfo<Value>& args) {
+#if OPENSSL_WITH_EVP_MAC
+  Mac* mac;
+  ASSIGN_OR_RETURN_UNWRAP(&mac, args.This());
+  Environment* env = mac->env();
+  if (!mac->context_) {
+    THROW_ERR_CRYPTO_OPERATION_FAILED(env, "MAC context is not initialized");
+    return;
+  }
+  enum encoding encoding = BUFFER;
+  if (args.Length() >= 1) {
+    encoding = ParseEncoding(env->isolate(), args[0], BUFFER);
+  }
+  Local<Value> result;
+  if (FinalizeMac(env,
+                  &mac->context_,
+                  mac->output_size_,
+                  mac->has_output_length_,
+                  encoding)
+          .ToLocal(&result)) {
+    args.GetReturnValue().Set(result);
+  }
+#else
+  THROW_ERR_CRYPTO_MAC_NOT_SUPPORTED(Environment::GetCurrent(args),
+                                     "MAC is not supported");
+#endif
+}
+
+void Mac::GetMacs(const FunctionCallbackInfo<Value>& args) {
+#if OPENSSL_WITH_EVP_MAC
+  Local<Context> context = args.GetIsolate()->GetCurrentContext();
+  Environment* env = Environment::GetCurrent(context);
+  Local<Value> result;
+  if (ToV8Value(context, GetSupportedMacAlgorithms(env)).ToLocal(&result)) {
+    args.GetReturnValue().Set(result);
+  }
+#else
+  args.GetReturnValue().Set(Array::New(args.GetIsolate(), 0));
+#endif
+}
+
+void Mac::GetCachedAliases(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  LocalVector<Name> names(isolate);
+  LocalVector<Value> values(isolate);
+#if OPENSSL_WITH_EVP_MAC
+  Environment* env = Environment::GetCurrent(args);
+  SynchronizeMacCache(env);
+  const auto& aliases = env->provider_mac_cache->aliases();
+  names.reserve(aliases.size());
+  values.reserve(aliases.size());
+  for (const auto& [alias, id] : aliases) {
+    names.push_back(OneByteString(isolate, alias));
+    values.push_back(Int32::New(isolate, id));
+  }
+#endif
+  Local<Object> result = Object::New(
+      isolate, Null(isolate), names.data(), values.data(), names.size());
+  args.GetReturnValue().Set(result);
+}
+
+}  // namespace crypto
+}  // namespace node
diff --git a/src/crypto/crypto_mac.h b/src/crypto/crypto_mac.h
new file mode 100644
index 000000000000..3223b1487107
--- /dev/null
+++ b/src/crypto/crypto_mac.h
@@ -0,0 +1,51 @@
+#ifndef SRC_CRYPTO_CRYPTO_MAC_H_
+#define SRC_CRYPTO_CRYPTO_MAC_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "base_object.h"
+#include "crypto/crypto_util.h"
+#include "env.h"
+#include "memory_tracker.h"
+#include "v8.h"
+
+namespace node {
+namespace crypto {
+
+class Mac final : public BaseObject {
+ public:
+  static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(Mac)
+  SET_SELF_SIZE(Mac)
+
+ private:
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void MacUpdate(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void MacFinal(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMacs(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCachedAliases(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+#if OPENSSL_WITH_EVP_MAC
+  Mac(Environment* env,
+      v8::Local<v8::Object> wrap,
+      ncrypto::EVPMacCtxPointer&& context,
+      size_t output_size,
+      bool has_output_length);
+  bool MacUpdate(const char* data, size_t length);
+
+  ncrypto::EVPMacCtxPointer context_;
+  size_t output_size_ = 0;
+  bool has_output_length_ = false;
+#else
+  Mac(Environment* env, v8::Local<v8::Object> wrap);
+#endif
+};
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+#endif  // SRC_CRYPTO_CRYPTO_MAC_H_
diff --git a/src/crypto/crypto_pkcs12.cc b/src/crypto/crypto_pkcs12.cc
new file mode 100644
index 000000000000..8b0af44d9d7f
--- /dev/null
+++ b/src/crypto/crypto_pkcs12.cc
@@ -0,0 +1,193 @@
+#include "crypto/crypto_pkcs12.h"
+#include "crypto/crypto_context.h"
+#include "crypto/crypto_keys.h"
+#include "crypto/crypto_util.h"
+#include "crypto/crypto_x509.h"
+#include "env-inl.h"
+#include "ncrypto.h"
+#include "node_errors.h"
+#include "util-inl.h"
+#include "v8.h"
+
+#include <openssl/pkcs12.h>
+
+#include <string>
+
+namespace node {
+
+using ncrypto::BIOPointer;
+using v8::Array;
+using v8::ArrayBufferView;
+using v8::FunctionCallbackInfo;
+using v8::Local;
+using v8::LocalVector;
+using v8::Object;
+using v8::Value;
+
+namespace crypto {
+
+// Parses a PKCS#12 bundle from `bio`. See crypto_pkcs12.h; shared with
+// SecureContext::LoadPKCS12(), which backs the TLS `pfx` option.
+PKCS12ParseResult ParsePKCS12Bundle(const BIOPointer& bio, const char* pass) {
+  using PKCS12Pointer = ncrypto::DeleteFnPtr<PKCS12, PKCS12_free>;
+
+  ncrypto::ClearErrorOnReturn clear_error_on_return;
+
+  if (!bio) {
+    return PKCS12ParseResult(PKCS12ParseError::FAILED, ERR_get_error());
+  }
+
+  PKCS12* p12_ptr = nullptr;
+  if (!d2i_PKCS12_bio(bio.get(), &p12_ptr) || p12_ptr == nullptr) {
+    return PKCS12ParseResult(PKCS12ParseError::NOT_RECOGNIZED, ERR_get_error());
+  }
+  PKCS12Pointer p12(p12_ptr);
+
+  EVP_PKEY* pkey_ptr = nullptr;
+  X509* cert_ptr = nullptr;
+  STACK_OF(X509)* ca_ptr = nullptr;
+
+  if (!PKCS12_parse(p12.get(), pass, &pkey_ptr, &cert_ptr, &ca_ptr)) {
+    unsigned long err = ERR_get_error();  // NOLINT(runtime/int)
+#ifdef OPENSSL_IS_BORINGSSL
+    // BoringSSL's d2i_PKCS12() only copies the input; it does no ASN.1
+    // validation, so malformed input gets this far rather than failing above.
+    // PKCS8_R_BAD_PKCS12_DATA is raised only for structural failures -- a
+    // wrong passphrase is reported as PKCS8_R_INCORRECT_PASSWORD instead --
+    // so it means the same thing the d2i failure does on OpenSSL.
+    if (ERR_GET_LIB(err) == ERR_LIB_PKCS8 &&
+        ERR_GET_REASON(err) == PKCS8_R_BAD_PKCS12_DATA) {
+      return PKCS12ParseResult(PKCS12ParseError::NOT_RECOGNIZED, err);
+    }
+#endif
+#if OPENSSL_VERSION_MAJOR >= 3
+    // OpenSSL 3 reports algorithms that moved to the legacy provider as a
+    // bare "unsupported" error.
+    if (ERR_GET_REASON(err) == ERR_R_UNSUPPORTED) {
+      return PKCS12ParseResult(PKCS12ParseError::UNSUPPORTED_ALGORITHM, err);
+    }
+#endif
+    return PKCS12ParseResult(PKCS12ParseError::FAILED, err);
+  }
+
+  PKCS12Contents contents;
+  contents.key.reset(pkey_ptr);
+  contents.cert.reset(cert_ptr);
+  contents.ca.reset(ca_ptr);
+  return PKCS12ParseResult(std::move(contents));
+}
+
+namespace {
+
+// Returns [ keyHandle | null, certificate | null,
+//           [ ...additionalCertificates ] ].
+void ParsePKCS12(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+
+  CHECK_GE(args.Length(), 2);
+
+  BIOPointer bio(LoadBIO(env, args[0]));
+  if (!bio) {
+    return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
+                                             "Unable to read PKCS#12 data");
+  }
+
+  // PKCS12_parse() takes a NUL-terminated C string; a view is not one, so copy
+  // the bytes out.
+  std::string pass_storage;
+  const char* pass = nullptr;
+  if (!args[1]->IsUndefined()) {
+    THROW_AND_RETURN_IF_NOT_BUFFER(env, args[1], "passphrase");
+    Local<ArrayBufferView> abv = args[1].As<ArrayBufferView>();
+    size_t len = abv->ByteLength();
+    pass_storage.resize(len);
+    if (len > 0) abv->CopyContents(pass_storage.data(), len);
+    // PKCS12_parse() has no length parameter, so an embedded NUL byte would
+    // truncate the passphrase and open the bundle with only the bytes that
+    // precede it. Reject it rather than silently accepting a shorter
+    // passphrase than the caller supplied. The JS layer checks this too;
+    // this is the backstop.
+    if (pass_storage.find('\0') != std::string::npos) {
+      return THROW_ERR_INVALID_ARG_VALUE(
+          env, "passphrase must not contain null bytes");
+    }
+    pass = pass_storage.c_str();
+  }
+
+  auto parsed = ParsePKCS12Bundle(bio, pass);
+
+  if (!parsed) {
+    switch (*parsed.error) {
+      case PKCS12ParseError::NOT_RECOGNIZED:
+        return THROW_ERR_CRYPTO_OPERATION_FAILED(
+            env, "Input is not a valid PKCS#12 structure");
+      case PKCS12ParseError::UNSUPPORTED_ALGORITHM:
+        return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
+            env,
+            "PKCS#12 bundle uses an unsupported algorithm; it may require "
+            "the OpenSSL legacy provider");
+      case PKCS12ParseError::FAILED:
+        return ThrowCryptoError(env,
+                                parsed.openssl_error.value_or(0),
+                                "Unable to parse PKCS#12 data");
+    }
+  }
+
+  Local<Value> key_value = v8::Null(env->isolate());
+  if (parsed.value.key) {
+    auto data = KeyObjectData::CreateAsymmetric(KeyType::kKeyTypePrivate,
+                                                std::move(parsed.value.key));
+    Local<Object> handle;
+    if (!KeyObjectHandle::Create(env, data).ToLocal(&handle)) return;
+    key_value = handle;
+  }
+
+  Local<Value> cert_value = v8::Null(env->isolate());
+  if (parsed.value.cert) {
+    Local<Object> cert;
+    if (!X509Certificate::New(env, std::move(parsed.value.cert))
+             .ToLocal(&cert)) {
+      return;
+    }
+    cert_value = cert;
+  }
+
+  const int ca_count = parsed.value.ca ? sk_X509_num(parsed.value.ca.get()) : 0;
+  LocalVector<Value> ca_values(env->isolate());
+  ca_values.reserve(ca_count > 0 ? ca_count : 0);
+
+  for (int i = 0; i < ca_count; i++) {
+    X509* ca = sk_X509_value(parsed.value.ca.get(), i);
+    if (ca == nullptr) continue;
+    // New() takes ownership, so hand it a reference of its own rather than
+    // the stack's.
+    X509_up_ref(ca);
+    ncrypto::X509Pointer owned(ca);
+    Local<Object> obj;
+    if (!X509Certificate::New(env, std::move(owned)).ToLocal(&obj)) return;
+    ca_values.push_back(obj);
+  }
+
+  Local<Value> result[] = {
+      key_value,
+      cert_value,
+      Array::New(env->isolate(), ca_values.data(), ca_values.size()),
+  };
+
+  args.GetReturnValue().Set(
+      Array::New(env->isolate(), result, arraysize(result)));
+}
+
+}  // anonymous namespace
+
+void PKCS12Parser::Initialize(Environment* env, Local<Object> target) {
+  SetMethodNoSideEffect(env->context(), target, "parsePKCS12", ParsePKCS12);
+}
+
+void PKCS12Parser::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(ParsePKCS12);
+}
+
+}  // namespace crypto
+}  // namespace node
diff --git a/src/crypto/crypto_pkcs12.h b/src/crypto/crypto_pkcs12.h
new file mode 100644
index 000000000000..598b9e5094c9
--- /dev/null
+++ b/src/crypto/crypto_pkcs12.h
@@ -0,0 +1,54 @@
+#ifndef SRC_CRYPTO_CRYPTO_PKCS12_H_
+#define SRC_CRYPTO_CRYPTO_PKCS12_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include "env.h"
+#include "ncrypto.h"
+#include "v8.h"
+
+namespace node {
+namespace crypto {
+
+// Parsed contents of a PKCS#12 bundle. Any field may be empty: a bundle can
+// legitimately contain only certificates, or only a key.
+struct PKCS12Contents {
+  ncrypto::EVPKeyPointer key;
+  ncrypto::X509Pointer cert;
+  ncrypto::StackOfX509 ca;
+};
+
+enum class PKCS12ParseError {
+  // Input is not a well-formed PKCS#12 structure.
+  NOT_RECOGNIZED,
+  // Structure is valid but uses an algorithm the active providers do not
+  // offer -- typically RC2 or PBE-SHA1 without the legacy provider.
+  UNSUPPORTED_ALGORITHM,
+  FAILED,
+};
+
+using PKCS12ParseResult = ncrypto::Result<PKCS12Contents, PKCS12ParseError>;
+
+// Parses a PKCS#12 bundle from `bio`. `pass` is nullptr for no passphrase, or
+// a NUL-terminated string. PKCS12_parse() verifies the MAC when one is present,
+// and for nullptr or "" it tries both PKCS#12 password encodings, so those two
+// arguments cannot give different results.
+//
+// Callers apply their own requirements to the result: crypto.parsePKCS12()
+// accepts any combination of key and certificates, while the TLS `pfx` option
+// requires both a key and a certificate.
+PKCS12ParseResult ParsePKCS12Bundle(const ncrypto::BIOPointer& bio,
+                                    const char* pass);
+
+class PKCS12Parser final {
+ public:
+  static void Initialize(Environment* env, v8::Local<v8::Object> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+};
+
+}  // namespace crypto
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_CRYPTO_CRYPTO_PKCS12_H_
diff --git a/src/crypto/crypto_pqc.cc b/src/crypto/crypto_pqc.cc
index 3cccca0c0d73..17d6855ada7b 100644
--- a/src/crypto/crypto_pqc.cc
+++ b/src/crypto/crypto_pqc.cc
@@ -1,283 +1,22 @@
 #include "crypto/crypto_pqc.h"
-#include "crypto/crypto_util.h"
-#include "env-inl.h"
-#include "string_bytes.h"
+#include "ncrypto.h"
+#include "util-inl.h"
 #include "v8.h"
 
 namespace node {
 
-using ncrypto::DataPointer;
-using ncrypto::EVPKeyPointer;
-using v8::Local;
-using v8::Object;
-using v8::String;
 using v8::Value;
 
 namespace crypto {
 
-#if OPENSSL_WITH_PQC
-namespace {
-using PqcKeyTypeGetter = Local<String> (Environment::*)() const;
-
-enum PqcAlgorithmFlag {
-  kPqcRawPrivate = 1 << 0,
-  kPqcRawSeed = 1 << 1,
-  kPqcSignature = 1 << 2,
-};
-
-struct PqcAlgorithm {
-  int id;
-  const char* name;
-  PqcKeyTypeGetter key_type;
-  int flags;
-};
-
-// ML-DSA and ML-KEM carry private material as a seed. SLH-DSA uses the
-// expanded private key and is only exposed by OpenSSL.
-constexpr int kPqcMlDsaFlags = kPqcRawSeed | kPqcSignature;
-constexpr int kPqcMlKemFlags = kPqcRawSeed;
-constexpr int kPqcSlhDsaFlags = kPqcRawPrivate | kPqcSignature;
-
-constexpr PqcAlgorithm kPqcAlgorithms[] = {
-    {EVP_PKEY_ML_DSA_44,
-     "ML-DSA-44",
-     &Environment::crypto_ml_dsa_44_string,
-     kPqcMlDsaFlags},
-    {EVP_PKEY_ML_DSA_65,
-     "ML-DSA-65",
-     &Environment::crypto_ml_dsa_65_string,
-     kPqcMlDsaFlags},
-    {EVP_PKEY_ML_DSA_87,
-     "ML-DSA-87",
-     &Environment::crypto_ml_dsa_87_string,
-     kPqcMlDsaFlags},
-    {EVP_PKEY_ML_KEM_768,
-     "ML-KEM-768",
-     &Environment::crypto_ml_kem_768_string,
-     kPqcMlKemFlags},
-    {EVP_PKEY_ML_KEM_1024,
-     "ML-KEM-1024",
-     &Environment::crypto_ml_kem_1024_string,
-     kPqcMlKemFlags},
-
-#if OPENSSL_WITH_PQC_ML_KEM_512
-    {EVP_PKEY_ML_KEM_512,
-     "ML-KEM-512",
-     &Environment::crypto_ml_kem_512_string,
-     kPqcMlKemFlags},
-#endif
-#if OPENSSL_WITH_PQC_SLH_DSA
-    {EVP_PKEY_SLH_DSA_SHA2_128F,
-     "SLH-DSA-SHA2-128f",
-     &Environment::crypto_slh_dsa_sha2_128f_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHA2_128S,
-     "SLH-DSA-SHA2-128s",
-     &Environment::crypto_slh_dsa_sha2_128s_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHA2_192F,
-     "SLH-DSA-SHA2-192f",
-     &Environment::crypto_slh_dsa_sha2_192f_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHA2_192S,
-     "SLH-DSA-SHA2-192s",
-     &Environment::crypto_slh_dsa_sha2_192s_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHA2_256F,
-     "SLH-DSA-SHA2-256f",
-     &Environment::crypto_slh_dsa_sha2_256f_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHA2_256S,
-     "SLH-DSA-SHA2-256s",
-     &Environment::crypto_slh_dsa_sha2_256s_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHAKE_128F,
-     "SLH-DSA-SHAKE-128f",
-     &Environment::crypto_slh_dsa_shake_128f_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHAKE_128S,
-     "SLH-DSA-SHAKE-128s",
-     &Environment::crypto_slh_dsa_shake_128s_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHAKE_192F,
-     "SLH-DSA-SHAKE-192f",
-     &Environment::crypto_slh_dsa_shake_192f_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHAKE_192S,
-     "SLH-DSA-SHAKE-192s",
-     &Environment::crypto_slh_dsa_shake_192s_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHAKE_256F,
-     "SLH-DSA-SHAKE-256f",
-     &Environment::crypto_slh_dsa_shake_256f_string,
-     kPqcSlhDsaFlags},
-    {EVP_PKEY_SLH_DSA_SHAKE_256S,
-     "SLH-DSA-SHAKE-256s",
-     &Environment::crypto_slh_dsa_shake_256s_string,
-     kPqcSlhDsaFlags},
-#endif
-};
-
-const PqcAlgorithm* FindPqcAlgorithmById(int id) {
-  for (const auto& alg : kPqcAlgorithms) {
-    if (alg.id == id) return &alg;
-  }
-  return nullptr;
-}
-
-const PqcAlgorithm* FindPqcAlgorithmByName(const char* name) {
-  for (const auto& alg : kPqcAlgorithms) {
-    if (strcmp(name, alg.name) == 0) return &alg;
-  }
-  return nullptr;
-}
-
-bool HasPqcAlgorithmFlag(const PqcAlgorithm* alg, PqcAlgorithmFlag flag) {
-  return alg != nullptr && (alg->flags & flag) != 0;
-}
-
-bool TrySetEncodedKey(Environment* env,
-                      DataPointer data,
-                      Local<Object> target,
-                      Local<String> key) {
-  Local<Value> encoded;
-  if (!data) return false;
-  const ncrypto::Buffer<const char> out = data;
-  return StringBytes::Encode(env->isolate(), out.data, out.len, BASE64URL)
-             .ToLocal(&encoded) &&
-         target->DefineOwnProperty(env->context(), key, encoded)
-             .FromMaybe(false);
-}
-}  // namespace
-
-bool ExportJwkPqcKey(Environment* env,
-                     const KeyObjectData& key,
-                     Local<Object> target) {
-  Mutex::ScopedLock lock(key.mutex());
-  const auto& pkey = key.GetAsymmetricKey();
-
-  const PqcAlgorithm* alg = FindPqcAlgorithmById(pkey.id());
-  CHECK(alg);
-
-  if (key.GetKeyType() == kKeyTypePrivate) {
-    const bool uses_seed = HasPqcAlgorithmFlag(alg, kPqcRawSeed);
-    DataPointer priv_data = uses_seed ? pkey.rawSeed() : pkey.rawPrivateKey();
-    if (uses_seed && !priv_data) {
-      THROW_ERR_CRYPTO_OPERATION_FAILED(env,
-                                        "key does not have an available seed");
-      return false;
-    }
-    if (!TrySetEncodedKey(
-            env, std::move(priv_data), target, env->jwk_priv_string())) {
-      return false;
-    }
-  }
-
-  return !(!target
-                ->DefineOwnProperty(env->context(),
-                                    env->jwk_kty_string(),
-                                    env->jwk_akp_string())
-                .FromMaybe(false) ||
-           !target
-                ->DefineOwnProperty(env->context(),
-                                    env->jwk_alg_string(),
-                                    OneByteString(env->isolate(), alg->name))
-                .FromMaybe(false) ||
-           !TrySetEncodedKey(
-               env, pkey.rawPublicKey(), target, env->jwk_pub_string()));
-}
-
-KeyObjectData ImportJWKPqcKey(Environment* env, Local<Object> jwk) {
-  Local<Value> alg_value;
-  Local<Value> pub_value;
-  Local<Value> priv_value;
-
-  if (!jwk->Get(env->context(), env->jwk_alg_string()).ToLocal(&alg_value) ||
-      !jwk->Get(env->context(), env->jwk_pub_string()).ToLocal(&pub_value) ||
-      !jwk->Get(env->context(), env->jwk_priv_string()).ToLocal(&priv_value)) {
-    return {};
-  }
-
-  Utf8Value alg_str(env->isolate(),
-                    alg_value->IsString() ? alg_value.As<String>()
-                                          : String::Empty(env->isolate()));
-
-  const PqcAlgorithm* alg = FindPqcAlgorithmByName(*alg_str);
-  if (!alg) {
-    THROW_ERR_CRYPTO_INVALID_JWK(env, "Unsupported JWK AKP \"alg\"");
-    return {};
-  }
-
-  if (!pub_value->IsString() ||
-      (!priv_value->IsUndefined() && !priv_value->IsString())) {
-    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK AKP key");
-    return {};
-  }
-
-  KeyType type = priv_value->IsString() ? kKeyTypePrivate : kKeyTypePublic;
-
-  EVPKeyPointer pkey;
-  if (type == kKeyTypePrivate) {
-    ByteSource priv =
-        ByteSource::FromEncodedString(env, priv_value.As<String>());
-    ncrypto::Buffer<const unsigned char> buf{
-        .data = priv.data<const unsigned char>(),
-        .len = priv.size(),
-    };
-    pkey = HasPqcAlgorithmFlag(alg, kPqcRawSeed)
-               ? EVPKeyPointer::NewRawSeed(alg->id, buf)
-               : EVPKeyPointer::NewRawPrivate(alg->id, buf);
-  } else {
-    ByteSource pub = ByteSource::FromEncodedString(env, pub_value.As<String>());
-    pkey =
-        EVPKeyPointer::NewRawPublic(alg->id,
-                                    ncrypto::Buffer<const unsigned char>{
-                                        .data = pub.data<const unsigned char>(),
-                                        .len = pub.size(),
-                                    });
-  }
-
-  if (!pkey) {
-    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK AKP key");
-    return {};
-  }
-
-  return KeyObjectData::CreateAsymmetric(type, std::move(pkey));
-}
-
-bool IsPqcKeyId(int id) {
-  return FindPqcAlgorithmById(id) != nullptr;
-}
-
-bool IsPqcRawPrivateKeyId(int id) {
-  const PqcAlgorithm* alg = FindPqcAlgorithmById(id);
-  return HasPqcAlgorithmFlag(alg, kPqcRawPrivate);
-}
-
-bool IsPqcSeedKeyId(int id) {
-  const PqcAlgorithm* alg = FindPqcAlgorithmById(id);
-  return HasPqcAlgorithmFlag(alg, kPqcRawSeed);
-}
-
-bool IsPqcSignatureKeyId(int id) {
-  const PqcAlgorithm* alg = FindPqcAlgorithmById(id);
-  return HasPqcAlgorithmFlag(alg, kPqcSignature);
-}
-
-int GetPqcNidFromName(const char* name) {
-  for (const auto& alg : kPqcAlgorithms) {
-    if (StringEqualNoCase(name, alg.name)) return alg.id;
-  }
-  return NID_undef;
-}
-
-Local<Value> GetPqcAsymmetricKeyType(Environment* env, int id) {
-  const PqcAlgorithm* alg = FindPqcAlgorithmById(id);
-  if (alg == nullptr) return v8::Undefined(env->isolate());
-
-  Local<String> key_type = (env->*(alg->key_type))();
-  return key_type.As<Value>();
+void GetPqcKeyTypes(const v8::FunctionCallbackInfo<Value>& args) {
+  v8::LocalVector<Value> names(args.GetIsolate());
+  ncrypto::KeyAlgorithm::ForEachPqc(
+      [&](const ncrypto::KeyAlgorithm& algorithm) {
+        names.push_back(OneByteString(args.GetIsolate(), algorithm.name()));
+      });
+  args.GetReturnValue().Set(
+      v8::Array::New(args.GetIsolate(), names.data(), names.size()));
 }
-#endif
 }  // namespace crypto
 }  // namespace node
diff --git a/src/crypto/crypto_pqc.h b/src/crypto/crypto_pqc.h
index 14f919d94c6f..23cdcdc05123 100644
--- a/src/crypto/crypto_pqc.h
+++ b/src/crypto/crypto_pqc.h
@@ -3,35 +3,11 @@
 
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
-#include "crypto/crypto_keys.h"
-#include "env.h"
 #include "v8.h"
 
 namespace node {
 namespace crypto {
-#if OPENSSL_WITH_PQC
-bool ExportJwkPqcKey(Environment* env,
-                     const KeyObjectData& key,
-                     v8::Local<v8::Object> target);
-
-KeyObjectData ImportJWKPqcKey(Environment* env, v8::Local<v8::Object> jwk);
-
-// Returns true for PQC algorithms that support raw private key export/import.
-bool IsPqcRawPrivateKeyId(int id);
-// Returns true if the given EVP_PKEY id is a PQC algorithm known to Node.
-bool IsPqcKeyId(int id);
-// Returns true for PQC algorithms that carry the private key as a seed
-// (ML-DSA, ML-KEM). Returns false for algorithms that use the expanded
-// private key (SLH-DSA), or for non-PQC ids.
-bool IsPqcSeedKeyId(int id);
-// Returns true for PQC signature algorithms (ML-DSA, SLH-DSA). Returns false
-// for ML-KEM or for non-PQC ids.
-bool IsPqcSignatureKeyId(int id);
-// Returns the EVP_PKEY id for the given PQC algorithm name, or NID_undef.
-int GetPqcNidFromName(const char* name);
-// Returns the JS asymmetricKeyType string for a PQC id, or undefined.
-v8::Local<v8::Value> GetPqcAsymmetricKeyType(Environment* env, int id);
-#endif
+void GetPqcKeyTypes(const v8::FunctionCallbackInfo<v8::Value>& args);
 }  // namespace crypto
 }  // namespace node
 
diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
index 82d7affccc30..6eea14dce814 100644
--- a/src/crypto/crypto_rsa.cc
+++ b/src/crypto/crypto_rsa.cc
@@ -19,9 +19,11 @@ using ncrypto::DataPointer;
 using ncrypto::Digest;
 using ncrypto::EVPKeyCtxPointer;
 using ncrypto::EVPKeyPointer;
+using ncrypto::KeyAlgorithm;
 #if NCRYPTO_USE_LEGACY_KEY_TYPES
 using ncrypto::RSAPointer;
 #endif
+using v8::Array;
 using v8::ArrayBuffer;
 using v8::BackingStoreInitializationMode;
 using v8::FunctionCallbackInfo;
@@ -38,10 +40,27 @@ using v8::Uint32;
 using v8::Value;
 
 namespace crypto {
+namespace {
+constexpr uint32_t kMaxRsaOtherPrimeInfos = 8;
+
+bool IsRsaPssDigestEncodable(const Digest& digest) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const int nid = EVP_MD_type(digest.get());
+  if (nid == NID_undef) return false;
+
+  const ASN1_OBJECT* object = OBJ_nid2obj(nid);
+  return object != nullptr && OBJ_length(object) > 0;
+#else
+  static_cast<void>(digest);
+  return true;
+#endif
+}
+}  // namespace
+
 EVPKeyCtxPointer RsaKeyGenTraits::Setup(RsaKeyPairGenConfig* params) {
-  auto ctx = EVPKeyCtxPointer::NewFromID(
-      params->params.variant == kKeyVariantRSA_PSS ? EVP_PKEY_RSA_PSS
-                                                   : EVP_PKEY_RSA);
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(
+      params->params.variant == kKeyVariantRSA_PSS ? KeyAlgorithm::RSA_PSS
+                                                   : KeyAlgorithm::RSA);
 
   if (!ctx.initForKeygen() ||
       !ctx.setRsaKeygenBits(params->params.modulus_bits)) {
@@ -58,7 +77,8 @@ EVPKeyCtxPointer RsaKeyGenTraits::Setup(RsaKeyPairGenConfig* params) {
   }
 
   if (params->params.variant == kKeyVariantRSA_PSS) {
-    if (params->params.md && !ctx.setRsaPssKeygenMd(params->params.md)) {
+    if (params->params.md && (!IsRsaPssDigestEncodable(params->params.md) ||
+                              !ctx.setRsaPssKeygenMd(params->params.md))) {
       return {};
     }
 
@@ -71,7 +91,8 @@ EVPKeyCtxPointer RsaKeyGenTraits::Setup(RsaKeyPairGenConfig* params) {
       mgf1_md = params->params.md;
     }
 
-    if (mgf1_md && !ctx.setRsaPssKeygenMgf1Md(mgf1_md)) {
+    if (mgf1_md && (!IsRsaPssDigestEncodable(mgf1_md) ||
+                    !ctx.setRsaPssKeygenMgf1Md(mgf1_md))) {
       return {};
     }
 
@@ -200,6 +221,7 @@ WebCryptoCipherStatus RSA_Cipher(Environment* env,
   const ncrypto::Rsa::CipherParams nparams{
       .padding = params.padding,
       .digest = params.digest,
+      .mgf1_digest = params.digest,
       .label = params.label,
   };
 
@@ -363,6 +385,29 @@ bool ExportJWKRsaKey(Environment* env,
             .IsNothing()) {
       return false;
     }
+
+    const auto other_prime_infos = rsa.getOtherPrimeInfos();
+    if (!other_prime_infos.empty()) {
+      const uint32_t count = static_cast<uint32_t>(other_prime_infos.size());
+      Local<Array> oth = Array::New(env->isolate(), count);
+      for (uint32_t i = 0; i < count; i++) {
+        const auto& info = other_prime_infos[i];
+        Local<Object> item = Object::New(env->isolate());
+        if (SetEncodedValue(env, item, env->jwk_r_string(), info.r)
+                .IsNothing() ||
+            SetEncodedValue(env, item, env->jwk_d_string(), info.d)
+                .IsNothing() ||
+            SetEncodedValue(env, item, env->jwk_t_string(), info.t)
+                .IsNothing() ||
+            !oth->Set(env->context(), i, item).FromMaybe(false)) {
+          return false;
+        }
+      }
+      if (!target->DefineOwnProperty(env->context(), env->jwk_oth_string(), oth)
+               .FromMaybe(false)) {
+        return false;
+      }
+    }
   }
 
   return true;
@@ -372,12 +417,13 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
   Local<Value> n_value;
   Local<Value> e_value;
   Local<Value> d_value;
+  Local<Value> oth_value;
 
   if (!jwk->Get(env->context(), env->jwk_n_string()).ToLocal(&n_value) ||
       !jwk->Get(env->context(), env->jwk_e_string()).ToLocal(&e_value) ||
       !jwk->Get(env->context(), env->jwk_d_string()).ToLocal(&d_value) ||
-      !n_value->IsString() ||
-      !e_value->IsString()) {
+      !jwk->Get(env->context(), env->jwk_oth_string()).ToLocal(&oth_value) ||
+      !n_value->IsString() || !e_value->IsString()) {
     THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
     return {};
   }
@@ -388,6 +434,10 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
   }
 
   KeyType type = d_value->IsString() ? kKeyTypePrivate : kKeyTypePublic;
+  if (type == kKeyTypePublic && !oth_value->IsUndefined()) {
+    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+    return {};
+  }
 
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   ncrypto::Rsa rsa_view;
@@ -441,8 +491,63 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
     ByteSource dq = ByteSource::FromEncodedString(env, dq_value.As<String>());
     ByteSource qi = ByteSource::FromEncodedString(env, qi_value.As<String>());
 
-    if (!rsa_view.setPrivateKey(
-            d.ToBN(), q.ToBN(), p.ToBN(), dp.ToBN(), dq.ToBN(), qi.ToBN())) {
+    ncrypto::Rsa::OtherPrimeInfoPointers other_prime_infos;
+    if (!oth_value->IsUndefined()) {
+      if (!oth_value->IsArray()) {
+        THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+        return {};
+      }
+
+      Local<Array> oth = oth_value.As<Array>();
+      const uint32_t length = oth->Length();
+      if (length == 0 || length > kMaxRsaOtherPrimeInfos) {
+        THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+        return {};
+      }
+      other_prime_infos.reserve(length);
+      for (uint32_t i = 0; i < length; i++) {
+        Local<Value> item_value;
+        Local<Value> r_value;
+        Local<Value> other_d_value;
+        Local<Value> t_value;
+        if (!oth->Get(env->context(), i).ToLocal(&item_value) ||
+            !item_value->IsObject()) {
+          THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+          return {};
+        }
+
+        Local<Object> item = item_value.As<Object>();
+        if (!item->Get(env->context(), env->jwk_r_string()).ToLocal(&r_value) ||
+            !item->Get(env->context(), env->jwk_d_string())
+                 .ToLocal(&other_d_value) ||
+            !item->Get(env->context(), env->jwk_t_string()).ToLocal(&t_value) ||
+            !r_value->IsString() || !other_d_value->IsString() ||
+            !t_value->IsString()) {
+          THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+          return {};
+        }
+
+        other_prime_infos.push_back({
+            ByteSource::FromEncodedString(env, r_value.As<String>()).ToBN(),
+            ByteSource::FromEncodedString(env, other_d_value.As<String>())
+                .ToBN(),
+            ByteSource::FromEncodedString(env, t_value.As<String>()).ToBN(),
+        });
+      }
+    }
+
+    if (!rsa_view.setPrivateKey(d.ToBN(),
+                                q.ToBN(),
+                                p.ToBN(),
+                                dp.ToBN(),
+                                dq.ToBN(),
+                                qi.ToBN(),
+                                std::move(other_prime_infos))) {
+      THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+      return {};
+    }
+
+    if (!rsa_view.checkPrimeProduct()) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
       return {};
     }
@@ -467,9 +572,7 @@ bool GetRsaKeyDetail(Environment* env,
   Mutex::ScopedLock lock(key.mutex());
   const auto& m_pkey = key.GetAsymmetricKey();
 
-  // TODO(tniessen): Remove the "else" branch once we drop support for OpenSSL
-  // versions older than 1.1.1e via FIPS / dynamic linking.
-  const ncrypto::Rsa rsa = m_pkey;
+  const auto rsa = ncrypto::Rsa::PublicOnly(m_pkey);
   if (!rsa) return false;
 
   auto pub_key = rsa.getPublicKey();
@@ -502,16 +605,9 @@ bool GetRsaKeyDetail(Environment* env,
     return false;
   }
 
-  if (m_pkey.id() == EVP_PKEY_RSA_PSS) {
-    // Due to the way ASN.1 encoding works, default values are omitted when
-    // encoding the data structure. However, there are also RSA-PSS keys for
-    // which no parameters are set. In that case, the ASN.1 RSASSA-PSS-params
-    // sequence will be missing entirely and RSA_get0_pss_params will return
-    // nullptr. If parameters are present but all parameters are set to their
-    // default values, an empty sequence will be stored in the ASN.1 structure.
-    // In that case, RSA_get0_pss_params does not return nullptr but all fields
-    // of the returned RSA_PSS_PARAMS will be set to nullptr.
-
+  if (m_pkey.isA(KeyAlgorithm::RSA_PSS)) {
+    // An absent RSASSA-PSS-params sequence means the key is unrestricted.
+    // An empty sequence restricts the key to the default parameter values.
     auto maybe_params = rsa.getPssParams();
     if (maybe_params.has_value()) {
       auto& params = maybe_params.value();
diff --git a/src/crypto/crypto_sig.cc b/src/crypto/crypto_sig.cc
index 3e065857cff8..e0783e067b52 100644
--- a/src/crypto/crypto_sig.cc
+++ b/src/crypto/crypto_sig.cc
@@ -22,7 +22,6 @@ using ncrypto::ClearErrorOnReturn;
 using ncrypto::DataPointer;
 using ncrypto::Digest;
 using ncrypto::ECDSASigPointer;
-using ncrypto::ECKeyPointer;
 using ncrypto::EVPKeyCtxPointer;
 using ncrypto::EVPKeyPointer;
 using ncrypto::EVPMDCtxPointer;
@@ -47,12 +46,11 @@ using v8::Value;
 namespace crypto {
 namespace {
 int GetPaddingFromJS(const EVPKeyPointer& key, Local<Value> val) {
-  int padding = key.getDefaultSignPadding();
   if (!val->IsUndefined()) [[likely]] {
     CHECK(val->IsInt32());
-    padding = val.As<Int32>()->Value();
+    return val.As<Int32>()->Value();
   }
-  return padding;
+  return key.getDefaultSignPadding();
 }
 
 std::optional<int> GetSaltLenFromJS(Local<Value> val) {
@@ -83,147 +81,6 @@ bool ApplyRSAOptions(const EVPKeyPointer& pkey,
   return true;
 }
 
-constexpr size_t kEd25519PointSize = 32;
-constexpr size_t kEd448PointSize = 57;
-
-// Ed25519 has cofactor 8, so the first eight entries are the full
-// canonical small-order subgroup: identity, one point of order 2,
-// two points of order 4, and four points of order 8.
-constexpr unsigned char kEd25519SmallOrderPoints[][kEd25519PointSize] = {
-    // Identity.
-    {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
-    // Order 2.
-    {0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
-    // Order 4.
-    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80},
-    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
-    // Order 8.
-    {0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b,
-     0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39,
-     0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0x7a},
-    {0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b,
-     0x76, 0x0d, 0x10, 0x67, 0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39,
-     0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac, 0x03, 0xfa},
-    {0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4,
-     0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6,
-     0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x05},
-    {0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4,
-     0x89, 0xf2, 0xef, 0x98, 0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6,
-     0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53, 0xfc, 0x85},
-    // Non-canonical encodings of the same small-order points.
-    {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80},
-    {0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
-    {0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
-    {0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
-    {0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
-    {0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
-};
-
-// Ed448 has cofactor 4, so these four entries are the full canonical
-// small-order subgroup: identity, one point of order 2, and two points
-// of order 4.
-constexpr unsigned char kEd448SmallOrderPoints[][kEd448PointSize] = {
-    // Identity.
-    {0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
-    // Order 2.
-    {0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00},
-    // Order 4.
-    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
-    {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80},
-};
-
-template <size_t PointSize, size_t Count>
-bool ContainsPoint(const unsigned char* candidate,
-                   const unsigned char (&points)[Count][PointSize]) {
-  for (const auto& point : points) {
-    if (memcmp(candidate, point, PointSize) == 0) return true;
-  }
-  return false;
-}
-
-bool IsSmallOrderEdDsaPoint(int id,
-                            const unsigned char* candidate,
-                            size_t size) {
-  switch (id) {
-    case EVP_PKEY_ED25519:
-      return size == kEd25519PointSize &&
-             ContainsPoint(candidate, kEd25519SmallOrderPoints);
-    case EVP_PKEY_ED448:
-      return size == kEd448PointSize &&
-             ContainsPoint(candidate, kEd448SmallOrderPoints);
-    default:
-      return false;
-  }
-}
-
-bool HasSmallOrderEdDsaPoint(const EVPKeyPointer& key,
-                             const ByteSource& signature) {
-  const int id = key.id();
-  size_t point_size;
-
-  switch (id) {
-    case EVP_PKEY_ED25519:
-      point_size = kEd25519PointSize;
-      break;
-    case EVP_PKEY_ED448:
-      point_size = kEd448PointSize;
-      break;
-    default:
-      return false;
-  }
-
-  if (signature.size() != point_size * 2) return false;
-
-  if (IsSmallOrderEdDsaPoint(id, signature.data<unsigned char>(), point_size)) {
-    return true;
-  }
-
-  unsigned char raw_public_key[kEd448PointSize];
-  size_t raw_public_key_size = point_size;
-  if (EVP_PKEY_get_raw_public_key(
-          key.get(), raw_public_key, &raw_public_key_size) != 1) {
-    return false;
-  }
-
-  return IsSmallOrderEdDsaPoint(id, raw_public_key, raw_public_key_size);
-}
-
 std::unique_ptr<BackingStore> Node_SignFinal(Environment* env,
                                              EVPMDCtxPointer&& mdctx,
                                              const EVPKeyPointer& pkey,
@@ -380,54 +237,7 @@ void CheckThrow(Environment* env, SignBase::Error error) {
 }
 
 bool UseP1363Encoding(const EVPKeyPointer& key, const DSASigEnc dsa_encoding) {
-  return key.isSigVariant() && dsa_encoding == DSASigEnc::P1363;
-}
-
-bool SupportsContextString(const EVPKeyPointer& key) {
-  if (!OPENSSL_WITH_SIGNATURE_CONTEXT_STRING) return false;
-
-  const int id = key.id();
-#if OPENSSL_WITH_PQC
-  if (IsPqcSignatureKeyId(id)) return true;
-#endif
-#ifndef OPENSSL_IS_BORINGSSL
-  if (id == EVP_PKEY_ED25519 || id == EVP_PKEY_ED448) return true;
-#endif
-  return false;
-}
-
-// Returns true unless the key is known not to be SM2, so that a key whose curve
-// cannot be determined opts out of the prehashed fallback rather than into it.
-bool MayBeSM2Key(const EVPKeyPointer& key) {
-#ifdef OPENSSL_IS_BORINGSSL
-  return false;
-#else
-  if (key.id() == EVP_PKEY_SM2) return true;
-  if (key.id() != EVP_PKEY_EC) return false;
-
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
-  // An ECKeyPointer would also need the public point, which a provider-backed
-  // key need not expose.
-  char group_name[64];
-  size_t group_name_len = 0;
-  if (EVP_PKEY_get_utf8_string_param(key.get(),
-                                     OSSL_PKEY_PARAM_GROUP_NAME,
-                                     group_name,
-                                     sizeof(group_name),
-                                     &group_name_len) != 1) {
-    return true;
-  }
-  return OBJ_sn2nid(group_name) == NID_sm2 ||
-         EC_curve_nist2nid(group_name) == NID_sm2;
-#else
-  ECKeyPointer ec(key);
-  if (!ec) return true;
-
-  const EC_GROUP* group = ec.getGroup();
-  if (group == nullptr) return true;
-  return EC_GROUP_get_curve_name(group) == NID_sm2;
-#endif
-#endif
+  return dsa_encoding == DSASigEnc::P1363 && key.isSigVariant();
 }
 
 bool CanUsePrehashedFallback(const EVPKeyPointer& key,
@@ -439,7 +249,7 @@ bool CanUsePrehashedFallback(const EVPKeyPointer& key,
 
   // SM2 digest signing first hashes the algorithm-specific Z value, so the
   // lower-level prehashed sign/verify operation is not equivalent.
-  return key.isSigVariant() && !MayBeSM2Key(key);
+  return key.isSigVariant() && !key.mayBeSM2();
 }
 
 ByteSource SignPrehashed(Environment* env,
@@ -644,7 +454,8 @@ void Sign::SignFinal(const FunctionCallbackInfo<Value>& args) {
   if (!key) [[unlikely]]
     return;
 
-  if (key.isOneShotVariant()) [[unlikely]] {
+  const auto* algorithm = key.getAlgorithm();
+  if (algorithm != nullptr && algorithm->isOneShot()) [[unlikely]] {
     THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(env);
     return;
   }
@@ -761,7 +572,8 @@ void Verify::VerifyFinal(const FunctionCallbackInfo<Value>& args) {
   if (!key) [[unlikely]]
     return;
 
-  if (key.isOneShotVariant()) [[unlikely]] {
+  const auto* algorithm = key.getAlgorithm();
+  if (algorithm != nullptr && algorithm->isOneShot()) [[unlikely]] {
     THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(env);
     return;
   }
@@ -924,14 +736,15 @@ bool SignTraits::DeriveBits(Environment* env,
   bool has_context = (params.flags & SignConfiguration::kHasContextString &&
                       params.context_string.size() > 0);
 
-  if (has_context && !SupportsContextString(key)) {
+  if (has_context && !key.supportsContextString()) {
     if (can_throw) crypto::CheckThrow(env, SignBase::Error::ContextUnsupported);
     return false;
   }
 
-  int padding = params.flags & SignConfiguration::kHasPadding
-                    ? params.padding
-                    : key.getDefaultSignPadding();
+  int padding = params.padding;
+  if (!(params.flags & SignConfiguration::kHasPadding)) {
+    padding = key.getDefaultSignPadding();
+  }
 
   std::optional<int> salt_length =
       params.flags & SignConfiguration::kHasSaltLength
@@ -978,7 +791,8 @@ bool SignTraits::DeriveBits(Environment* env,
 
   switch (params.mode) {
     case SignConfiguration::Mode::Sign: {
-      if (key.isOneShotVariant()) {
+      const auto* algorithm = key.getAlgorithm();
+      if (algorithm != nullptr && algorithm->isOneShot()) {
         auto data = context.signOneShot(params.data);
         if (!data) [[unlikely]] {
           if (can_throw) crypto::CheckThrow(env, SignBase::Error::PrivateKey);
@@ -1029,7 +843,7 @@ bool SignTraits::DeriveBits(Environment* env,
       // Retrying 0 would perform a second verification for every mismatch.
       int verify_result = context.verifyOneShot(params.data, params.signature);
       if (verify_result == 1 &&
-          !HasSmallOrderEdDsaPoint(key, params.signature)) {
+          !key.hasSmallOrderEdDsaPoint(params.signature)) {
         static_cast<char*>(buf.get())[0] = 1;
       } else if (verify_result < 0 &&
                  CanUsePrehashedFallback(key, params.digest, has_context) &&
diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index ce44ad15fa79..83f84c0a1c3e 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -23,7 +23,6 @@
 #include <cstdio>
 #include "async_wrap-inl.h"
 #include "crypto/crypto_bio.h"
-#include "crypto/crypto_clienthello-inl.h"
 #include "crypto/crypto_common.h"
 #include "crypto/crypto_context.h"
 #include "crypto/crypto_util.h"
@@ -103,42 +102,43 @@ SSL_SESSION* GetSessionCallback(
   return w->ReleaseSession();
 }
 
-void OnClientHello(
-    void* arg,
-    const ClientHelloParser::ClientHello& hello) {
-  TLSWrap* w = static_cast<TLSWrap*>(arg);
-  Environment* env = w->env();
-  HandleScope handle_scope(env->isolate());
-  Context::Scope context_scope(env->context());
+// The TLS library invokes this before version negotiation and before session
+// or ticket resumption, which makes async session lookup possible. If required
+// the handshake is suspended here and resumed once JS has answered.
+#ifdef OPENSSL_IS_BORINGSSL
+ssl_select_cert_result_t EarlyClientHelloCallback(const SSL_CLIENT_HELLO* ch) {
+  TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(ch->ssl));
+  if (!w->should_suspend_for_client_hello()) return ssl_select_cert_success;
 
-  Local<Object> hello_obj = Object::New(env->isolate());
-  Local<String> servername = (hello.servername() == nullptr)
-      ? String::Empty(env->isolate())
-      : OneByteString(env->isolate(),
-                      hello.servername(),
-                      hello.servername_size());
-  Local<Object> buf =
-      Buffer::Copy(
-          env,
-          reinterpret_cast<const char*>(hello.session_id()),
-          hello.session_size()).FromMaybe(Local<Object>());
+  const uint8_t* ext;
+  size_t ext_len;
+  bool has_ticket = SSL_early_callback_ctx_extension_get(
+                        ch, TLSEXT_TYPE_session_ticket, &ext, &ext_len) &&
+                    ext_len > 0;
 
-  if ((buf.IsEmpty() ||
-       hello_obj->Set(env->context(), env->session_id_string(), buf)
-           .IsNothing()) ||
-      hello_obj->Set(env->context(), env->servername_string(), servername)
-          .IsNothing() ||
-      hello_obj
-          ->Set(env->context(),
-                env->tls_ticket_string(),
-                Boolean::New(env->isolate(), hello.has_ticket()))
-          .IsNothing()) {
-    return;
-  }
+  return w->OnEarlyClientHello(ch->session_id, ch->session_id_len, has_ticket)
+             ? ssl_select_cert_success
+             : ssl_select_cert_retry;
+}
+#else
+int EarlyClientHelloCallback(SSL* s, int* al, void* arg) {
+  TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
+  if (!w->should_suspend_for_client_hello()) return SSL_CLIENT_HELLO_SUCCESS;
 
-  Local<Value> argv[] = { hello_obj };
-  w->MakeCallback(env->onclienthello_string(), arraysize(argv), argv);
+  const unsigned char* session_id;
+  size_t session_id_len = SSL_client_hello_get0_session_id(s, &session_id);
+
+  const unsigned char* ext;
+  size_t ext_len;
+  bool has_ticket = SSL_client_hello_get0_ext(
+                        s, TLSEXT_TYPE_session_ticket, &ext, &ext_len) == 1 &&
+                    ext_len > 0;
+
+  return w->OnEarlyClientHello(session_id, session_id_len, has_ticket)
+             ? SSL_CLIENT_HELLO_SUCCESS
+             : SSL_CLIENT_HELLO_RETRY;
 }
+#endif
 
 void KeylogCallback(const SSL* s, const char* line) {
   TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
@@ -218,32 +218,18 @@ int SSLCertCallback(SSL* s, void* arg) {
     // handshake will continue after certcb is done.
     return -1;
 
-  Environment* env = w->env();
-  HandleScope handle_scope(env->isolate());
-  Context::Scope context_scope(env->context());
   w->set_cert_cb_running();
 
-  Local<Object> info = Object::New(env->isolate());
+  // The view points into SSL-owned memory, so copy it before deferring.
+  std::string servername;
+  if (auto name = SSLPointer::GetServerName(s)) servername = *name;
 
-  auto servername = SSLPointer::GetServerName(s);
-  Local<String> servername_str =
-      !servername.has_value()
-          ? String::Empty(env->isolate())
-          : OneByteString(env->isolate(), servername.value());
+  w->ScheduleCertCb(std::move(servername),
+                    SSL_get_tlsext_status_type(s) == TLSEXT_STATUSTYPE_ocsp);
 
-  Local<Value> ocsp = Boolean::New(
-      env->isolate(), SSL_get_tlsext_status_type(s) == TLSEXT_STATUSTYPE_ocsp);
-
-  if (info->Set(env->context(), env->servername_string(), servername_str)
-          .IsNothing() ||
-      info->Set(env->context(), env->ocsp_request_string(), ocsp).IsNothing()) {
-    return 1;
-  }
-
-  Local<Value> argv[] = { info };
-  w->MakeCallback(env->oncertcb_string(), arraysize(argv), argv);
-
-  return w->is_cert_cb_running() ? -1 : 1;
+  // Suspend handshake with SSL_ERROR_WANT_X509_LOOKUP, and handshake will
+  // continue after certcb is done.
+  return -1;
 }
 
 int SelectALPNCallback(
@@ -254,7 +240,7 @@ int SelectALPNCallback(
     unsigned int inlen,
     void* arg) {
   TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
-  if (w->alpn_callback_enabled_) {
+  if (w->get_alpn_callback_enabled()) {
     Environment* env = w->env();
     HandleScope handle_scope(env->isolate());
 
@@ -289,7 +275,7 @@ int SelectALPNCallback(
     return SSL_TLSEXT_ERR_OK;
   }
 
-  const std::vector<unsigned char>& alpn_protos = w->alpn_protos_;
+  auto& alpn_protos = w->get_alpn_protos();
 
   if (alpn_protos.empty()) return SSL_TLSEXT_ERR_NOACK;
 
@@ -417,14 +403,15 @@ TLSWrap::TLSWrap(Environment* env,
       StreamBase(env),
       env_(env),
       kind_(kind),
-      sc_(sc),
-      has_active_write_issued_by_prev_listener_(
-          under_stream_ws == UnderlyingStreamWriteStatus::kHasActive) {
+      sc_(sc) {
+  flags_.has_active_write_issued_by_prev_listener =
+      under_stream_ws == UnderlyingStreamWriteStatus::kHasActive;
   MakeWeak();
   CHECK(sc_);
   ssl_ = sc_->CreateSSL();
   CHECK(ssl_);
 
+  sc_->SetClientHelloCallback(EarlyClientHelloCallback);
   sc_->SetGetSessionCallback(GetSessionCallback);
   sc_->SetNewSessionCallback(NewSessionCallback);
 
@@ -457,8 +444,7 @@ SSL_SESSION* TLSWrap::ReleaseSession() {
 
 void TLSWrap::InvokeQueued(int status, const char* error_str) {
   Debug(this, "Invoking queued write callbacks (%d, %s)", status, error_str);
-  if (!write_callback_scheduled_)
-    return;
+  if (!flags_.write_callback_scheduled) return;
 
   if (current_write_) {
     BaseObjectPtr<AsyncWrap> current_write = std::move(current_write_);
@@ -473,6 +459,93 @@ void TLSWrap::NewSessionDoneCb() {
   Cycle();
 }
 
+// N.b. TLS1.3 ClientHellos carry a fake legacy_session_id (middlebox compat),
+// and so emit spurious 'resumeSession'/'newSession' events here.
+bool TLSWrap::OnEarlyClientHello(const unsigned char* session_id,
+                                 size_t session_id_len,
+                                 bool has_ticket) {
+  if (!flags_.hello_emitted) {
+    flags_.hello_emitted = true;
+    Debug(this, "Scheduling onclienthello");
+
+    // The hello data is only valid inside the library callback, and JS must
+    // not run while we are on its stack: a handler that synchronously wrote
+    // to the socket would re-enter SSL mid-handshake. Copy what we need and
+    // emit from a fresh stack instead.
+    std::vector<unsigned char> id(session_id, session_id + session_id_len);
+    BaseObjectPtr<TLSWrap> strong_ref{this};
+    env()->SetImmediate(
+        [this, strong_ref, id = std::move(id), has_ticket](Environment* env) {
+          if (ssl_) EmitClientHello(id, has_ticket);
+        });
+  }
+  return flags_.hello_answered;
+}
+
+void TLSWrap::EmitClientHello(const std::vector<unsigned char>& session_id,
+                              bool has_ticket) {
+  Debug(this, "Emitting onclienthello");
+  Environment* env = this->env();
+  HandleScope handle_scope(env->isolate());
+  Context::Scope context_scope(env->context());
+
+  Local<Object> hello_obj = Object::New(env->isolate());
+  Local<Object> buf =
+      Buffer::Copy(env,
+                   reinterpret_cast<const char*>(session_id.data()),
+                   session_id.size())
+          .FromMaybe(Local<Object>());
+
+  if ((buf.IsEmpty() ||
+       hello_obj->Set(env->context(), env->session_id_string(), buf)
+           .IsNothing()) ||
+      hello_obj
+          ->Set(env->context(),
+                env->tls_ticket_string(),
+                Boolean::New(env->isolate(), has_ticket))
+          .IsNothing()) {
+    // An exception is pending, so don't re-enter SSL or JS to resume.
+    return;
+  }
+
+  Local<Value> argv[] = {hello_obj};
+  MakeCallback(env->onclienthello_string(), arraysize(argv), argv);
+}
+
+// As with the ClientHello, JS must not run on the library's stack: 'oncertcb'
+// handlers synchronously call back into the handle to resume the handshake.
+void TLSWrap::ScheduleCertCb(std::string servername, bool ocsp) {
+  Debug(this, "Scheduling oncertcb");
+  BaseObjectPtr<TLSWrap> strong_ref{this};
+  env()->SetImmediate(
+      [this, strong_ref, servername = std::move(servername), ocsp](
+          Environment* env) {
+        if (ssl_) EmitCertCb(servername, ocsp);
+      });
+}
+
+void TLSWrap::EmitCertCb(const std::string& servername, bool ocsp) {
+  Debug(this, "Emitting oncertcb");
+  Environment* env = this->env();
+  HandleScope handle_scope(env->isolate());
+  Context::Scope context_scope(env->context());
+
+  Local<Object> info = Object::New(env->isolate());
+  if (info->Set(env->context(),
+                env->servername_string(),
+                OneByteString(env->isolate(), servername))
+          .IsNothing() ||
+      info->Set(env->context(),
+                env->ocsp_request_string(),
+                Boolean::New(env->isolate(), ocsp))
+          .IsNothing()) {
+    return;
+  }
+
+  Local<Value> argv[] = {info};
+  MakeCallback(env->oncertcb_string(), arraysize(argv), argv);
+}
+
 void TLSWrap::InitSSL() {
   // Initialize SSL – OpenSSL takes ownership of these.
   enc_in_ = NodeBIO::New(env()).release();
@@ -584,8 +657,8 @@ void TLSWrap::Start(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
 
-  CHECK(!wrap->started_);
-  wrap->started_ = true;
+  CHECK(!wrap->flags_.started);
+  wrap->flags_.started = true;
 
   // Send ClientHello handshake
   CHECK(wrap->is_client());
@@ -629,7 +702,7 @@ void TLSWrap::SSLInfoCallback(const SSL* ssl_, int where, int ret) {
     CHECK(!SSL_renegotiate_pending(ssl));
     Local<Value> callback;
 
-    c->established_ = true;
+    c->flags_.established = true;
 
     if (object->Get(env->context(), env->onhandshakedone_string())
           .ToLocal(&callback) && callback->IsFunction()) {
@@ -641,12 +714,6 @@ void TLSWrap::SSLInfoCallback(const SSL* ssl_, int where, int ret) {
 void TLSWrap::EncOut() {
   Debug(this, "Trying to write encrypted output");
 
-  // Ignore cycling data if ClientHello wasn't yet parsed
-  if (!hello_parser_.IsEnded()) {
-    Debug(this, "Returning from EncOut(), hello_parser_ active");
-    return;
-  }
-
   // Write in progress
   if (write_size_ != 0) {
     Debug(this, "Returning from EncOut(), write currently in progress");
@@ -659,7 +726,7 @@ void TLSWrap::EncOut() {
     return;
   }
 
-  if (has_active_write_issued_by_prev_listener_) [[unlikely]] {
+  if (flags_.has_active_write_issued_by_prev_listener) [[unlikely]] {
     Debug(this,
           "Returning from EncOut(), "
           "has_active_write_issued_by_prev_listener_ is true");
@@ -667,9 +734,9 @@ void TLSWrap::EncOut() {
   }
 
   // Split-off queue
-  if (established_ && current_write_) {
+  if (flags_.established && current_write_) {
     Debug(this, "EncOut() write is scheduled");
-    write_callback_scheduled_ = true;
+    flags_.write_callback_scheduled = true;
   }
 
   if (ssl_ == nullptr) {
@@ -682,7 +749,7 @@ void TLSWrap::EncOut() {
     Debug(this, "No pending encrypted output");
     if (!pending_cleartext_input_ ||
         pending_cleartext_input_->ByteLength() == 0) {
-      if (!in_dowrite_) {
+      if (!flags_.in_dowrite) {
         Debug(this, "No pending cleartext input, not inside DoWrite()");
         InvokeQueued(0);
       } else {
@@ -737,7 +804,7 @@ void TLSWrap::EncOut() {
 void TLSWrap::OnStreamAfterWrite(WriteWrap* req_wrap, int status) {
   Debug(this, "OnStreamAfterWrite(status = %d)", status);
 
-  if (has_active_write_issued_by_prev_listener_) [[unlikely]] {
+  if (flags_.has_active_write_issued_by_prev_listener) [[unlikely]] {
     Debug(this, "Notify write finish to the previous_listener_");
     CHECK_EQ(write_size_, 0);  // we must have restrained writes
 
@@ -762,7 +829,7 @@ void TLSWrap::OnStreamAfterWrite(WriteWrap* req_wrap, int status) {
 
   // Handle error
   if (status) {
-    if (shutdown_) {
+    if (flags_.shutdown) {
       Debug(this, "Ignoring error after shutdown");
       return;
     }
@@ -785,14 +852,9 @@ void TLSWrap::OnStreamAfterWrite(WriteWrap* req_wrap, int status) {
 
 void TLSWrap::ClearOut() {
   Debug(this, "Trying to read cleartext output");
-  // Ignore cycling data if ClientHello wasn't yet parsed
-  if (!hello_parser_.IsEnded()) {
-    Debug(this, "Returning from ClearOut(), hello_parser_ active");
-    return;
-  }
 
   // No reads after EOF
-  if (eof_) {
+  if (flags_.eof) {
     Debug(this, "Returning from ClearOut(), EOF reached");
     return;
   }
@@ -807,7 +869,10 @@ void TLSWrap::ClearOut() {
   char out[kClearOutChunkSize];
   int read;
   for (;;) {
-    read = SSL_read(ssl_.get(), out, sizeof(out));
+    {
+      SSLLibraryCallScope ssl_library_call_scope(this);
+      read = SSL_read(ssl_.get(), out, sizeof(out));
+    }
     Debug(this, "Read %d bytes of cleartext output", read);
 
     if (read <= 0)
@@ -848,8 +913,8 @@ void TLSWrap::ClearOut() {
     int err = SSL_get_error(ssl_.get(), read);
     switch (err) {
       case SSL_ERROR_ZERO_RETURN:
-        if (!eof_) {
-          eof_ = true;
+        if (!flags_.eof) {
+          flags_.eof = true;
           EmitRead(UV_EOF);
         }
         return;
@@ -912,11 +977,6 @@ void TLSWrap::ClearOut() {
 
 void TLSWrap::ClearIn() {
   Debug(this, "Trying to write cleartext input");
-  // Ignore cycling data if ClientHello wasn't yet parsed
-  if (!hello_parser_.IsEnded()) {
-    Debug(this, "Returning from ClearIn(), hello_parser_ active");
-    return;
-  }
 
   if (ssl_ == nullptr) {
     Debug(this, "Returning from ClearIn(), ssl_ == nullptr");
@@ -933,7 +993,11 @@ void TLSWrap::ClearIn() {
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
   NodeBIO::FromBIO(enc_out_)->set_allocate_tls_hint(bs->ByteLength());
-  int written = SSL_write(ssl_.get(), bs->Data(), bs->ByteLength());
+  int written;
+  {
+    SSLLibraryCallScope ssl_library_call_scope(this);
+    written = SSL_write(ssl_.get(), bs->Data(), bs->ByteLength());
+  }
   Debug(this, "Writing %zu bytes, written = %d", bs->ByteLength(), written);
   CHECK(written == -1 || written == static_cast<int>(bs->ByteLength()));
 
@@ -947,7 +1011,7 @@ void TLSWrap::ClearIn() {
   int err = SSL_get_error(ssl_.get(), written);
   if (err == SSL_ERROR_SSL || err == SSL_ERROR_SYSCALL) {
     Debug(this, "Got SSL error (%d)", err);
-    write_callback_scheduled_ = true;
+    flags_.write_callback_scheduled = true;
     // TODO(@sam-github) Should forward an error object with
     // .code/.function/.etc, if possible.
     InvokeQueued(UV_EPROTO, GetBIOError().c_str());
@@ -991,7 +1055,7 @@ bool TLSWrap::IsClosing() {
 
 int TLSWrap::ReadStart() {
   Debug(this, "ReadStart()");
-  if (underlying_stream() != nullptr && !eof_)
+  if (underlying_stream() != nullptr && !flags_.eof)
     return underlying_stream()->ReadStart();
   return 0;
 }
@@ -1036,6 +1100,33 @@ int TLSWrap::DoWrite(WriteWrap* w,
     }
   }
 
+  // If we got here from a call inside the OpenSSL/BoringSSL stack, we need to
+  // defer reentrant write calls:
+  if (in_ssl_library_call()) {
+    Debug(this, "Deferring write issued from the SSL library's stack");
+    CHECK(!current_write_);
+    current_write_.reset(w->GetAsyncWrap());
+
+    if (length > 0) {
+      CHECK(!pending_cleartext_input_ ||
+            pending_cleartext_input_->ByteLength() == 0);
+      std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
+          env()->isolate(),
+          length,
+          BackingStoreInitializationMode::kUninitialized);
+      size_t offset = 0;
+      for (i = 0; i < count; i++) {
+        memcpy(
+            static_cast<char*>(bs->Data()) + offset, bufs[i].base, bufs[i].len);
+        offset += bufs[i].len;
+      }
+      pending_cleartext_input_ = std::move(bs);
+    }
+
+    ScheduleDeferredCycle();
+    return 0;
+  }
+
   // We want to trigger a Write() on the underlying stream to drive the stream
   // system, but don't want to encrypt empty buffers into a TLS frame, so see
   // if we can find something to Write().
@@ -1101,12 +1192,18 @@ int TLSWrap::DoWrite(WriteWrap* w,
     }
 
     NodeBIO::FromBIO(enc_out_)->set_allocate_tls_hint(length);
-    written = SSL_write(ssl_.get(), bs->Data(), length);
+    {
+      SSLLibraryCallScope ssl_library_call_scope(this);
+      written = SSL_write(ssl_.get(), bs->Data(), length);
+    }
   } else {
     // Only one buffer: try to write directly, only store if it fails
     uv_buf_t* buf = &bufs[nonempty_i];
     NodeBIO::FromBIO(enc_out_)->set_allocate_tls_hint(buf->len);
-    written = SSL_write(ssl_.get(), buf->base, buf->len);
+    {
+      SSLLibraryCallScope ssl_library_call_scope(this);
+      written = SSL_write(ssl_.get(), buf->base, buf->len);
+    }
 
     if (written == -1) {
       bs = ArrayBuffer::NewBackingStore(
@@ -1139,9 +1236,9 @@ int TLSWrap::DoWrite(WriteWrap* w,
 
   // Write any encrypted/handshake output that may be ready.
   // Guard against sync call of current_write_->Done(), its unsupported.
-  in_dowrite_ = true;
+  flags_.in_dowrite = true;
   EncOut();
-  in_dowrite_ = false;
+  flags_.in_dowrite = false;
 
   return 0;
 }
@@ -1158,8 +1255,7 @@ void TLSWrap::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
   Debug(this, "Read %zd bytes from underlying stream", nread);
 
   // Ignore everything after close_notify (rfc5246#section-7.2.1)
-  if (eof_)
-    return;
+  if (flags_.eof) return;
 
   if (nread < 0)  {
     // Error should be emitted only after all data was read
@@ -1167,7 +1263,7 @@ void TLSWrap::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
 
     if (nread == UV_EOF) {
       // underlying stream already should have also called ReadStop on itself
-      eof_ = true;
+      flags_.eof = true;
     }
 
     EmitRead(nread);
@@ -1181,20 +1277,7 @@ void TLSWrap::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
 
   // Commit the amount of data actually read into the peeked/allocated buffer
   // from the underlying stream.
-  NodeBIO* enc_in = NodeBIO::FromBIO(enc_in_);
-  enc_in->Commit(nread);
-
-  // Parse ClientHello first, if we need to. It's only parsed if session event
-  // listeners are used on the server side.  "ended" is the initial state, so
-  // can mean parsing was never started, or that parsing is finished. Either
-  // way, ended means we can give the buffered data to SSL.
-  if (!hello_parser_.IsEnded()) {
-    size_t avail = 0;
-    uint8_t* data = reinterpret_cast<uint8_t*>(enc_in->Peek(&avail));
-    CHECK_IMPLIES(data == nullptr, avail == 0);
-    Debug(this, "Passing %zu bytes to the hello parser", avail);
-    return hello_parser_.Parse(data, avail);
-  }
+  NodeBIO::FromBIO(enc_in_)->Commit(nread);
 
   // Cycle OpenSSL's state
   Cycle();
@@ -1206,16 +1289,57 @@ ShutdownWrap* TLSWrap::CreateShutdownWrap(Local<Object> req_wrap_object) {
 
 int TLSWrap::DoShutdown(ShutdownWrap* req_wrap) {
   Debug(this, "DoShutdown()");
+
+  // We must not call SSL_shutdown from inside the TLS library stack, so
+  // defer if required:
+  if (in_ssl_library_call()) {
+    Debug(this, "Deferring shutdown issued from the SSL library's stack");
+    CHECK(!pending_shutdown_);
+    pending_shutdown_.reset(req_wrap->GetAsyncWrap());
+    flags_.shutdown = true;
+    ScheduleDeferredCycle();
+    return 0;
+  }
+
   MarkPopErrorOnReturn mark_pop_error_on_return;
 
-  if (ssl_ && SSL_shutdown(ssl_.get()) == 0)
-    SSL_shutdown(ssl_.get());
+  if (ssl_) {
+    SSLLibraryCallScope ssl_library_call_scope(this);
+    if (SSL_shutdown(ssl_.get()) == 0) SSL_shutdown(ssl_.get());
+  }
 
-  shutdown_ = true;
+  flags_.shutdown = true;
   EncOut();
   return underlying_stream()->DoShutdown(req_wrap);
 }
 
+void TLSWrap::ScheduleDeferredCycle() {
+  if (flags_.deferred_cycle_scheduled) return;
+  flags_.deferred_cycle_scheduled = true;
+
+  BaseObjectPtr<TLSWrap> strong_ref{this};
+  env()->SetImmediate([this, strong_ref](Environment* env) {
+    flags_.deferred_cycle_scheduled = false;
+    if (ssl_) Cycle();
+  });
+}
+
+void TLSWrap::FlushPendingShutdown() {
+  if (!pending_shutdown_ || !ssl_) return;
+
+  const bool can_send_close_notify =
+      SSL_is_init_finished(ssl_.get()) && !is_awaiting_new_session();
+  if (!can_send_close_notify) {
+    Debug(this, "Holding deferred shutdown, cannot send close_notify yet");
+    return;
+  }
+
+  BaseObjectPtr<AsyncWrap> pending = std::move(pending_shutdown_);
+  ShutdownWrap* req_wrap = ShutdownWrap::FromObject(pending);
+  int err = DoShutdown(req_wrap);
+  if (err != 0) req_wrap->Done(err);
+}
+
 void TLSWrap::SetVerifyMode(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
@@ -1253,15 +1377,6 @@ void TLSWrap::EnableSessionCallbacks(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
   CHECK_NOT_NULL(wrap->ssl_);
   wrap->enable_session_callbacks();
-
-  // Clients don't use the HelloParser.
-  if (wrap->is_client())
-    return;
-
-  NodeBIO::FromBIO(wrap->enc_in_)->set_initial(kMaxHelloLength);
-  wrap->hello_parser_.Start(OnClientHello,
-                            OnClientHelloParseEnd,
-                            wrap);
 }
 
 void TLSWrap::EnableKeylogCallback(const FunctionCallbackInfo<Value>& args) {
@@ -1316,11 +1431,18 @@ void TLSWrap::Destroy() {
     return;
 
   // If there is a write happening, mark it as finished.
-  write_callback_scheduled_ = true;
+  flags_.write_callback_scheduled = true;
 
   // And destroy
   InvokeQueued(UV_ECANCELED, "Canceled because of SSL destruction");
 
+  // A shutdown held back off the SSL library's stack will never be replayed
+  // now, so complete it here rather than leaving the stream waiting on it.
+  if (pending_shutdown_) {
+    BaseObjectPtr<AsyncWrap> pending = std::move(pending_shutdown_);
+    ShutdownWrap::FromObject(pending)->Done(UV_ECANCELED);
+  }
+
   env()->external_memory_accounter()->Decrease(env()->isolate(), kExternalSize);
   ssl_.reset();
 
@@ -1336,7 +1458,7 @@ void TLSWrap::Destroy() {
 void TLSWrap::EnableCertCb(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
-  wrap->WaitForCertCb(OnClientHelloParseEnd, wrap);
+  wrap->WaitForCertCb(ResumeAfterCertCb, wrap);
 }
 
 void TLSWrap::WaitForCertCb(CertCb cb, void* arg) {
@@ -1344,16 +1466,16 @@ void TLSWrap::WaitForCertCb(CertCb cb, void* arg) {
   cert_cb_arg_ = arg;
 }
 
-void TLSWrap::OnClientHelloParseEnd(void* arg) {
+void TLSWrap::ResumeAfterCertCb(void* arg) {
   TLSWrap* c = static_cast<TLSWrap*>(arg);
-  Debug(c, "OnClientHelloParseEnd()");
+  Debug(c, "ResumeAfterCertCb()");
   c->Cycle();
 }
 
 void TLSWrap::EnableALPNCb(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* wrap;
   ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
-  wrap->alpn_callback_enabled_ = true;
+  wrap->flags_.alpn_callback_enabled = true;
 
   SSL* ssl = wrap->ssl_.get();
   SSL_CTX* ssl_ctx = SSL_get_SSL_CTX(ssl);
@@ -1382,7 +1504,7 @@ void TLSWrap::SetServername(const FunctionCallbackInfo<Value>& args) {
 
   CHECK_EQ(args.Length(), 1);
   CHECK(args[0]->IsString());
-  CHECK(!wrap->started_);
+  CHECK(!wrap->flags_.started);
   CHECK(wrap->is_client());
 
   CHECK(wrap->ssl_);
@@ -1597,7 +1719,7 @@ void TLSWrap::CertCbDone(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
 
-  CHECK(w->is_waiting_cert_cb() && w->cert_cb_running_);
+  CHECK(w->is_waiting_cert_cb() && w->flags_.cert_cb_running);
 
   Local<Object> object = w->object();
   Local<Value> ctx = object->Get(env->context(), env->sni_context_string())
@@ -1649,7 +1771,7 @@ void TLSWrap::CertCbDone(const FunctionCallbackInfo<Value>& args) {
   cb = w->cert_cb_;
   arg = w->cert_cb_arg_;
 
-  w->cert_cb_running_ = false;
+  w->flags_.cert_cb_running = false;
   w->cert_cb_ = nullptr;
   w->cert_cb_arg_ = nullptr;
 
@@ -1732,6 +1854,13 @@ void TLSWrap::GetPeerX509Certificate(const FunctionCallbackInfo<Value>& args) {
     args.GetReturnValue().Set(ret);
 }
 
+void TLSWrap::HasPeerCertificate(const FunctionCallbackInfo<Value>& args) {
+  TLSWrap* w;
+  ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
+  bool has_peer_cert = static_cast<bool>(X509Pointer::PeerFrom(w->ssl_));
+  args.GetReturnValue().Set(has_peer_cert);
+}
+
 void TLSWrap::GetCertificate(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
@@ -1933,19 +2062,19 @@ void TLSWrap::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
                            nullptr);
 
     switch (sign_nid) {
-      case EVP_PKEY_RSA:
+      case NID_rsaEncryption:
         sig_with_md = "RSA+";
         break;
 
-      case EVP_PKEY_RSA_PSS:
+      case NID_rsassaPss:
         sig_with_md = "RSA-PSS+";
         break;
 
-      case EVP_PKEY_DSA:
+      case NID_dsa:
         sig_with_md = "DSA+";
         break;
 
-      case EVP_PKEY_EC:
+      case NID_X9_62_id_ecPublicKey:
         sig_with_md = "ECDSA+";
         break;
 
@@ -2033,10 +2162,11 @@ void TLSWrap::ExportKeyingMaterial(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(buffer);
 }
 
-void TLSWrap::EndParser(const FunctionCallbackInfo<Value>& args) {
+void TLSWrap::ClientHelloDone(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
-  w->hello_parser_.End();
+  w->flags_.hello_answered = true;
+  w->Cycle();
 }
 
 void TLSWrap::Renegotiate(const FunctionCallbackInfo<Value>& args) {
@@ -2070,7 +2200,7 @@ void TLSWrap::GetTLSTicket(const FunctionCallbackInfo<Value>& args) {
 void TLSWrap::NewSessionDone(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
-  w->awaiting_new_session_ = false;
+  w->flags_.awaiting_new_session = false;
   w->NewSessionDoneCb();
 }
 
@@ -2151,11 +2281,18 @@ void TLSWrap::WritesIssuedByPrevListenerDone(
   ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
 
   Debug(w, "WritesIssuedByPrevListenerDone is called");
-  w->has_active_write_issued_by_prev_listener_ = false;
+  w->flags_.has_active_write_issued_by_prev_listener = false;
   w->EncOut();  // resume all of our restrained writes
 }
 
 void TLSWrap::Cycle() {
+  // With no loop to extend, cycling now would re-enter the SSL library.
+  if (cycle_depth_ == 0 && in_ssl_library_call()) {
+    Debug(this, "Deferring cycle requested from the SSL library's stack");
+    ScheduleDeferredCycle();
+    return;
+  }
+
   // Prevent recursion
   if (++cycle_depth_ > 1)
     return;
@@ -2163,6 +2300,10 @@ void TLSWrap::Cycle() {
   for (; cycle_depth_ > 0; cycle_depth_--) {
     ClearIn();
     ClearOut();
+    // ClearOut() could defer a write/shutdown, so we ClearIn() again now
+    // to avoid needing a second pass:
+    ClearIn();
+    FlushPendingShutdown();
     // EncIn() doesn't exist, it happens via stream listener callbacks.
     EncOut();
   }
@@ -2214,10 +2355,10 @@ void TLSWrap::Initialize(
   t->Inherit(AsyncWrap::GetConstructorTemplate(env));
 
   SetProtoMethod(isolate, t, "certCbDone", CertCbDone);
+  SetProtoMethod(isolate, t, "clientHelloDone", ClientHelloDone);
   SetProtoMethod(isolate, t, "destroySSL", DestroySSL);
   SetProtoMethod(isolate, t, "enableCertCb", EnableCertCb);
   SetProtoMethod(isolate, t, "enableALPNCb", EnableALPNCb);
-  SetProtoMethod(isolate, t, "endParser", EndParser);
   SetProtoMethod(isolate, t, "enableKeylogCallback", EnableKeylogCallback);
   SetProtoMethod(isolate, t, "enableSessionCallbacks", EnableSessionCallbacks);
   SetProtoMethod(isolate, t, "enableTrace", EnableTrace);
@@ -2255,6 +2396,8 @@ void TLSWrap::Initialize(
       isolate, t, "getPeerCertificate", GetPeerCertificate);
   SetProtoMethodNoSideEffect(
       isolate, t, "getPeerX509Certificate", GetPeerX509Certificate);
+  SetProtoMethodNoSideEffect(
+      isolate, t, "hasPeerCertificate", HasPeerCertificate);
   SetProtoMethodNoSideEffect(isolate, t, "getPeerFinished", GetPeerFinished);
   SetProtoMethodNoSideEffect(isolate, t, "getProtocol", GetProtocol);
   SetProtoMethodNoSideEffect(isolate, t, "getSession", GetSession);
@@ -2285,10 +2428,10 @@ void TLSWrap::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetWriteQueueSize);
 
   registry->Register(CertCbDone);
+  registry->Register(ClientHelloDone);
   registry->Register(DestroySSL);
   registry->Register(EnableCertCb);
   registry->Register(EnableALPNCb);
-  registry->Register(EndParser);
   registry->Register(EnableKeylogCallback);
   registry->Register(EnableSessionCallbacks);
   registry->Register(EnableTrace);
@@ -2314,6 +2457,7 @@ void TLSWrap::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetFinished);
   registry->Register(GetPeerCertificate);
   registry->Register(GetPeerX509Certificate);
+  registry->Register(HasPeerCertificate);
   registry->Register(GetPeerFinished);
   registry->Register(GetProtocol);
   registry->Register(GetSession);
diff --git a/src/crypto/crypto_tls.h b/src/crypto/crypto_tls.h
index 87063b50bb74..ab6024018873 100644
--- a/src/crypto/crypto_tls.h
+++ b/src/crypto/crypto_tls.h
@@ -25,7 +25,6 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include "crypto/crypto_context.h"
-#include "crypto/crypto_clienthello.h"
 
 #include "async_wrap.h"
 #include "stream_wrap.h"
@@ -55,6 +54,23 @@ class TLSWrap : public AsyncWrap,
 
   enum class UnderlyingStreamWriteStatus { kHasActive, kVacancy };
 
+  // The SSL library's state machine is not reentrant. Node holds this scope
+  // across every call into it, so that JS the SSL library invokes on its own
+  // stack is recognised and kept from re-entering.
+  class SSLLibraryCallScope {
+   public:
+    explicit SSLLibraryCallScope(TLSWrap* wrap) : wrap_(wrap) {
+      wrap_->ssl_library_call_depth_++;
+    }
+    ~SSLLibraryCallScope() { wrap_->ssl_library_call_depth_--; }
+
+    SSLLibraryCallScope(const SSLLibraryCallScope&) = delete;
+    SSLLibraryCallScope& operator=(const SSLLibraryCallScope&) = delete;
+
+   private:
+    TLSWrap* wrap_;
+  };
+
   static void Initialize(v8::Local<v8::Object> target,
                          v8::Local<v8::Value> unused,
                          v8::Local<v8::Context> context,
@@ -63,17 +79,26 @@ class TLSWrap : public AsyncWrap,
 
   ~TLSWrap() override;
 
-  inline bool is_cert_cb_running() const { return cert_cb_running_; }
+  inline bool is_cert_cb_running() const { return flags_.cert_cb_running; }
   inline bool is_waiting_cert_cb() const { return cert_cb_ != nullptr; }
-  inline bool has_session_callbacks() const { return session_callbacks_; }
-  inline void set_cert_cb_running(bool on = true) { cert_cb_running_ = on; }
+  inline bool has_session_callbacks() const { return flags_.session_callbacks; }
+  // We need to suspend the ClientHello only for server session id
+  // callbacks, and only on the first pass.
+  inline bool should_suspend_for_client_hello() const {
+    return is_server() && flags_.session_callbacks && !flags_.hello_answered;
+  }
+  inline void set_cert_cb_running(bool on = true) {
+    flags_.cert_cb_running = on;
+  }
   inline void set_awaiting_new_session(bool on = true) {
-    awaiting_new_session_ = on;
+    flags_.awaiting_new_session = on;
   }
-  inline void enable_session_callbacks() { session_callbacks_ = true; }
+  inline void enable_session_callbacks() { flags_.session_callbacks = true; }
   inline bool is_server() const { return kind_ == Kind::kServer; }
   inline bool is_client() const { return kind_ == Kind::kClient; }
-  inline bool is_awaiting_new_session() const { return awaiting_new_session_; }
+  inline bool is_awaiting_new_session() const {
+    return flags_.awaiting_new_session;
+  }
 
   // Implement StreamBase:
   bool IsAlive() override;
@@ -105,6 +130,15 @@ class TLSWrap : public AsyncWrap,
   // Called by the done() callback of the 'newSession' event.
   void NewSessionDoneCb();
 
+  // Schedules 'onclienthello'; returns false to suspend the handshake until
+  // clientHelloDone(). The emit itself must not run on the library's stack.
+  bool OnEarlyClientHello(const unsigned char* session_id,
+                          size_t session_id_len,
+                          bool has_ticket);
+
+  // Schedules 'oncertcb'. The handshake stays suspended until certCbDone().
+  void ScheduleCertCb(std::string servername, bool ocsp);
+
   // Implement MemoryRetainer:
   void MemoryInfo(MemoryTracker* tracker) const override;
   SET_MEMORY_INFO_NAME(TLSWrap)
@@ -112,6 +146,14 @@ class TLSWrap : public AsyncWrap,
 
   std::string diagnostic_name() const override;
 
+  bool get_alpn_callback_enabled() const {
+    return flags_.alpn_callback_enabled;
+  }
+
+  const std::vector<unsigned char>& get_alpn_protos() const {
+    return alpn_protos_;
+  }
+
  private:
   // OpenSSL structures are opaque. Estimate SSL memory size for OpenSSL 1.1.1b:
   //   SSL: 6224
@@ -122,9 +164,6 @@ class TLSWrap : public AsyncWrap,
 
   static constexpr int kClearOutChunkSize = 16384;
 
-  // Maximum number of bytes for hello parser
-  static constexpr int kMaxHelloLength = 16384;
-
   // Usual ServerHello + Certificate size
   static constexpr int kInitialClientBufferLength = 4096;
 
@@ -140,6 +179,9 @@ class TLSWrap : public AsyncWrap,
   }
 
   void WaitForCertCb(CertCb cb, void* arg);
+  void EmitClientHello(const std::vector<unsigned char>& session_id,
+                       bool has_ticket);
+  void EmitCertCb(const std::string& servername, bool ocsp);
 
   TLSWrap(Environment* env,
           v8::Local<v8::Object> obj,
@@ -169,6 +211,16 @@ class TLSWrap : public AsyncWrap,
   // underlying stream even if there is no clear text to read or write.
   void Cycle();
 
+  inline bool in_ssl_library_call() const {
+    return ssl_library_call_depth_ > 0;
+  }
+
+  // Setup Cycle() after a library call, to flush anything DoWrite() held back
+  void ScheduleDeferredCycle();
+
+  // Flush a shutdown held back by DoShutdown(), if there is one.
+  void FlushPendingShutdown();
+
   // Implement StreamListener:
   // Returns buf that points into enc_in_.
   uv_buf_t OnStreamAlloc(size_t size) override;
@@ -180,6 +232,7 @@ class TLSWrap : public AsyncWrap,
   static int SelectSNIContextCallback(SSL* s, int* ad, void* arg);
 
   static void CertCbDone(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void ClientHelloDone(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void DestroySSL(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableCertCb(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableALPNCb(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -188,7 +241,6 @@ class TLSWrap : public AsyncWrap,
   static void EnableSessionCallbacks(
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableTrace(const v8::FunctionCallbackInfo<v8::Value>& args);
-  static void EndParser(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void ExportKeyingMaterial(
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetALPNNegotiatedProto(
@@ -204,6 +256,8 @@ class TLSWrap : public AsyncWrap,
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetPeerX509Certificate(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void HasPeerCertificate(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetPeerFinished(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetProtocol(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetServername(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -215,7 +269,7 @@ class TLSWrap : public AsyncWrap,
   static void IsSessionReused(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void LoadSession(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void NewSessionDone(const v8::FunctionCallbackInfo<v8::Value>& args);
-  static void OnClientHelloParseEnd(void* arg);
+  static void ResumeAfterCertCb(void* arg);
   static void Receive(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Renegotiate(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void RequestOCSP(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -257,7 +311,6 @@ class TLSWrap : public AsyncWrap,
   Kind kind_;
   ncrypto::SSLSessionPointer next_sess_;
   ncrypto::SSLPointer ssl_;
-  ClientHelloParser hello_parser_;
   v8::Global<v8::ArrayBufferView> ocsp_response_;
   BaseObjectPtr<SecureContext> sni_context_;
   BaseObjectPtr<SecureContext> sc_;
@@ -270,38 +323,49 @@ class TLSWrap : public AsyncWrap,
   size_t write_size_ = 0;
   BaseObjectPtr<AsyncWrap> current_write_;
   BaseObjectPtr<AsyncWrap> current_empty_write_;
+  // Set when DoShutdown() was called while the SSL library was on the stack,
+  // and so has yet to send close_notify.
+  BaseObjectPtr<AsyncWrap> pending_shutdown_;
   std::string error_;
 
-  bool session_callbacks_ = false;
-  bool awaiting_new_session_ = false;
-  bool in_dowrite_ = false;
-  bool started_ = false;
-  bool shutdown_ = false;
-  bool cert_cb_running_ = false;
-  bool eof_ = false;
-
   // TODO(@jasnell): These state flags should be revisited.
   // The established_ flag indicates that the handshake is
   // completed. The write_callback_scheduled_ flag is less
   // clear -- once it is set to true, it is never set to
   // false and it is only set to true after established_
   // is set to true, so it's likely redundant.
-  bool established_ = false;
-  bool write_callback_scheduled_ = false;
+  struct Flags {
+    bool session_callbacks : 1;
+    bool awaiting_new_session : 1;
+    // 'onclienthello' has been emitted for this connection.
+    bool hello_emitted : 1;
+    // JS has answered it by calling clientHelloDone().
+    bool hello_answered : 1;
+    bool in_dowrite : 1;
+    bool started : 1;
+    bool shutdown : 1;
+    bool cert_cb_running : 1;
+    bool eof : 1;
+    bool deferred_cycle_scheduled : 1;
+    bool established : 1;
+    bool write_callback_scheduled : 1;
+    bool has_active_write_issued_by_prev_listener : 1;
+    bool alpn_callback_enabled : 1;
+  };
+  Flags flags_{};
 
   int cycle_depth_ = 0;
 
+  // Nesting depth of calls into the SSL library. See SSLLibraryCallScope.
+  int ssl_library_call_depth_ = 0;
+
   // SSL_set_cert_cb
   CertCb cert_cb_ = nullptr;
   void* cert_cb_arg_ = nullptr;
 
   ncrypto::BIOPointer bio_trace_;
 
-  bool has_active_write_issued_by_prev_listener_ = false;
-
- public:
   std::vector<unsigned char> alpn_protos_;  // Accessed by SelectALPNCallback.
-  bool alpn_callback_enabled_ = false;      // Accessed by SelectALPNCallback.
 };
 
 }  // namespace crypto
diff --git a/src/crypto/crypto_turboshake.cc b/src/crypto/crypto_turboshake.cc
index 899ed7c717dd..4078d213ddec 100644
--- a/src/crypto/crypto_turboshake.cc
+++ b/src/crypto/crypto_turboshake.cc
@@ -428,6 +428,11 @@ Maybe<void> TurboShakeTraits::AdditionalConfig(
     TurboShakeConfig* params) {
   Environment* env = Environment::GetCurrent(args);
 
+  if (IsFipsEnabled()) {
+    THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(env);
+    return Nothing<void>();
+  }
+
   // args[offset + 0] = algorithm name (string)
   CHECK(args[offset]->IsString());
   Utf8Value algorithm_name(env->isolate(), args[offset]);
@@ -533,6 +538,11 @@ Maybe<void> KangarooTwelveTraits::AdditionalConfig(
     KangarooTwelveConfig* params) {
   Environment* env = Environment::GetCurrent(args);
 
+  if (IsFipsEnabled()) {
+    THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(env);
+    return Nothing<void>();
+  }
+
   // args[offset + 0] = algorithm name (string)
   CHECK(args[offset]->IsString());
   Utf8Value algorithm_name(env->isolate(), args[offset]);
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index 3f5f70bf3200..19a087770f7e 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -6,18 +6,32 @@
 #include "memory_tracker-inl.h"
 #include "ncrypto.h"
 #include "node_buffer.h"
+#include "node_diagnostics_channel.h"
 #include "node_options-inl.h"
+#include "node_realm-inl.h"
 #include "string_bytes.h"
 #include "threadpoolwork-inl.h"
 #include "util-inl.h"
 #include "v8.h"
 
+#include <atomic>
+#include <deque>
+#include <mutex>
 #include "math.h"
 
 #if OPENSSL_VERSION_MAJOR >= 3
 #include "openssl/provider.h"
 #endif
 
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+#include <openssl/indicator.h>
+#endif
+
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+#include <openssl/core_names.h>
+#include <openssl/params.h>
+#endif
+
 namespace node {
 
 using ncrypto::BignumPointer;
@@ -36,6 +50,7 @@ using v8::BackingStoreInitializationMode;
 using v8::BackingStoreOnFailureMode;
 using v8::BigInt;
 using v8::Context;
+using v8::DictionaryTemplate;
 using v8::EscapableHandleScope;
 using v8::Exception;
 using v8::Function;
@@ -76,6 +91,108 @@ size_t MemoryRetainerTraits<crypto::ByteSource>::SelfSize(
 
 namespace crypto {
 
+CShakeOptions::CShakeOptions(CShakeOptions&& other) noexcept
+    : function_name(std::move(other.function_name)),
+      customization(std::move(other.customization)),
+      flags(other.flags) {}
+
+CShakeOptions& CShakeOptions::operator=(CShakeOptions&& other) noexcept {
+  if (&other == this) return *this;
+  this->~CShakeOptions();
+  return *new (this) CShakeOptions(std::move(other));
+}
+
+void CShakeOptions::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackFieldWithSize("function_name", function_name.size());
+  tracker->TrackFieldWithSize("customization", customization.size());
+}
+
+bool CShakeOptions::Initialize(ncrypto::EVPMDCtxPointer* ctx,
+                               const EVP_MD* digest) const {
+  if (!ctx || !*ctx || digest == nullptr) return false;
+  if (empty()) return ctx->digestInit(digest);
+
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(4, 0)
+  const bool is_cshake =
+      EVP_MD_is_a(digest, "CSHAKE-128") || EVP_MD_is_a(digest, "CSHAKE-256");
+  if (!is_cshake) return false;
+
+  OSSL_PARAM params[3];
+  size_t count = 0;
+  if (has(kFunctionName)) {
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_DIGEST_PARAM_FUNCTION_NAME,
+        const_cast<char*>(function_name.c_str()),
+        function_name.size());
+  }
+  if (has(kCustomization)) {
+    params[count++] = OSSL_PARAM_construct_utf8_string(
+        OSSL_DIGEST_PARAM_CUSTOMIZATION,
+        const_cast<char*>(customization.c_str()),
+        customization.size());
+  }
+  params[count] = OSSL_PARAM_construct_end();
+  return ctx->digestInit(digest, params);
+#else
+  return false;
+#endif
+}
+
+namespace {
+bool ContainsNullByte(std::string_view value) {
+  return value.find('\0') != std::string_view::npos;
+}
+
+v8::Maybe<void> GetDigestStringOption(
+    Environment* env,
+    const v8::FunctionCallbackInfo<v8::Value>& args,
+    unsigned int offset,
+    CShakeOptions::Flag flag,
+    std::string* target,
+    CShakeOptions* options) {
+  if (args[offset]->IsUndefined()) return v8::JustVoid();
+  CHECK(IsAnyBufferSource(args[offset]));
+  ArrayBufferOrViewContents<char> value(args[offset]);
+  if (!value.CheckSizeInt32()) {
+    THROW_ERR_OUT_OF_RANGE(env, "digest option is too big");
+    return v8::Nothing<void>();
+  }
+  target->assign(value.data(), value.size());
+  if (ContainsNullByte(*target)) {
+    THROW_ERR_INVALID_ARG_VALUE(env,
+                                "Digest options must not contain null bytes");
+    return v8::Nothing<void>();
+  }
+  options->flags |= flag;
+  return v8::JustVoid();
+}
+}  // namespace
+
+v8::Maybe<void> GetCShakeOptions(
+    const v8::FunctionCallbackInfo<v8::Value>& args,
+    unsigned int offset,
+    CShakeOptions* options) {
+  Environment* env = Environment::GetCurrent(args);
+  if (GetDigestStringOption(env,
+                            args,
+                            offset,
+                            CShakeOptions::kFunctionName,
+                            &options->function_name,
+                            options)
+          .IsNothing() ||
+      GetDigestStringOption(env,
+                            args,
+                            offset + 1,
+                            CShakeOptions::kCustomization,
+                            &options->customization,
+                            options)
+          .IsNothing()) {
+    return v8::Nothing<void>();
+  }
+
+  return v8::JustVoid();
+}
+
 int PasswordCallback(char* buf, int size, int rwflag, void* u) {
   const ByteSource* passphrase = *static_cast<const ByteSource**>(u);
   if (passphrase != nullptr) {
@@ -99,6 +216,238 @@ int NoPasswordCallback(char* buf, int size, int rwflag, void* u) {
   return 0;
 }
 
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+namespace {
+
+constexpr size_t kMaxPendingFipsIndicatorEvents = 256;
+constexpr std::string_view kFipsIndicatorChannel = "crypto.fips.indicator";
+
+struct FipsIndicatorEvent {
+  std::string operation;
+  std::string reason;
+  bool blocked;
+  uint32_t count = 1;
+  uint32_t dropped = 0;
+};
+
+Local<DictionaryTemplate> GetFipsIndicatorEventTemplate(Environment* env) {
+  auto tmpl = env->fips_indicator_event_template();
+  if (tmpl.IsEmpty()) {
+    static constexpr std::string_view names[] = {
+        "operation",
+        "reason",
+        "blocked",
+        "count",
+        "dropped",
+    };
+    tmpl = DictionaryTemplate::New(env->isolate(), names);
+    env->set_fips_indicator_event_template(tmpl);
+  }
+  return tmpl;
+}
+
+class FipsIndicatorState final {
+ public:
+  static FipsIndicatorState& Get() {
+    static FipsIndicatorState state;
+    return state;
+  }
+
+  void Install() {
+    reject_unapproved_.store(
+        per_process::cli_options->force_fips_crypto &&
+            per_process::cli_options->force_fips_crypto_policy == "strict",
+        std::memory_order_release);
+    std::call_once(install_once_, [this]() {
+      OSSL_INDICATOR_get_callback(nullptr, &previous_callback_);
+      OSSL_INDICATOR_set_callback(nullptr, OnOpenSSLIndicator);
+    });
+  }
+
+  void Setup(Environment* env) {
+    CHECK(env->owns_process_state());
+    auto channel =
+        diagnostics_channel::Channel::Get(env, kFipsIndicatorChannel);
+    if (!channel) return;
+
+    Realm* realm = env->principal_realm();
+    auto* binding = realm->GetBindingData<diagnostics_channel::BindingData>();
+    CHECK_NOT_NULL(binding);
+    const uint32_t index =
+        binding->GetOrCreateChannelIndex(std::string(kFipsIndicatorChannel));
+
+    {
+      Mutex::ScopedLock lock(mutex_);
+      CHECK_NULL(env_);
+      env_ = env;
+      channel_ = channel;
+    }
+    env->AddCleanupHook(Cleanup, this);
+    binding->SetChannelStatusCallback(
+        index, [this](bool active) { SetActive(active); });
+    SetActive(channel->HasSubscribers());
+  }
+
+ private:
+  void SetActive(bool active) {
+    subscription_generation_++;
+    active_.store(active, std::memory_order_release);
+    if (active) return;
+
+    {
+      Mutex::ScopedLock lock(mutex_);
+      events_.clear();
+      dropped_events_ = 0;
+    }
+  }
+
+  static int OnOpenSSLIndicator(const char* operation,
+                                const char* reason,
+                                const OSSL_PARAM* params) {
+    return Get().OnIndicator(operation, reason, params);
+  }
+
+  static void Cleanup(void* data) {
+    static_cast<FipsIndicatorState*>(data)->CleanupEnvironment();
+  }
+
+  int OnIndicator(const char* operation,
+                  const char* reason,
+                  const OSSL_PARAM* params) {
+    const int previous_result =
+        previous_callback_ == nullptr
+            ? 1
+            : previous_callback_(operation, reason, params);
+    const int result = reject_unapproved_.load(std::memory_order_acquire)
+                           ? 0
+                           : previous_result;
+    if (!active_.load(std::memory_order_acquire)) return result;
+
+    const bool blocked = result == 0;
+    {
+      Mutex::ScopedLock lock(mutex_);
+      if (env_ != nullptr && active_.load(std::memory_order_relaxed)) {
+        const std::string operation_string =
+            operation == nullptr ? "" : operation;
+        const std::string reason_string = reason == nullptr ? "" : reason;
+        const auto existing = std::find_if(
+            events_.begin(),
+            events_.end(),
+            [&](const FipsIndicatorEvent& event) {
+              return event.operation == operation_string &&
+                     event.reason == reason_string && event.blocked == blocked;
+            });
+        if (existing == events_.end()) {
+          if (events_.size() < kMaxPendingFipsIndicatorEvents) {
+            events_.push_back({operation_string, reason_string, blocked});
+          } else if (dropped_events_ != UINT32_MAX) {
+            dropped_events_++;
+          }
+        } else if (existing->count != UINT32_MAX) {
+          existing->count++;
+        } else if (dropped_events_ != UINT32_MAX) {
+          dropped_events_++;
+        }
+        if (!dispatch_scheduled_) {
+          dispatch_scheduled_ = true;
+          env_->SetImmediateThreadsafe(
+              [](Environment* env) { Get().Drain(env); },
+              CallbackFlags::kUnrefed);
+        }
+      }
+    }
+    return result;
+  }
+
+  void Drain(Environment* env) {
+    CHECK(env->owns_process_state());
+    std::deque<FipsIndicatorEvent> events;
+    {
+      Mutex::ScopedLock lock(mutex_);
+      if (env_ != env) return;
+      events.swap(events_);
+      if (!events.empty()) events.front().dropped = dropped_events_;
+      dropped_events_ = 0;
+      dispatch_scheduled_ = false;
+    }
+    if (events.empty() || !channel_ || !channel_->HasSubscribers()) return;
+
+    Isolate* isolate = env->isolate();
+    HandleScope handle_scope(isolate);
+    Local<Context> context = env->context();
+    const uint64_t subscription_generation = subscription_generation_;
+    for (const auto& event : events) {
+      if (subscription_generation_ != subscription_generation) return;
+      MaybeLocal<Value> values[] = {
+          OneByteString(isolate, event.operation),
+          OneByteString(isolate, event.reason),
+          v8::Boolean::New(isolate, event.blocked),
+          Uint32::New(isolate, event.count),
+          Uint32::New(isolate, event.dropped),
+      };
+      Local<Object> value;
+      if (!NewDictionaryInstance(
+               context, GetFipsIndicatorEventTemplate(env), values)
+               .ToLocal(&value)) {
+        return;
+      }
+      channel_->Publish(env, value);
+      if (subscription_generation_ != subscription_generation) return;
+    }
+  }
+
+  void CleanupEnvironment() {
+    subscription_generation_++;
+    active_.store(false, std::memory_order_release);
+    {
+      Mutex::ScopedLock lock(mutex_);
+      env_ = nullptr;
+      channel_.reset();
+      events_.clear();
+      dropped_events_ = 0;
+      dispatch_scheduled_ = false;
+    }
+  }
+
+  std::once_flag install_once_;
+  std::atomic<bool> active_{false};
+  std::atomic<bool> reject_unapproved_{false};
+  OSSL_INDICATOR_CALLBACK* previous_callback_ = nullptr;
+  Mutex mutex_;
+  Environment* env_ = nullptr;
+  BaseObjectPtr<diagnostics_channel::Channel> channel_;
+  std::deque<FipsIndicatorEvent> events_;
+  uint32_t dropped_events_ = 0;
+  bool dispatch_scheduled_ = false;
+  uint64_t subscription_generation_ = 0;
+};
+
+}  // namespace
+#endif
+
+void InstallFipsIndicatorCallback() {
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+  const auto& options = per_process::cli_options;
+  const bool strict = options->force_fips_crypto &&
+                      options->force_fips_crypto_policy == "strict";
+  if (options->enable_fips_indicator_events || strict) {
+    FipsIndicatorState::Get().Install();
+  }
+#endif
+}
+
+void SetupFipsIndicatorChannel(const FunctionCallbackInfo<Value>& args) {
+#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 4)
+  Environment* env = Environment::GetCurrent(args);
+  if (env->owns_process_state() &&
+      per_process::cli_options->enable_fips_indicator_events) {
+    FipsIndicatorState::Get().Setup(env);
+  }
+#else
+  USE(args);
+#endif
+}
+
 std::optional<std::string> ProcessFipsOptions() {
   const bool enable_fips = per_process::cli_options->enable_fips_crypto;
   const bool force_fips = per_process::cli_options->force_fips_crypto;
@@ -146,11 +495,17 @@ bool InitCryptoOnce(Isolate* isolate) {
 // be part of a larger mutex for global OpenSSL state.
 static Mutex fips_mutex;
 
+bool IsFipsEnabled() {
+  Mutex::ScopedLock fips_lock(fips_mutex);
+  return ncrypto::isFipsEnabled();
+}
+
 void InitCryptoOnce() {
   Mutex::ScopedLock lock(per_process::cli_options_mutex);
   Mutex::ScopedLock fips_lock(fips_mutex);
 #ifndef OPENSSL_IS_BORINGSSL
   OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
+  CHECK_NOT_NULL(settings);
 
 #if OPENSSL_VERSION_MAJOR < 3
   // --openssl-config=...
@@ -171,6 +526,9 @@ void InitCryptoOnce() {
 #endif
 
   OPENSSL_init_ssl(0, settings);
+  InstallFipsIndicatorCallback();
+
+  ncrypto::ConfigurePqcEncoding();
   OPENSSL_INIT_free(settings);
   settings = nullptr;
 
@@ -206,8 +564,12 @@ void InitCryptoOnce() {
 
 void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
   Mutex::ScopedLock lock(per_process::cli_options_mutex);
-  Mutex::ScopedLock fips_lock(fips_mutex);
-  args.GetReturnValue().Set(ncrypto::isFipsEnabled() ? 1 : 0);
+  args.GetReturnValue().Set(IsFipsEnabled() ? 1 : 0);
+}
+
+void GetFipsCryptoGeneration(const FunctionCallbackInfo<Value>& args) {
+  args.GetReturnValue().Set(BigInt::NewFromUnsigned(
+      args.GetIsolate(), ncrypto::getFipsStateGeneration()));
 }
 
 void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
@@ -848,6 +1210,10 @@ void Initialize(Environment* env, Local<Object> target) {
 #endif  // !OPENSSL_NO_ENGINE
 
   SetMethodNoSideEffect(context, target, "getFipsCrypto", GetFipsCrypto);
+  SetMethodNoSideEffect(
+      context, target, "getFipsCryptoGeneration", GetFipsCryptoGeneration);
+  SetMethod(
+      context, target, "setupFipsIndicatorChannel", SetupFipsIndicatorChannel);
   SetMethod(context, target, "setFipsCrypto", SetFipsCrypto);
   SetMethodNoSideEffect(context, target, "testFipsCrypto", TestFipsCrypto);
 
@@ -867,6 +1233,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 #endif  // !OPENSSL_NO_ENGINE
 
   registry->Register(GetFipsCrypto);
+  registry->Register(GetFipsCryptoGeneration);
+  registry->Register(SetupFipsIndicatorChannel);
   registry->Register(SetFipsCrypto);
   registry->Register(TestFipsCrypto);
   registry->Register(SecureBuffer);
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index 27d698107113..8b2408e37141 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -50,6 +50,7 @@ namespace node::crypto {
 constexpr size_t kSizeOf_DH = 144;
 constexpr size_t kSizeOf_EC_KEY = 80;
 constexpr size_t kSizeOf_EVP_CIPHER_CTX = 168;
+constexpr size_t kSizeOf_EVP_MAC_CTX = 16;
 constexpr size_t kSizeOf_EVP_MD_CTX = 48;
 constexpr size_t kSizeOf_EVP_PKEY = 72;
 constexpr size_t kSizeOf_EVP_PKEY_CTX = 80;
@@ -66,6 +67,8 @@ constexpr T NumBitsToBytes(T bits) {
 // what went wrong, or std::nullopt when there was nothing to do or the
 // options were applied successfully.
 std::optional<std::string> ProcessFipsOptions();
+void InstallFipsIndicatorCallback();
+bool IsFipsEnabled();
 
 bool InitCryptoOnce(v8::Isolate* isolate);
 void InitCryptoOnce();
@@ -210,6 +213,15 @@ class ByteSource final {
     return ncrypto::BignumPointer(data<unsigned char>(), size());
   }
 
+  inline ByteSource ToCopy() const {
+    if (empty()) return {};
+    CHECK_NOT_NULL(data_);
+    auto data = MallocOpenSSL<char>(size());
+    CHECK_NOT_NULL(data);
+    memcpy(data, data_, size());
+    return ByteSource::Allocated(data, size());
+  }
+
   // Creates a v8::BackingStore that takes over responsibility for
   // any allocated data. The ByteSource will be reset with size = 0
   // after being called.
@@ -271,6 +283,35 @@ enum CryptoJobMode { kCryptoJobAsync, kCryptoJobSync, kCryptoJobWebCrypto };
 CryptoJobMode GetCryptoJobMode(v8::Local<v8::Value> args);
 bool IsCryptoJobAsync(CryptoJobMode mode);
 
+struct CShakeOptions final : public MemoryRetainer {
+  enum Flag : uint8_t {
+    kFunctionName = 1 << 0,
+    kCustomization = 1 << 1,
+  };
+
+  std::string function_name;
+  std::string customization;
+  uint8_t flags = 0;
+
+  CShakeOptions() = default;
+  CShakeOptions(CShakeOptions&& other) noexcept;
+  CShakeOptions& operator=(CShakeOptions&& other) noexcept;
+
+  bool empty() const { return flags == 0; }
+  bool has(Flag flag) const { return (flags & flag) != 0; }
+
+  bool Initialize(ncrypto::EVPMDCtxPointer* ctx, const EVP_MD* digest) const;
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(CShakeOptions)
+  SET_SELF_SIZE(CShakeOptions)
+};
+
+v8::Maybe<void> GetCShakeOptions(
+    const v8::FunctionCallbackInfo<v8::Value>& args,
+    unsigned int offset,
+    CShakeOptions* options);
+
 v8::MaybeLocal<v8::Value> CreateWebCryptoJobError(Environment* env,
                                                   v8::Local<v8::Value> cause);
 
diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
index be4067df0e22..0050e5591e2a 100644
--- a/src/crypto/crypto_x509.cc
+++ b/src/crypto/crypto_x509.cc
@@ -807,7 +807,7 @@ Local<FunctionTemplate> X509Certificate::GetConstructorTemplate(
   Local<FunctionTemplate> tmpl = env->x509_constructor_template();
   if (tmpl.IsEmpty()) {
     Isolate* isolate = env->isolate();
-    tmpl = NewFunctionTemplate(isolate, nullptr);
+    tmpl = NewFunctionTemplate(isolate, NewFromHandle);
     tmpl->InstanceTemplate()->SetInternalFieldCount(
         X509Certificate::kInternalFieldCount);
     tmpl->SetClassName(
@@ -850,43 +850,118 @@ Local<FunctionTemplate> X509Certificate::GetConstructorTemplate(
   return tmpl;
 }
 
-bool X509Certificate::HasInstance(Environment* env, Local<Object> object) {
-  return GetConstructorTemplate(env)->HasInstance(object);
+bool X509Certificate::HasInstance(Environment* env, Local<Value> value) {
+  return GetConstructorTemplate(env)->HasInstance(value);
+}
+
+void X509Certificate::NewFromHandle(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  if (args.Length() == 1 && args[0]->IsArrayBufferView()) {
+    ArrayBufferViewContents<unsigned char> buf(args[0].As<ArrayBufferView>());
+    auto result = X509Pointer::Parse(ncrypto::Buffer<const unsigned char>{
+        .data = buf.data(),
+        .len = buf.length(),
+    });
+    if (!result.value) [[unlikely]] {
+      return ThrowCryptoError(env, result.error.value_or(0));
+    }
+    new X509Certificate(env,
+                        args.This(),
+                        std::make_shared<ManagedX509>(std::move(result.value)));
+    return;
+  }
+
+  if (args.Length() != 1 || !HasInstance(env, args[0])) {
+    THROW_ERR_INVALID_ARG_TYPE(
+        env, "value must be an X509CertificateHandle or BufferSource");
+    return;
+  }
+
+  X509Certificate* handle = Unwrap<X509Certificate>(args[0].As<Object>());
+  CHECK_NOT_NULL(handle);
+  Local<Object> issuer;
+  if (handle->issuer_cert_) issuer = handle->issuer_cert_->object();
+  new X509Certificate(env, args.This(), handle->cert_, issuer);
+}
+
+void X509Certificate::CreateX509CertificateClass(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  CHECK(args[0]->IsFunction());
+
+  Local<Value> ctor;
+  if (!GetConstructorTemplate(env)->GetFunction(env->context()).ToLocal(&ctor))
+    return;
+
+  Local<Value> ret;
+  if (!args[0]
+           .As<Function>()
+           ->Call(env->context(), Undefined(env->isolate()), 1, &ctor)
+           .ToLocal(&ret)) {
+    return;
+  }
+
+  Local<Array> constructors = ret.As<Array>();
+  Local<Value> internal_ctor;
+  if (!constructors->Get(env->context(), 1).ToLocal(&internal_ctor)) return;
+  CHECK(env->crypto_internal_x509_certificate_constructor().IsEmpty());
+  env->set_crypto_internal_x509_certificate_constructor(
+      internal_ctor.As<Function>());
+  args.GetReturnValue().Set(constructors);
+}
+
+void X509Certificate::IsX509Certificate(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  args.GetReturnValue().Set(HasInstance(env, args[0]));
 }
 
 MaybeLocal<Object> X509Certificate::New(Environment* env,
                                         X509Pointer cert,
-                                        STACK_OF(X509) * issuer_chain) {
+                                        const STACK_OF(X509) * issuer_chain) {
   std::shared_ptr<ManagedX509> mcert(new ManagedX509(std::move(cert)));
   return New(env, std::move(mcert), issuer_chain);
 }
 
 MaybeLocal<Object> X509Certificate::New(Environment* env,
                                         std::shared_ptr<ManagedX509> cert,
-                                        STACK_OF(X509) * issuer_chain) {
-  EscapableHandleScope scope(env->isolate());
-  Local<Function> ctor;
-  if (!GetConstructorTemplate(env)->GetFunction(env->context()).ToLocal(&ctor))
-    return MaybeLocal<Object>();
+                                        const STACK_OF(X509) * issuer_chain) {
+  return NewWithIssuers(env, std::move(cert), issuer_chain, 0);
+}
 
+MaybeLocal<Object> X509Certificate::NewWithIssuers(
+    Environment* env,
+    std::shared_ptr<ManagedX509> cert,
+    const STACK_OF(X509) * issuer_chain,
+    int start) {
+  EscapableHandleScope scope(env->isolate());
   Local<Object> obj;
-  if (!ctor->NewInstance(env->context()).ToLocal(&obj))
+  if (!GetConstructorTemplate(env)
+           ->InstanceTemplate()
+           ->NewInstance(env->context())
+           .ToLocal(&obj)) {
     return MaybeLocal<Object>();
+  }
 
-  Local<Object> issuer_chain_obj;
-  if (issuer_chain != nullptr && sk_X509_num(issuer_chain)) {
-    X509Pointer cert(X509_dup(sk_X509_value(issuer_chain, 0)));
-    sk_X509_delete(issuer_chain, 0);
-    auto maybeObj =
-        sk_X509_num(issuer_chain)
-            ? X509Certificate::New(env, std::move(cert), issuer_chain)
-            : X509Certificate::New(env, std::move(cert));
-    if (!maybeObj.ToLocal(&issuer_chain_obj)) [[unlikely]] {
+  Local<Object> issuer;
+  if (issuer_chain != nullptr && start < sk_X509_num(issuer_chain)) {
+    X509Pointer issuer_cert =
+        X509View(sk_X509_value(issuer_chain, start)).clone();
+    if (!issuer_cert) [[unlikely]] {
+      return MaybeLocal<Object>();
+    }
+    if (!NewWithIssuers(env,
+                        std::make_shared<ManagedX509>(std::move(issuer_cert)),
+                        issuer_chain,
+                        start + 1)
+             .ToLocal(&issuer)) [[unlikely]] {
       return MaybeLocal<Object>();
     }
   }
 
-  new X509Certificate(env, obj, std::move(cert), issuer_chain_obj);
+  new X509Certificate(env, obj, std::move(cert), issuer);
   return scope.Escape(obj);
 }
 
@@ -903,23 +978,29 @@ MaybeLocal<Object> X509Certificate::GetPeerCert(Environment* env,
                                                 GetPeerCertificateFlag flag) {
   ClearErrorOnReturn clear_error_on_return;
 
+  // The peer chain is owned by the SSL session and must not be modified. Its
+  // first entry is the peer certificate on the client but not on the server.
+  const STACK_OF(X509)* ssl_certs = SSL_get_peer_cert_chain(ssl.get());
+  int issuers_start = 0;
+
   X509Pointer cert;
   if ((flag & GetPeerCertificateFlag::SERVER) ==
       GetPeerCertificateFlag::SERVER) {
     cert = X509Pointer::PeerFrom(ssl);
   }
-
-  STACK_OF(X509)* ssl_certs = SSL_get_peer_cert_chain(ssl.get());
-  if (!cert && (ssl_certs == nullptr || sk_X509_num(ssl_certs) == 0))
-    return MaybeLocal<Object>();
-
-  if (!cert) [[unlikely]] {
-    cert.reset(sk_X509_value(ssl_certs, 0));
-    sk_X509_delete(ssl_certs, 0);
+  if (!cert) {
+    if (ssl_certs == nullptr || sk_X509_num(ssl_certs) == 0)
+      return MaybeLocal<Object>();
+    cert = X509View(sk_X509_value(ssl_certs, 0)).clone();
+    if (!cert) [[unlikely]]
+      return MaybeLocal<Object>();
+    issuers_start = 1;
   }
 
-  return sk_X509_num(ssl_certs) ? New(env, std::move(cert), ssl_certs)
-                                : New(env, std::move(cert));
+  return NewWithIssuers(env,
+                        std::make_shared<ManagedX509>(std::move(cert)),
+                        ssl_certs,
+                        issuers_start);
 }
 
 v8::MaybeLocal<v8::Value> X509Certificate::toObject(Environment* env) {
@@ -963,11 +1044,31 @@ X509Certificate::X509CertificateTransferData::Deserialize(
   if (!X509Certificate::New(env, data_).ToLocal(&handle))
     return {};
 
-  return BaseObjectPtr<BaseObject>(
-      Unwrap<X509Certificate>(handle.As<Object>()));
+  Local<Value> module =
+      FIXED_ONE_BYTE_STRING(env->isolate(), "internal/crypto/x509");
+  if (env->builtin_module_require()
+          ->Call(context, Null(env->isolate()), 1, &module)
+          .IsEmpty()) {
+    return {};
+  }
+
+  Local<Function> ctor = env->crypto_internal_x509_certificate_constructor();
+  CHECK(!ctor.IsEmpty());
+  Local<Value> cert;
+  if (!ctor->NewInstance(context, 1, &handle).ToLocal(&cert)) return {};
+
+  return BaseObjectPtr<BaseObject>(Unwrap<X509Certificate>(cert.As<Object>()));
 }
 
 BaseObject::TransferMode X509Certificate::GetTransferMode() const {
+  Local<Value> transfer_mode =
+      object()
+          ->GetPrivate(env()->context(), env()->transfer_mode_private_symbol())
+          .ToLocalChecked();
+  if (transfer_mode->IsUint32() &&
+      (transfer_mode.As<Uint32>()->Value() & TransferMode::kCloneable) == 0) {
+    return BaseObject::TransferMode::kDisallowCloneAndTransfer;
+  }
   return BaseObject::TransferMode::kCloneable;
 }
 
@@ -977,6 +1078,12 @@ std::unique_ptr<worker::TransferData> X509Certificate::CloneForMessaging()
 }
 
 void X509Certificate::Initialize(Environment* env, Local<Object> target) {
+  SetMethod(env->context(),
+            target,
+            "createX509CertificateClass",
+            CreateX509CertificateClass);
+  SetMethodNoSideEffect(
+      env->context(), target, "isX509Certificate", IsX509Certificate);
   SetMethod(env->context(), target, "parseX509", Parse);
 
   NODE_DEFINE_CONSTANT(target, X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT);
@@ -989,6 +1096,9 @@ void X509Certificate::Initialize(Environment* env, Local<Object> target) {
 
 void X509Certificate::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
+  registry->Register(CreateX509CertificateClass);
+  registry->Register(IsX509Certificate);
+  registry->Register(NewFromHandle);
   registry->Register(Parse);
   registry->Register(Subject);
   registry->Register(SubjectAltName);
diff --git a/src/crypto/crypto_x509.h b/src/crypto/crypto_x509.h
index c94e832a2845..a6f64d4f2d4f 100644
--- a/src/crypto/crypto_x509.h
+++ b/src/crypto/crypto_x509.h
@@ -49,17 +49,23 @@ class X509Certificate final : public BaseObject {
   static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
   static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
       Environment* env);
-  static bool HasInstance(Environment* env, v8::Local<v8::Object> object);
+  static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
+
+  static void CreateX509CertificateClass(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsX509Certificate(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void NewFromHandle(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static v8::MaybeLocal<v8::Object> New(
       Environment* env,
       ncrypto::X509Pointer cert,
-      STACK_OF(X509) * issuer_chain = nullptr);
+      const STACK_OF(X509) * issuer_chain = nullptr);
 
   static v8::MaybeLocal<v8::Object> New(
       Environment* env,
       std::shared_ptr<ManagedX509> cert,
-      STACK_OF(X509)* issuer_chain = nullptr);
+      const STACK_OF(X509) * issuer_chain = nullptr);
 
   static v8::MaybeLocal<v8::Object> GetCert(Environment* env,
                                             const ncrypto::SSLPointer& ssl);
@@ -115,6 +121,13 @@ class X509Certificate final : public BaseObject {
                   std::shared_ptr<ManagedX509> cert,
                   v8::Local<v8::Object> issuer_chain = v8::Local<v8::Object>());
 
+  // Like New(), but reads the issuer chain from issuer_chain[start] upward.
+  static v8::MaybeLocal<v8::Object> NewWithIssuers(
+      Environment* env,
+      std::shared_ptr<ManagedX509> cert,
+      const STACK_OF(X509) * issuer_chain,
+      int start);
+
   std::shared_ptr<ManagedX509> cert_;
   BaseObjectPtr<X509Certificate> issuer_cert_;
 };
diff --git a/src/dataqueue/queue.cc b/src/dataqueue/queue.cc
index 8516362b7a87..bddf840942e2 100644
--- a/src/dataqueue/queue.cc
+++ b/src/dataqueue/queue.cc
@@ -847,13 +847,19 @@ class FdEntry final : public EntryImpl {
   // the race
   //   condition described in the comment above.
  public:
-  static std::unique_ptr<FdEntry> Create(Environment* env, Local<Value> path) {
+  static std::unique_ptr<FdEntry> Create(Environment* env,
+                                         Local<Value> path,
+                                         int* status) {
     // We're only going to create the FdEntry if the file exists.
     uv_fs_t req = uv_fs_t();
     auto cleanup = OnScopeLeave([&] { uv_fs_req_cleanup(&req); });
 
     auto buf = std::make_shared<BufferValue>(env->isolate(), path);
-    if (uv_fs_stat(nullptr, &req, buf->out(), nullptr) < 0) return nullptr;
+    int err = uv_fs_stat(nullptr, &req, buf->out(), nullptr);
+    if (err < 0) {
+      if (status != nullptr) *status = err;
+      return nullptr;
+    }
 
     return std::make_unique<FdEntry>(
         env, std::move(buf), req.statbuf, 0, req.statbuf.st_size);
@@ -1162,8 +1168,9 @@ std::unique_ptr<DataQueue::Entry> DataQueue::CreateDataQueueEntry(
 }
 
 std::unique_ptr<DataQueue::Entry> DataQueue::CreateFdEntry(Environment* env,
-                                                           Local<Value> path) {
-  return FdEntry::Create(env, path);
+                                                           Local<Value> path,
+                                                           int* status) {
+  return FdEntry::Create(env, path, status);
 }
 
 void DataQueue::Initialize(Environment* env, v8::Local<v8::Object> target) {
diff --git a/src/dataqueue/queue.h b/src/dataqueue/queue.h
index 190c54111b3e..64c7404e8b41 100644
--- a/src/dataqueue/queue.h
+++ b/src/dataqueue/queue.h
@@ -226,8 +226,11 @@ class DataQueue : public MemoryRetainer {
   static std::unique_ptr<Entry> CreateDataQueueEntry(
       std::shared_ptr<DataQueue> data_queue);
 
+  // Returns nullptr if the file cannot be stat'd. When `status` is given, it
+  // is set to the libuv error code so callers can report why.
   static std::unique_ptr<Entry> CreateFdEntry(Environment* env,
-                                              v8::Local<v8::Value> path);
+                                              v8::Local<v8::Value> path,
+                                              int* status = nullptr);
 
   // Creates a Reader for the given queue. If the queue is idempotent,
   // any number of readers can be created, all of which are guaranteed
diff --git a/src/env.cc b/src/env.cc
index 84957de5cb01..3495479752fb 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -16,6 +16,9 @@
 #include "node_snapshotable.h"
 #include "node_v8_platform-inl.h"
 #include "node_worker.h"
+#if HAVE_OPENSSL
+#include "ncrypto.h"
+#endif
 #include "req_wrap-inl.h"
 #include "stream_base.h"
 #include "tracing/agent.h"
@@ -586,10 +589,8 @@ IsolateData* IsolateData::CreateIsolateData(
     uv_loop_t* loop,
     MultiIsolatePlatform* platform,
     ArrayBufferAllocator* allocator,
-    const EmbedderSnapshotData* embedder_snapshot_data,
+    const SnapshotData* snapshot_data,
     std::shared_ptr<PerIsolateOptions> options) {
-  const SnapshotData* snapshot_data =
-      SnapshotData::FromEmbedderWrapper(embedder_snapshot_data);
   if (options == nullptr) {
     options = per_process::cli_options->per_isolate->Clone();
   }
@@ -800,6 +801,105 @@ void Environment::recycle_managed_buffer(std::unique_ptr<BackingStore> bs) {
     managed_buffer_cache_ = std::move(bs);
 }
 
+uv_buf_t StreamReadSlab::Allocate(Isolate* isolate, size_t suggested) {
+  DCHECK_GT(suggested, 0);
+  // Reads always get the full `suggested` size: handing out a smaller
+  // remainder would shrink the read() buffer and fragment large reads into
+  // more system calls, which costs more than the slab tail it saves.
+  size_t remaining = current_.bs ? current_.size() - current_.offset : 0;
+  if (remaining < suggested) {
+    // Retire the current slab; it stays alive through `retired_` if reads
+    // are still pending on it, or through JS views over it otherwise.
+    if (current_.bs && current_.pending > 0)
+      retired_.push_back(std::move(current_));
+    current_ = Slab();
+    std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
+        isolate,
+        std::max(kSlabSize, suggested),
+        BackingStoreInitializationMode::kUninitialized);
+    current_.bs = std::move(bs);
+  }
+  char* base = current_.data() + current_.offset;
+  current_.offset += suggested;
+  current_.last_base = base;
+  current_.last_end = current_.offset;
+  current_.pending++;
+  return uv_buf_init(base, suggested);
+}
+
+StreamReadSlab::Slab* StreamReadSlab::FindSlab(const char* base) {
+  if (current_.Contains(base)) return &current_;
+  for (Slab& slab : retired_)
+    if (slab.Contains(base)) return &slab;
+  return nullptr;
+}
+
+void StreamReadSlab::CompleteReservation(Slab* slab,
+                                         const uv_buf_t& buf,
+                                         size_t used) {
+  DCHECK_GT(slab->pending, 0);
+  slab->pending--;
+  if (buf.base == slab->last_base && slab->offset == slab->last_end) {
+    // This was the most recent reservation and nothing was reserved after
+    // it: rewind the unused remainder so it can be reserved again.
+    slab->offset = (buf.base - slab->data()) + used;
+    slab->last_end = slab->offset;
+  }
+  if (slab != &current_ && slab->pending == 0) {
+    for (auto it = retired_.begin(); it != retired_.end(); ++it) {
+      if (&*it == slab) {
+        retired_.erase(it);
+        break;
+      }
+    }
+  }
+}
+
+bool StreamReadSlab::Commit(Isolate* isolate,
+                            const uv_buf_t& buf,
+                            size_t nread,
+                            Local<ArrayBuffer>* ab,
+                            size_t* offset) {
+  Slab* slab = FindSlab(buf.base);
+  if (slab == nullptr) return false;
+  DCHECK_LE(nread, buf.len);
+
+  // A partial read would leave the rest of its reservation as waste once
+  // the slab retires - memory that counts towards V8's external memory and
+  // drives up GC frequency. If most of the reservation would be wasted,
+  // give the read a right-sized copy instead (as if it had never been read
+  // into the slab) and return its reservation in full. Reads that (mostly)
+  // fill their reservation get a zero-copy view into the slab.
+  if (nread < buf.len - buf.len / 4 && buf.base == slab->last_base &&
+      slab->offset == slab->last_end) {
+    std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
+        isolate, nread, BackingStoreInitializationMode::kUninitialized);
+    memcpy(bs->Data(), buf.base, nread);
+    *ab = ArrayBuffer::New(isolate, std::move(bs));
+    *offset = 0;
+    CompleteReservation(slab, buf, 0);
+    return true;
+  }
+
+  *offset = buf.base - slab->data();
+  if (slab->ab.IsEmpty()) {
+    *ab = ArrayBuffer::New(isolate, slab->bs);
+    slab->ab.Reset(isolate, *ab);
+  } else {
+    *ab = slab->ab.Get(isolate);
+  }
+  CompleteReservation(slab, buf, nread);
+  return true;
+}
+
+bool StreamReadSlab::Release(const uv_buf_t& buf) {
+  if (buf.base == nullptr) return true;
+  Slab* slab = FindSlab(buf.base);
+  if (slab == nullptr) return false;
+  CompleteReservation(slab, buf, 0);
+  return true;
+}
+
 std::string Environment::GetExecPath(const std::vector<std::string>& argv) {
   char exec_path_buf[2 * PATH_MAX];
   size_t exec_path_len = sizeof(exec_path_buf);
@@ -862,6 +962,14 @@ Environment::Environment(IsolateData* isolate_data,
                      ? AllocateEnvironmentThreadId().id
                      : thread_id.id),
       thread_name_(thread_name) {
+#if HAVE_OPENSSL && NCRYPTO_USE_OPENSSL3_PROVIDER
+  provider_digest_cache = std::make_unique<ncrypto::DigestCache>();
+  provider_cipher_cache = std::make_unique<ncrypto::CipherCache>();
+#if OPENSSL_WITH_EVP_MAC
+  provider_mac_cache = std::make_unique<ncrypto::MacCache>();
+#endif
+#endif
+
   if (!is_main_thread()) {
     // If this is a Worker thread, we can always safely use the parent's
     // Isolate's code cache because of the shared read-only heap.
@@ -1105,6 +1213,15 @@ Environment::~Environment() {
   // Also, since the main thread usually stops just before the process exits,
   // this is far less relevant here.
   if (!is_main_thread()) {
+#if HAVE_OPENSSL
+    // Provider methods can contain callbacks into native addons. Release the
+    // environment-owned methods before unloading any addon DSOs.
+    provider_digest_cache.reset();
+    provider_cipher_cache.reset();
+#if OPENSSL_WITH_EVP_MAC
+    provider_mac_cache.reset();
+#endif
+#endif
     // Dereference all addons that were loaded into this environment.
     for (binding::DLib& addon : loaded_addons_) {
       addon.Close();
diff --git a/src/env.h b/src/env.h
index c5501cd7914a..944365f2447f 100644
--- a/src/env.h
+++ b/src/env.h
@@ -53,10 +53,6 @@
 #include "v8-profiler.h"
 #include "v8.h"
 
-#if HAVE_OPENSSL
-#include <openssl/evp.h>
-#endif
-
 #include <array>
 #include <atomic>
 #include <cstdint>
@@ -71,6 +67,12 @@
 #include <unordered_set>
 #include <vector>
 
+namespace ncrypto {
+class CipherCache;
+class DigestCache;
+class MacCache;
+}  // namespace ncrypto
+
 namespace node {
 
 namespace shadow_realm {
@@ -140,7 +142,7 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
       uv_loop_t* event_loop,
       MultiIsolatePlatform* platform = nullptr,
       ArrayBufferAllocator* node_allocator = nullptr,
-      const EmbedderSnapshotData* embedder_snapshot_data = nullptr,
+      const SnapshotData* snapshot_data = nullptr,
       std::shared_ptr<PerIsolateOptions> options = nullptr);
   ~IsolateData();
 
@@ -276,6 +278,63 @@ struct ContextInfo {
 
 class EnabledDebugList;
 
+// A bump allocator for stream read buffers. Reads reserve a chunk of the
+// current slab and, once completed, are handed to JS as a view (ArrayBuffer +
+// offset) over the slab, so that no per-read allocation or copy is needed.
+// Unused reservation space is rewound when a read returns fewer bytes than
+// were reserved. Slabs with reads still pending when a new slab is started
+// (possible when multiple reads are in flight, e.g. on Windows) are kept
+// alive in `retired_` until those reads complete.
+class StreamReadSlab {
+ public:
+  // Sized to match the read buffer size that libuv suggests for stream
+  // reads: a slab typically serves a single large read (still avoiding the
+  // copy that right-sizing the buffer would need), or many small ones.
+  // Larger slabs amortize allocations further, but stay alive (pinned by
+  // chunk views) long enough to be promoted to V8's old generation, where
+  // their external memory is only reclaimed by major GCs.
+  static constexpr size_t kSlabSize = 64 * 1024;
+
+  // Reserve `suggested` bytes. Starts a new slab if the current one does
+  // not have enough space left.
+  uv_buf_t Allocate(v8::Isolate* isolate, size_t suggested);
+  // Commit a completed read of `nread` bytes into the buffer previously
+  // returned by Allocate(), rewinding the unused remainder of the
+  // reservation if possible. Returns the slab's ArrayBuffer and the offset
+  // of `buf.base` within it. Returns false if the buffer was not allocated
+  // from this slab (e.g. reads rerouted from another stream listener).
+  bool Commit(v8::Isolate* isolate,
+              const uv_buf_t& buf,
+              size_t nread,
+              v8::Local<v8::ArrayBuffer>* ab,
+              size_t* offset);
+  // Return an unused reservation (failed or empty read). Returns false if
+  // the buffer was not allocated from this slab.
+  bool Release(const uv_buf_t& buf);
+
+ private:
+  struct Slab {
+    std::shared_ptr<v8::BackingStore> bs;
+    v8::Global<v8::ArrayBuffer> ab;
+    size_t offset = 0;          // Bump pointer.
+    size_t pending = 0;         // Reservations not yet committed/released.
+    char* last_base = nullptr;  // Most recent reservation...
+    size_t last_end = 0;        // ...and the bump pointer after it.
+
+    char* data() const { return static_cast<char*>(bs->Data()); }
+    size_t size() const { return bs->ByteLength(); }
+    bool Contains(const char* p) const {
+      return bs && p >= data() && p < data() + size();
+    }
+  };
+
+  Slab* FindSlab(const char* base);
+  void CompleteReservation(Slab* slab, const uv_buf_t& buf, size_t used);
+
+  Slab current_;
+  std::vector<Slab> retired_;
+};
+
 namespace per_process {
 extern std::shared_ptr<KVStore> system_environment;
 }
@@ -587,7 +646,6 @@ struct SnapshotData {
   static bool FromBlob(SnapshotData* out, std::string_view in);
   static const SnapshotData* FromEmbedderWrapper(
       const EmbedderSnapshotData* data);
-  EmbedderSnapshotData::Pointer AsEmbedderWrapper() const;
 
   ~SnapshotData();
 };
@@ -1060,6 +1118,10 @@ class Environment final : public MemoryRetainer {
   // Only buffers that were not exposed externally may be recycled.
   void recycle_managed_buffer(std::unique_ptr<v8::BackingStore> bs);
 
+  StreamReadSlab& stream_read_slab() {
+    return stream_read_slab_;
+  }
+
   void AddUnmanagedFd(int fd);
   void RemoveUnmanagedFd(int fd);
 
@@ -1087,13 +1149,14 @@ class Environment final : public MemoryRetainer {
   };
 
 #if HAVE_OPENSSL
-#if OPENSSL_VERSION_MAJOR >= 3
-  // We declare another alias here to avoid having to include crypto_util.h
-  using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
-  std::vector<EVPMDPointer> evp_md_cache;
-#endif  // OPENSSL_VERSION_MAJOR >= 3
-  std::unordered_map<std::string, size_t> alias_to_md_id_map;
+  uint64_t hash_cache_generation = 0;
+  std::unique_ptr<ncrypto::DigestCache> provider_digest_cache;
+  std::unique_ptr<ncrypto::CipherCache> provider_cipher_cache;
   std::vector<std::string> supported_hash_algorithms;
+  uint64_t mac_cache_generation = 0;
+  std::unique_ptr<ncrypto::MacCache> provider_mac_cache;
+  std::vector<std::string> supported_mac_algorithms;
+  bool supported_mac_algorithms_initialized = false;
 #endif  // HAVE_OPENSSL
 
   v8::Global<v8::Module> temporary_required_module_facade_original;
@@ -1278,6 +1341,9 @@ class Environment final : public MemoryRetainer {
       released_allocated_buffers_;
   std::unique_ptr<v8::BackingStore> managed_buffer_cache_;
 
+  // Used by EmitToJSStreamListener to allocate stream read buffers.
+  StreamReadSlab stream_read_slab_;
+
   v8::CpuProfiler* cpu_profiler_ = nullptr;
   std::vector<v8::ProfilerId> pending_profiles_;
 };
diff --git a/src/env_properties.h b/src/env_properties.h
index 36e1f9209793..564d3fa3c7a2 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -105,35 +105,9 @@
   V(code_string, "code")                                                       \
   V(config_string, "config")                                                   \
   V(constants_string, "constants")                                             \
-  V(crypto_dh_string, "dh")                                                    \
-  V(crypto_dsa_string, "dsa")                                                  \
-  V(crypto_ec_string, "ec")                                                    \
-  V(crypto_ed25519_string, "ed25519")                                          \
-  V(crypto_ed448_string, "ed448")                                              \
-  V(crypto_ml_dsa_44_string, "ml-dsa-44")                                      \
-  V(crypto_ml_dsa_65_string, "ml-dsa-65")                                      \
-  V(crypto_ml_dsa_87_string, "ml-dsa-87")                                      \
-  V(crypto_ml_kem_512_string, "ml-kem-512")                                    \
-  V(crypto_ml_kem_768_string, "ml-kem-768")                                    \
-  V(crypto_ml_kem_1024_string, "ml-kem-1024")                                  \
-  V(crypto_slh_dsa_sha2_128f_string, "slh-dsa-sha2-128f")                      \
-  V(crypto_slh_dsa_sha2_128s_string, "slh-dsa-sha2-128s")                      \
-  V(crypto_slh_dsa_sha2_192f_string, "slh-dsa-sha2-192f")                      \
-  V(crypto_slh_dsa_sha2_192s_string, "slh-dsa-sha2-192s")                      \
-  V(crypto_slh_dsa_sha2_256f_string, "slh-dsa-sha2-256f")                      \
-  V(crypto_slh_dsa_sha2_256s_string, "slh-dsa-sha2-256s")                      \
-  V(crypto_slh_dsa_shake_128f_string, "slh-dsa-shake-128f")                    \
-  V(crypto_slh_dsa_shake_128s_string, "slh-dsa-shake-128s")                    \
-  V(crypto_slh_dsa_shake_192f_string, "slh-dsa-shake-192f")                    \
-  V(crypto_slh_dsa_shake_192s_string, "slh-dsa-shake-192s")                    \
-  V(crypto_slh_dsa_shake_256f_string, "slh-dsa-shake-256f")                    \
-  V(crypto_slh_dsa_shake_256s_string, "slh-dsa-shake-256s")                    \
-  V(crypto_x25519_string, "x25519")                                            \
-  V(crypto_x448_string, "x448")                                                \
-  V(crypto_rsa_string, "rsa")                                                  \
-  V(crypto_rsa_pss_string, "rsa-pss")                                          \
   V(cwd_string, "cwd")                                                         \
   V(data_string, "data")                                                       \
+  V(database_string, "database")                                               \
   V(default_is_true_string, "defaultIsTrue")                                   \
   V(defensive_string, "defensive")                                             \
   V(deserialize_info_string, "deserializeInfo")                                \
@@ -230,12 +204,15 @@
   V(jwk_n_string, "n")                                                         \
   V(jwk_oct_string, "oct")                                                     \
   V(jwk_okp_string, "OKP")                                                     \
+  V(jwk_oth_string, "oth")                                                     \
   V(jwk_p_string, "p")                                                         \
   V(jwk_priv_string, "priv")                                                   \
   V(jwk_pub_string, "pub")                                                     \
   V(jwk_q_string, "q")                                                         \
   V(jwk_qi_string, "qi")                                                       \
+  V(jwk_r_string, "r")                                                         \
   V(jwk_rsa_string, "RSA")                                                     \
+  V(jwk_t_string, "t")                                                         \
   V(jwk_x_string, "x")                                                         \
   V(jwk_y_string, "y")                                                         \
   V(kill_signal_string, "killSignal")                                          \
@@ -348,6 +325,7 @@
   V(source_map_url_string, "sourceMapURL")                                     \
   V(source_url_string, "sourceURL")                                            \
   V(specifier_string, "specifier")                                             \
+  V(sql_string, "sql")                                                         \
   V(stack_string, "stack")                                                     \
   V(start_string, "start")                                                     \
   V(state_string, "state")                                                     \
@@ -391,6 +369,7 @@
   V(writable_string, "writable")                                               \
   V(write_host_object_string, "_writeHostObject")                              \
   V(write_queue_size_string, "writeQueueSize")                                 \
+  V(write_status_string, "writeStatus")                                        \
   V(zlib_string, "zlib")                                                       \
   V(zstd_string, "zstd")
 
@@ -422,6 +401,7 @@
   V(fd_constructor_template, v8::ObjectTemplate)                               \
   V(fdclose_constructor_template, v8::ObjectTemplate)                          \
   V(filehandlereadwrap_template, v8::ObjectTemplate)                           \
+  V(fips_indicator_event_template, v8::DictionaryTemplate)                     \
   V(free_list_statistics_template, v8::DictionaryTemplate)                     \
   V(fsreqpromise_constructor_template, v8::ObjectTemplate)                     \
   V(handle_wrap_ctor_template, v8::FunctionTemplate)                           \
@@ -488,6 +468,7 @@
   V(async_hooks_promise_resolve_function, v8::Function)                        \
   V(buffer_prototype_object, v8::Object)                                       \
   V(crypto_internal_cryptokey_constructor, v8::Function)                       \
+  V(crypto_internal_x509_certificate_constructor, v8::Function)                \
   V(crypto_key_object_private_constructor, v8::Function)                       \
   V(crypto_key_object_public_constructor, v8::Function)                        \
   V(crypto_key_object_secret_constructor, v8::Function)                        \
diff --git a/src/histogram-inl.h b/src/histogram-inl.h
index eea0e89bef11..e2704b499f31 100644
--- a/src/histogram-inl.h
+++ b/src/histogram-inl.h
@@ -33,9 +33,15 @@ void Histogram::UpdateEwma(double value) {
   }
 }
 
+void Histogram::InvalidateRecordedSnapshot() {
+  mutation_generation_++;
+  recorded_snapshot_cache_.reset();
+}
+
 void Histogram::Reset() {
   RwLock::ScopedWriteLock lock(mutex_);
   hdr_reset(histogram_.get());
+  InvalidateRecordedSnapshot();
   exceeds_ = 0;
   prev_ = 0;
   ewma_mean_ = 0;
@@ -49,8 +55,10 @@ double Histogram::Add(const Histogram& other) {
     exceeds_ += other.exceeds_;
     if (other.prev_ > prev_) prev_ = other.prev_;
     // hdr_add merges all bucket counts and total_count internally.
-    return static_cast<double>(
-        hdr_add(histogram_.get(), other.histogram_.get()));
+    const double dropped =
+        static_cast<double>(hdr_add(histogram_.get(), other.histogram_.get()));
+    InvalidateRecordedSnapshot();
+    return dropped;
   };
 
   // When adding a histogram to itself, a single write lock suffices.
@@ -146,8 +154,10 @@ bool Histogram::RecordCorrected(int64_t value, int64_t expected_interval) {
       hdr_record_corrected_value(histogram_.get(), value, expected_interval);
   if (!recorded)
     exceeds_++;
-  else
+  else {
+    InvalidateRecordedSnapshot();
     UpdateEwma(static_cast<double>(value));
+  }
   return recorded;
 }
 
@@ -156,8 +166,10 @@ bool Histogram::Record(int64_t value) {
   bool recorded = hdr_record_value(histogram_.get(), value);
   if (!recorded)
     exceeds_++;
-  else
+  else {
+    InvalidateRecordedSnapshot();
     UpdateEwma(static_cast<double>(value));
+  }
   return recorded;
 }
 
@@ -170,8 +182,10 @@ uint64_t Histogram::RecordDelta() {
     delta = time - prev_;
     if (!hdr_record_value(histogram_.get(), delta))
       exceeds_++;
-    else
+    else {
+      InvalidateRecordedSnapshot();
       UpdateEwma(static_cast<double>(delta));
+    }
   }
   prev_ = time;
   return delta;
diff --git a/src/histogram.cc b/src/histogram.cc
index 7127bb80cc8f..30a095b3c43c 100644
--- a/src/histogram.cc
+++ b/src/histogram.cc
@@ -5,31 +5,43 @@
 #include "node_debug.h"
 #include "node_errors.h"
 #include "node_external_reference.h"
+#include "threadpoolwork-inl.h"
 #include "util.h"
 #include "v8-typed-array.h"
 
+#include <algorithm>
 #include <cmath>
+#include <cstring>
 #include <numbers>
 #include <vector>
 
 namespace node {
 
 using v8::Array;
+using v8::ArrayBuffer;
 using v8::BigInt;
 using v8::CFunction;
 using v8::Context;
+using v8::Exception;
+using v8::FastApiCallbackOptions;
 using v8::Float64Array;
 using v8::FunctionCallbackInfo;
 using v8::FunctionTemplate;
+using v8::Global;
+using v8::HandleScope;
 using v8::Integer;
 using v8::Isolate;
 using v8::Local;
 using v8::Map;
+using v8::Name;
+using v8::Null;
 using v8::Number;
 using v8::Object;
 using v8::ObjectTemplate;
+using v8::Promise;
 using v8::String;
 using v8::Uint32;
+using v8::Uint8Array;
 using v8::Value;
 
 template <typename T>
@@ -46,14 +58,8 @@ void StopHandleHistogram(Local<Value> receiver) {
   histogram->OnStop();
 }
 
-Histogram::Histogram(const Options& options) {
-  hdr_histogram* histogram;
-  CHECK_EQ(0, hdr_init(options.lowest,
-                       options.highest,
-                       options.figures,
-                       &histogram));
-  histogram_.reset(histogram);
-
+Histogram::Histogram(HistogramPointer histogram, const Options& options)
+    : histogram_(std::move(histogram)) {
   // alpha = 1 - 2^(-1/halfLife). With halfLife <= 0, EWMA is disabled.
   if (options.half_life > 0) {
     ewma_alpha_ = 1.0 - std::exp(-std::log(2.0) / options.half_life);
@@ -61,8 +67,19 @@ Histogram::Histogram(const Options& options) {
   threshold_ = options.threshold;
 }
 
+std::shared_ptr<Histogram> Histogram::Create(const Options& options) {
+  hdr_histogram* histogram;
+  if (hdr_init(options.lowest, options.highest, options.figures, &histogram) !=
+      0) {
+    return {};
+  }
+  return std::make_shared<Histogram>(HistogramPointer(histogram), options);
+}
+
 void Histogram::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackFieldWithSize("histogram", GetMemorySize());
+  tracker->TrackFieldWithSize("qrde_snapshot",
+                              GetCachedRecordedSnapshotMemorySize());
 }
 
 bool Histogram::IsCompatible(const Histogram& other) const {
@@ -75,6 +92,99 @@ bool Histogram::IsCompatible(const Histogram& other) const {
              other.histogram_->significant_figures;
 }
 
+Histogram::RecordedSnapshot Histogram::BuildRecordedSnapshot(
+    const hdr_histogram* histogram) {
+  RecordedSnapshot snapshot;
+  snapshot.total_count = histogram->total_count;
+  if (snapshot.total_count == 0) return snapshot;
+
+  const size_t occupied =
+      std::count_if(histogram->counts,
+                    histogram->counts + histogram->counts_len,
+                    [](int64_t count) { return count != 0; });
+  snapshot.buckets.reserve(occupied);
+  hdr_iter iter;
+  hdr_iter_recorded_init(&iter, histogram);
+  while (hdr_iter_next(&iter)) {
+    snapshot.buckets.push_back({
+        static_cast<double>(iter.median_equivalent_value),
+        static_cast<double>(
+            hdr_size_of_equivalent_value_range(histogram, iter.value)),
+        iter.count,
+        iter.cumulative_count,
+    });
+  }
+  return snapshot;
+}
+
+Histogram::RecordedSnapshotSource Histogram::GetRecordedSnapshotSource(
+    bool use_cache) const {
+  RecordedSnapshotSource source;
+  int64_t lowest;
+  int64_t highest;
+  int figures;
+  {
+    RwLock::ScopedReadLock lock(mutex_);
+    source.generation = mutation_generation_;
+    if (use_cache && recorded_snapshot_cache_) {
+      source.snapshot = recorded_snapshot_cache_;
+      source.cache_hit = true;
+      return source;
+    }
+    if (histogram_->total_count == 0) {
+      source.snapshot = std::make_shared<const RecordedSnapshot>();
+      return source;
+    }
+    lowest = histogram_->lowest_discernible_value;
+    highest = histogram_->highest_trackable_value;
+    figures = histogram_->significant_figures;
+  }
+
+  hdr_histogram* copy;
+  if (hdr_init(lowest, highest, figures, &copy) != 0) return source;
+  source.histogram.reset(copy);
+
+  RwLock::ScopedReadLock lock(mutex_);
+  source.generation = mutation_generation_;
+  if (use_cache && recorded_snapshot_cache_) {
+    source.histogram.reset();
+    source.snapshot = recorded_snapshot_cache_;
+    source.cache_hit = true;
+    return source;
+  }
+  if (histogram_->total_count == 0) {
+    source.histogram.reset();
+    source.snapshot = std::make_shared<const RecordedSnapshot>();
+    return source;
+  }
+
+  CHECK_EQ(source.histogram->counts_len, histogram_->counts_len);
+  source.histogram->min_value = histogram_->min_value;
+  source.histogram->max_value = histogram_->max_value;
+  source.histogram->normalizing_index_offset =
+      histogram_->normalizing_index_offset;
+  source.histogram->conversion_ratio = histogram_->conversion_ratio;
+  source.histogram->total_count = histogram_->total_count;
+  std::memcpy(source.histogram->counts,
+              histogram_->counts,
+              histogram_->counts_len * sizeof(*histogram_->counts));
+  return source;
+}
+
+void Histogram::CacheRecordedSnapshot(
+    uint64_t generation, std::shared_ptr<const RecordedSnapshot> snapshot) {
+  RwLock::ScopedWriteLock lock(mutex_);
+  if (generation == mutation_generation_) {
+    recorded_snapshot_cache_ = std::move(snapshot);
+  }
+}
+
+size_t Histogram::GetCachedRecordedSnapshotMemorySize() const {
+  RwLock::ScopedReadLock lock(mutex_);
+  if (!recorded_snapshot_cache_) return 0;
+  return recorded_snapshot_cache_->buckets.capacity() * sizeof(RecordedBucket);
+}
+
 double Histogram::Cdf(int64_t value) const {
   RwLock::ScopedReadLock lock(mutex_);
   int64_t total = histogram_->total_count;
@@ -166,6 +276,7 @@ double Histogram::Subtract(const Histogram& other) {
       histogram_->counts[i] = count;
     }
     hdr_reset_internal_counters(histogram_.get());
+    InvalidateRecordedSnapshot();
     exceeds_ = (exceeds_ > other.exceeds_) ? exceeds_ - other.exceeds_ : 0;
     return static_cast<double>(dropped);
   };
@@ -270,22 +381,157 @@ static double BetaContinuedFraction(double a, double b, double x) {
   return h;
 }
 
+struct BetaParameters {
+  double a;
+  double b;
+  double log_normalization;
+  double mean;
+  double standard_deviation;
+  double skewness;
+  double excess_kurtosis;
+  double log_scale;
+  double symmetry_point;
+  bool use_asymptotic_front;
+  bool use_asymptotic_cdf;
+};
+
+static double StirlingCorrection(double x) {
+  const double inverse = 1.0 / x;
+  const double inverse_squared = inverse * inverse;
+  return inverse * (1.0 / 12.0 +
+                    inverse_squared *
+                        (-1.0 / 360.0 +
+                         inverse_squared *
+                             (1.0 / 1260.0 +
+                              inverse_squared *
+                                  (-1.0 / 1680.0 + inverse_squared / 1188.0))));
+}
+
+static BetaParameters MakeBetaParameters(double a,
+                                         double b,
+                                         bool approximate_large_shapes) {
+  const double sum = a + b;
+  const double mean = a / sum;
+  const bool use_asymptotic_front =
+      approximate_large_shapes && a >= 8.0 && b >= 8.0;
+  // The continued fraction needs progressively more iterations as both
+  // beta shapes grow. At this concentration the Edgeworth error is smaller
+  // than the continued-fraction truncation error.
+  const bool use_asymptotic_cdf =
+      approximate_large_shapes && a * b / sum >= 25'000.0;
+  const double variance = mean * (1.0 - mean) / (sum + 1.0);
+  const double skewness =
+      2.0 * (b - a) * std::sqrt(sum + 1.0) / ((sum + 2.0) * std::sqrt(a * b));
+  const double excess_kurtosis =
+      6.0 * ((a - b) * (a - b) * (sum + 1.0) - a * b * (sum + 2.0)) /
+      (a * b * (sum + 2.0) * (sum + 3.0));
+  return {
+      a,
+      b,
+      use_asymptotic_front ? 0.0
+                           : std::lgamma(sum) - std::lgamma(a) - std::lgamma(b),
+      mean,
+      std::sqrt(variance),
+      skewness,
+      excess_kurtosis,
+      use_asymptotic_front ? 0.5 * std::log(sum * mean * (1.0 - mean) /
+                                            (2.0 * std::numbers::pi)) +
+                                 StirlingCorrection(sum) -
+                                 StirlingCorrection(a) - StirlingCorrection(b)
+                           : 0.0,
+      (a + 1.0) / (sum + 2.0),
+      use_asymptotic_front,
+      use_asymptotic_cdf,
+  };
+}
+
+static BetaParameters ReflectBetaParameters(const BetaParameters& params) {
+  return {
+      params.b,
+      params.a,
+      params.log_normalization,
+      1.0 - params.mean,
+      params.standard_deviation,
+      -params.skewness,
+      params.excess_kurtosis,
+      params.log_scale,
+      1.0 - params.symmetry_point,
+      params.use_asymptotic_front,
+      params.use_asymptotic_cdf,
+  };
+}
+
+static double BetaFront(const BetaParameters& params, double x) {
+  if (x <= 0.0 || x >= 1.0) return 0.0;
+  double log_front;
+  if (params.use_asymptotic_front) {
+    log_front = params.a * std::log1p((x - params.mean) / params.mean) +
+                params.b * std::log1p((params.mean - x) / (1.0 - params.mean)) +
+                params.log_scale;
+  } else {
+    log_front = params.log_normalization + params.a * std::log(x) +
+                params.b * std::log(1.0 - x);
+  }
+  return std::exp(log_front);
+}
+
+static double AsymptoticBetaCdf(const BetaParameters& params,
+                                double x,
+                                double* front_out) {
+  const double z = (x - params.mean) / params.standard_deviation;
+  const double normal_cdf = 0.5 * std::erfc(-z / std::numbers::sqrt2);
+  if (std::fabs(z) >= 8.0) {
+    if (front_out != nullptr) *front_out = 0.0;
+    return normal_cdf;
+  }
+
+  const double z2 = z * z;
+  const double z3 = z2 * z;
+  const double normal_pdf =
+      std::exp(-0.5 * z2) / std::sqrt(2.0 * std::numbers::pi);
+  if (front_out != nullptr) {
+    const double z4 = z2 * z2;
+    const double z6 = z3 * z3;
+    const double density_correction =
+        1.0 + params.skewness / 6.0 * (z3 - 3.0 * z) +
+        params.excess_kurtosis / 24.0 * (z4 - 6.0 * z2 + 3.0) +
+        params.skewness * params.skewness / 72.0 *
+            (z6 - 15.0 * z4 + 45.0 * z2 - 15.0);
+    *front_out = x * (1.0 - x) * normal_pdf / params.standard_deviation *
+                 std::max(0.0, density_correction);
+  }
+  const double correction = params.skewness / 6.0 * (1.0 - z2) -
+                            params.excess_kurtosis / 24.0 * (z3 - 3.0 * z) -
+                            params.skewness * params.skewness / 72.0 *
+                                (z3 * z2 - 10.0 * z3 + 15.0 * z);
+  return std::clamp(normal_cdf + normal_pdf * correction, 0.0, 1.0);
+}
+
 // Regularized incomplete beta function I_x(a, b).
 // Returns the probability that a Beta(a,b) random variable is <= x.
-static double RegularizedIncompleteBeta(double a, double b, double x) {
+static double RegularizedIncompleteBeta(const BetaParameters& params,
+                                        double x,
+                                        double* front_out = nullptr) {
+  if (front_out != nullptr) *front_out = 0.0;
   if (x <= 0.0) return 0.0;
   if (x >= 1.0) return 1.0;
-
-  double ln_front = std::lgamma(a + b) - std::lgamma(a) - std::lgamma(b) +
-                    a * std::log(x) + b * std::log(1.0 - x);
-  double bt = std::exp(ln_front);
+  if (params.use_asymptotic_cdf) {
+    return AsymptoticBetaCdf(params, x, front_out);
+  }
+  const double front = BetaFront(params, x);
+  if (front_out != nullptr) *front_out = front;
 
   // Use the symmetry relation to ensure the continued fraction
   // converges in the region where it is most accurate.
-  if (x < (a + 1.0) / (a + b + 2.0)) {
-    return bt * BetaContinuedFraction(a, b, x) / a;
+  if (x < params.symmetry_point) {
+    return front * BetaContinuedFraction(params.a, params.b, x) / params.a;
   }
-  return 1.0 - bt * BetaContinuedFraction(b, a, 1.0 - x) / b;
+  return 1.0 -
+         front * BetaContinuedFraction(params.b, params.a, 1.0 - x) / params.b;
+}
+
+static double RegularizedIncompleteBeta(double a, double b, double x) {
+  return RegularizedIncompleteBeta(MakeBetaParameters(a, b, false), x);
 }
 
 // Standard normal CDF: Phi(x) = P(Z <= x).
@@ -295,28 +541,29 @@ static double NormalCdf(double x) {
 
 // Student's t-distribution CDF: P(T <= t) for df degrees of freedom.
 static double StudentTCdf(double t, double df) {
-  double x = df / (df + t * t);
-  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
-  if (t >= 0.0) {
-    return 1.0 - 0.5 * ibeta;
+  double squared = t * t;
+  double denominator = df + squared;
+  if (squared < df) {
+    double x = squared / denominator;
+    double ibeta = RegularizedIncompleteBeta(0.5, df / 2.0, x);
+    return t >= 0.0 ? 0.5 + 0.5 * ibeta : 0.5 - 0.5 * ibeta;
   }
-  return 0.5 * ibeta;
+
+  double x = df / denominator;
+  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
+  return t >= 0.0 ? 1.0 - 0.5 * ibeta : 0.5 * ibeta;
 }
 
-// Student's t-distribution quantile (inverse CDF) using bisection.
-// Returns the value t such that P(T <= t) = p.
-static double StudentTQuantile(double p, double df) {
-  if (p <= 0.0) return -std::numeric_limits<double>::infinity();
-  if (p >= 1.0) return std::numeric_limits<double>::infinity();
-  if (p == 0.5) return 0.0;
+// Positive Student's t-distribution quantile for an upper-tail probability.
+// Using the lower tail avoids loss of precision for probabilities near 1.
+static double StudentTUpperQuantile(double p, double df) {
+  double lo = 0.0;
+  double hi = 1.0;
+  while (StudentTCdf(-hi, df) > p) hi *= 2.0;
 
-  // Bisection search. The range [-1e6, 1e6] is sufficient for any
-  // practical confidence level and degrees of freedom.
-  double lo = -1e6;
-  double hi = 1e6;
   for (int i = 0; i < 100; i++) {
     double mid = (lo + hi) / 2.0;
-    if (StudentTCdf(mid, df) < p) {
+    if (StudentTCdf(-mid, df) > p) {
       lo = mid;
     } else {
       hi = mid;
@@ -333,8 +580,551 @@ static double BinomialCdf(int64_t k, int64_t n, double p) {
   return RegularizedIncompleteBeta(
       static_cast<double>(n - k), static_cast<double>(k + 1), 1.0 - p);
 }
+
+struct QrdeResult {
+  std::vector<double> quantiles;
+  std::vector<double> densities;
+  size_t corrections = 0;
+};
+
+enum class QrdeDequantization : uint32_t {
+  kNone,
+  kHdr,
+  kAll,
+};
+
+static bool QrdeShouldDequantize(const Histogram::RecordedBucket& bucket,
+                                 QrdeDequantization dequantization) {
+  return bucket.count > 1 && (dequantization == QrdeDequantization::kAll ||
+                              (dequantization == QrdeDequantization::kHdr &&
+                               bucket.resolution > 1.0));
+}
+
+static std::pair<double, double> QrdeBucketRange(
+    const Histogram::RecordedSnapshot& snapshot,
+    size_t index,
+    QrdeDequantization dequantization) {
+  const auto& bucket = snapshot.buckets[index];
+  if (!QrdeShouldDequantize(bucket, dequantization)) {
+    return {bucket.value, bucket.value};
+  }
+
+  const double half_resolution = bucket.resolution / 2.0;
+  if (snapshot.buckets.size() == 1) {
+    return {bucket.value - half_resolution, bucket.value + half_resolution};
+  }
+  if (index == 0) {
+    return {bucket.value, bucket.value + half_resolution};
+  }
+  if (index + 1 == snapshot.buckets.size()) {
+    return {bucket.value - half_resolution, bucket.value};
+  }
+  return {bucket.value - half_resolution, bucket.value + half_resolution};
+}
+
+static bool QrdeExactSupport(const Histogram::RecordedSnapshot& snapshot,
+                             const BetaParameters& params,
+                             const BetaParameters& reflected,
+                             double count,
+                             size_t* begin_index,
+                             size_t* end_index) {
+  // Collapsing both tails changes a quantile by at most 2^-79 times the
+  // histogram range, which is less than 2^-16 over the int64 value domain.
+  constexpr double tail_mass = 0x1p-80;
+  size_t lo = 0;
+  size_t hi = snapshot.buckets.size();
+  while (lo < hi) {
+    const size_t mid = lo + (hi - lo) / 2;
+    const double rank =
+        static_cast<double>(snapshot.buckets[mid].cumulative_count) / count;
+    const double cdf = RegularizedIncompleteBeta(params, rank);
+    if (!std::isfinite(cdf)) return false;
+    if (cdf < tail_mass) {
+      lo = mid + 1;
+    } else {
+      hi = mid;
+    }
+  }
+  if (lo == snapshot.buckets.size()) return false;
+  const size_t first = lo;
+
+  lo = first;
+  hi = snapshot.buckets.size();
+  while (lo < hi) {
+    const size_t mid = lo + (hi - lo) / 2;
+    const double remaining_rank =
+        static_cast<double>(snapshot.total_count -
+                            snapshot.buckets[mid].cumulative_count) /
+        count;
+    const double survival =
+        RegularizedIncompleteBeta(reflected, remaining_rank);
+    if (!std::isfinite(survival)) return false;
+    if (survival > tail_mass) {
+      lo = mid + 1;
+    } else {
+      hi = mid;
+    }
+  }
+  if (lo == snapshot.buckets.size() || lo < first) return false;
+  *begin_index = first;
+  *end_index = lo + 1;
+  return true;
+}
+
+static double QrdeQuantile(const Histogram::RecordedSnapshot& snapshot,
+                           double p,
+                           QrdeDequantization dequantization) {
+  const double count = static_cast<double>(snapshot.total_count);
+  const double a = (count + 1.0) * p;
+  const double b = (count + 1.0) * (1.0 - p);
+  const BetaParameters mass_params = MakeBetaParameters(a, b, true);
+  const BetaParameters reflected_params = ReflectBetaParameters(mass_params);
+
+  size_t begin_index = 0;
+  size_t end_index = snapshot.buckets.size();
+  if (mass_params.use_asymptotic_cdf) {
+    // Outside this interval the normal-tail mass is below 2e-33.
+    constexpr double support_deviations = 12.0;
+    const double lower_rank = std::max(
+        0.0,
+        mass_params.mean - support_deviations * mass_params.standard_deviation);
+    const double upper_rank = std::min(
+        1.0,
+        mass_params.mean + support_deviations * mass_params.standard_deviation);
+    const auto first = std::lower_bound(
+        snapshot.buckets.begin(),
+        snapshot.buckets.end(),
+        lower_rank * count,
+        [](const Histogram::RecordedBucket& bucket, double cumulative) {
+          return static_cast<double>(bucket.cumulative_count) < cumulative;
+        });
+    const auto last = std::lower_bound(
+        first,
+        snapshot.buckets.end(),
+        upper_rank * count,
+        [](const Histogram::RecordedBucket& bucket, double cumulative) {
+          return static_cast<double>(bucket.cumulative_count) < cumulative;
+        });
+    begin_index = first - snapshot.buckets.begin();
+    if (last != snapshot.buckets.end()) {
+      end_index = last - snapshot.buckets.begin() + 1;
+    }
+  } else if (snapshot.buckets.size() >= 512) {
+    QrdeExactSupport(snapshot,
+                     mass_params,
+                     reflected_params,
+                     count,
+                     &begin_index,
+                     &end_index);
+  }
+
+  const bool dequantize = dequantization != QrdeDequantization::kNone;
+  const auto first_range = QrdeBucketRange(snapshot, 0, dequantization);
+  const auto last_range =
+      QrdeBucketRange(snapshot, snapshot.buckets.size() - 1, dequantization);
+  const double lower_endpoint = first_range.first;
+  const double upper_endpoint = last_range.second;
+
+  double previous_cdf = 0.0;
+  double previous_survival = 0.0;
+  double previous_front = 0.0;
+  int64_t previous_count =
+      begin_index == 0 ? 0 : snapshot.buckets[begin_index - 1].cumulative_count;
+  if (previous_count != 0) {
+    const double previous_rank = static_cast<double>(previous_count) / count;
+    previous_cdf = RegularizedIncompleteBeta(
+        mass_params, previous_rank, dequantize ? &previous_front : nullptr);
+    if (!std::isfinite(previous_cdf) ||
+        (dequantize && !std::isfinite(previous_front))) {
+      begin_index = 0;
+      end_index = snapshot.buckets.size();
+      previous_count = 0;
+      previous_cdf = 0.0;
+      previous_front = 0.0;
+    } else {
+      previous_cdf = std::clamp(previous_cdf, 0.0, 1.0);
+    }
+  }
+
+  double quantile = lower_endpoint * previous_cdf;
+  bool using_survival = false;
+
+  for (size_t i = begin_index; i < end_index; i++) {
+    const auto& bucket = snapshot.buckets[i];
+    const double u0 = static_cast<double>(previous_count) / count;
+    const double u1 = static_cast<double>(bucket.cumulative_count) / count;
+    double front = 0.0;
+    double mass;
+    // Use the reflected CDF above the symmetry point so small upper-tail
+    // interval weights are not lost to subtraction from one.
+    if (u1 <= mass_params.symmetry_point) {
+      const double cdf =
+          std::clamp(RegularizedIncompleteBeta(
+                         mass_params, u1, dequantize ? &front : nullptr),
+                     previous_cdf,
+                     1.0);
+      mass = cdf - previous_cdf;
+      previous_cdf = cdf;
+    } else {
+      const double remaining_rank =
+          static_cast<double>(snapshot.total_count - bucket.cumulative_count) /
+          count;
+      double survival = RegularizedIncompleteBeta(
+          reflected_params, remaining_rank, dequantize ? &front : nullptr);
+      if (using_survival) {
+        survival = std::clamp(survival, 0.0, previous_survival);
+        mass = previous_survival - survival;
+      } else {
+        survival = std::clamp(survival, 0.0, 1.0 - previous_cdf);
+        mass = 1.0 - previous_cdf - survival;
+        using_survival = true;
+      }
+      previous_survival = survival;
+    }
+
+    if (!QrdeShouldDequantize(bucket, dequantization)) {
+      quantile += bucket.value * mass;
+    } else {
+      // I_x(a + 1, b) = I_x(a, b) - front / a, so the first moment
+      // within this rank interval does not require a second beta CDF.
+      const double sum = a + b;
+      const double rank_width = static_cast<double>(bucket.count) / count;
+      const double local_moment =
+          std::clamp((a / sum - u0) * mass - (front - previous_front) / sum,
+                     0.0,
+                     rank_width * mass);
+      const auto [lower, upper] = QrdeBucketRange(snapshot, i, dequantization);
+      quantile += lower * mass + (upper - lower) * local_moment / rank_width;
+    }
+
+    previous_front = front;
+    previous_count = bucket.cumulative_count;
+  }
+
+  const double remaining_mass =
+      using_survival ? previous_survival : 1.0 - previous_cdf;
+  quantile += upper_endpoint * std::clamp(remaining_mass, 0.0, 1.0);
+  return quantile;
+}
+
+static QrdeResult CalculateQrde(const Histogram::RecordedSnapshot& snapshot,
+                                const std::vector<double>& probabilities,
+                                QrdeDequantization dequantization) {
+  QrdeResult result;
+  if (snapshot.buckets.empty()) return result;
+
+  result.quantiles.resize(probabilities.size());
+  result.densities.resize(probabilities.size() - 1);
+
+  const auto first_range = QrdeBucketRange(snapshot, 0, dequantization);
+  const auto last_range =
+      QrdeBucketRange(snapshot, snapshot.buckets.size() - 1, dequantization);
+  result.quantiles.front() = first_range.first;
+  result.quantiles.back() = last_range.second;
+
+  for (size_t i = 1; i + 1 < probabilities.size(); i++) {
+    double value = QrdeQuantile(snapshot, probabilities[i], dequantization);
+    value =
+        std::clamp(value, result.quantiles.front(), result.quantiles.back());
+    if (value < result.quantiles[i - 1]) {
+      value = result.quantiles[i - 1];
+      result.corrections++;
+    }
+    result.quantiles[i] = value;
+  }
+
+  for (size_t i = 0; i < result.densities.size(); i++) {
+    const double width = result.quantiles[i + 1] - result.quantiles[i];
+    const double probability_mass = probabilities[i + 1] - probabilities[i];
+    result.densities[i] = width == 0.0 ? std::numeric_limits<double>::infinity()
+                                       : probability_mass / width;
+  }
+
+  return result;
+}
+
+static Local<Float64Array> ToFloat64Array(Isolate* isolate,
+                                          const std::vector<double>& values) {
+  auto store =
+      ArrayBuffer::NewBackingStore(isolate, values.size() * sizeof(double));
+  if (!values.empty()) {
+    memcpy(store->Data(), values.data(), values.size() * sizeof(double));
+  }
+  Local<ArrayBuffer> buffer = ArrayBuffer::New(isolate, std::move(store));
+  return Float64Array::New(buffer, 0, values.size());
+}
+
+static const char* QrdeDequantizationName(QrdeDequantization dequantization) {
+  switch (dequantization) {
+    case QrdeDequantization::kNone:
+      return "none";
+    case QrdeDequantization::kHdr:
+      return "hdr";
+    case QrdeDequantization::kAll:
+      return "all";
+  }
+  UNREACHABLE();
+}
+
+class QrdeJob final : public ThreadPoolWork {
+ public:
+  QrdeJob(Environment* env,
+          Local<Promise::Resolver> resolver,
+          std::shared_ptr<Histogram> histogram,
+          Histogram::RecordedSnapshotSource snapshot_source,
+          std::vector<double> probabilities,
+          QrdeDequantization dequantization)
+      : ThreadPoolWork(env, "histogram.qrde"),
+        histogram_(std::move(histogram)),
+        snapshot_source_(std::move(snapshot_source)),
+        probabilities_(std::move(probabilities)),
+        dequantization_(dequantization) {
+    resolver_.Reset(env->isolate(), resolver);
+  }
+
+  void DoThreadPoolWork() override {
+    if (snapshot_source_.snapshot) {
+      snapshot_ = std::move(snapshot_source_.snapshot);
+    } else {
+      snapshot_ = std::make_shared<const Histogram::RecordedSnapshot>(
+          Histogram::BuildRecordedSnapshot(snapshot_source_.histogram.get()));
+      snapshot_source_.histogram.reset();
+    }
+    if (histogram_) {
+      histogram_->CacheRecordedSnapshot(snapshot_source_.generation, snapshot_);
+      histogram_.reset();
+    }
+    result_ = CalculateQrde(*snapshot_, probabilities_, dequantization_);
+  }
+
+  void AfterThreadPoolWork(int status) override {
+    std::unique_ptr<QrdeJob> self(this);
+    Environment* env = ThreadPoolWork::env();
+    CHECK(status == 0 || status == UV_ECANCELED);
+    if (!env->can_call_into_js()) {
+      resolver_.Reset();
+      return;
+    }
+
+    Isolate* isolate = env->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env->context());
+    InternalCallbackScope callback_scope(
+        env, Object::New(isolate), {0, 0}, InternalCallbackScope::kNoFlags);
+    Local<Promise::Resolver> resolver =
+        Local<Promise::Resolver>::New(isolate, resolver_);
+
+    if (status == UV_ECANCELED) {
+      USE(resolver->Reject(
+          env->context(),
+          Exception::Error(OneByteString(isolate, "QRDE job was canceled"))));
+      resolver_.Reset();
+      return;
+    }
+
+    Local<Name> names[] = {
+        FIXED_ONE_BYTE_STRING(isolate, "probabilities"),
+        FIXED_ONE_BYTE_STRING(isolate, "quantiles"),
+        FIXED_ONE_BYTE_STRING(isolate, "densities"),
+        FIXED_ONE_BYTE_STRING(isolate, "count"),
+        FIXED_ONE_BYTE_STRING(isolate, "bucketCount"),
+        FIXED_ONE_BYTE_STRING(isolate, "corrections"),
+        FIXED_ONE_BYTE_STRING(isolate, "dequantize"),
+    };
+    Local<Value> values[] = {
+        ToFloat64Array(isolate, probabilities_),
+        ToFloat64Array(isolate, result_.quantiles),
+        ToFloat64Array(isolate, result_.densities),
+        BigInt::New(isolate, snapshot_->total_count),
+        Number::New(isolate, static_cast<double>(snapshot_->buckets.size())),
+        Number::New(isolate, static_cast<double>(result_.corrections)),
+        OneByteString(isolate, QrdeDequantizationName(dequantization_)),
+    };
+    Local<Object> value =
+        Object::New(isolate, Null(isolate), names, values, arraysize(names));
+    USE(resolver->Resolve(env->context(), value));
+    resolver_.Reset();
+  }
+
+ private:
+  std::shared_ptr<Histogram> histogram_;
+  Histogram::RecordedSnapshotSource snapshot_source_;
+  std::shared_ptr<const Histogram::RecordedSnapshot> snapshot_;
+  const std::vector<double> probabilities_;
+  const QrdeDequantization dequantization_;
+  QrdeResult result_;
+  Global<Promise::Resolver> resolver_;
+};
+
+// -----------------------------------------------------------------------
+// Minimal CBOR encoder/decoder (RFC 8949) -- just enough types for
+// histogram export/import: unsigned int, float64, array, and map.
+// -----------------------------------------------------------------------
+
+// CBOR major types (upper 3 bits of the initial byte).
+constexpr uint8_t kCborUint = 0 << 5;   // Major 0: unsigned integer
+constexpr uint8_t kCborArray = 4 << 5;  // Major 4: array
+constexpr uint8_t kCborMap = 5 << 5;    // Major 5: map
+constexpr uint8_t kCborFloat64 = 0xfb;  // Major 7, additional 27
+
+static void CborWriteUint(std::vector<uint8_t>& out,
+                          uint8_t major,
+                          uint64_t val) {
+  if (val <= 23) {
+    out.push_back(major | static_cast<uint8_t>(val));
+  } else if (val <= 0xff) {
+    out.push_back(major | 24);
+    out.push_back(static_cast<uint8_t>(val));
+  } else if (val <= 0xffff) {
+    out.push_back(major | 25);
+    out.push_back(static_cast<uint8_t>(val >> 8));
+    out.push_back(static_cast<uint8_t>(val));
+  } else if (val <= 0xffffffff) {
+    out.push_back(major | 26);
+    out.push_back(static_cast<uint8_t>(val >> 24));
+    out.push_back(static_cast<uint8_t>(val >> 16));
+    out.push_back(static_cast<uint8_t>(val >> 8));
+    out.push_back(static_cast<uint8_t>(val));
+  } else {
+    out.push_back(major | 27);
+    out.push_back(static_cast<uint8_t>(val >> 56));
+    out.push_back(static_cast<uint8_t>(val >> 48));
+    out.push_back(static_cast<uint8_t>(val >> 40));
+    out.push_back(static_cast<uint8_t>(val >> 32));
+    out.push_back(static_cast<uint8_t>(val >> 24));
+    out.push_back(static_cast<uint8_t>(val >> 16));
+    out.push_back(static_cast<uint8_t>(val >> 8));
+    out.push_back(static_cast<uint8_t>(val));
+  }
+}
+
+static void CborWriteFloat64(std::vector<uint8_t>& out, double val) {
+  out.push_back(kCborFloat64);
+  uint64_t bits;
+  memcpy(&bits, &val, sizeof(bits));
+  // Network byte order (big-endian).
+  out.push_back(static_cast<uint8_t>(bits >> 56));
+  out.push_back(static_cast<uint8_t>(bits >> 48));
+  out.push_back(static_cast<uint8_t>(bits >> 40));
+  out.push_back(static_cast<uint8_t>(bits >> 32));
+  out.push_back(static_cast<uint8_t>(bits >> 24));
+  out.push_back(static_cast<uint8_t>(bits >> 16));
+  out.push_back(static_cast<uint8_t>(bits >> 8));
+  out.push_back(static_cast<uint8_t>(bits));
+}
+
+static bool CborReadUint(const uint8_t*& p, const uint8_t* end, uint64_t* val) {
+  if (p >= end) return false;
+  uint8_t info = *p++ & 0x1f;
+  if (info <= 23) {
+    *val = info;
+  } else if (info == 24) {
+    if (p + 1 > end) return false;
+    *val = p[0];
+    p += 1;
+  } else if (info == 25) {
+    if (p + 2 > end) return false;
+    *val = (static_cast<uint64_t>(p[0]) << 8) | p[1];
+    p += 2;
+  } else if (info == 26) {
+    if (p + 4 > end) return false;
+    *val = (static_cast<uint64_t>(p[0]) << 24) |
+           (static_cast<uint64_t>(p[1]) << 16) |
+           (static_cast<uint64_t>(p[2]) << 8) | p[3];
+    p += 4;
+  } else if (info == 27) {
+    if (p + 8 > end) return false;
+    *val = (static_cast<uint64_t>(p[0]) << 56) |
+           (static_cast<uint64_t>(p[1]) << 48) |
+           (static_cast<uint64_t>(p[2]) << 40) |
+           (static_cast<uint64_t>(p[3]) << 32) |
+           (static_cast<uint64_t>(p[4]) << 24) |
+           (static_cast<uint64_t>(p[5]) << 16) |
+           (static_cast<uint64_t>(p[6]) << 8) | p[7];
+    p += 8;
+  } else {
+    return false;  // Indefinite length or reserved -- not supported.
+  }
+  return true;
+}
+
+static bool CborReadFloat64(const uint8_t*& p,
+                            const uint8_t* end,
+                            double* val) {
+  if (p >= end || *p != kCborFloat64) return false;
+  p++;
+  if (p + 8 > end) return false;
+  uint64_t bits = (static_cast<uint64_t>(p[0]) << 56) |
+                  (static_cast<uint64_t>(p[1]) << 48) |
+                  (static_cast<uint64_t>(p[2]) << 40) |
+                  (static_cast<uint64_t>(p[3]) << 32) |
+                  (static_cast<uint64_t>(p[4]) << 24) |
+                  (static_cast<uint64_t>(p[5]) << 16) |
+                  (static_cast<uint64_t>(p[6]) << 8) | p[7];
+  p += 8;
+  memcpy(val, &bits, sizeof(*val));
+  return true;
+}
+
+// Read a value that may be either a uint or float64.
+static bool CborReadNumber(const uint8_t*& p, const uint8_t* end, double* val) {
+  if (p >= end) return false;
+  if (*p == kCborFloat64) return CborReadFloat64(p, end, val);
+  uint64_t u;
+  if (!CborReadUint(p, end, &u)) return false;
+  *val = static_cast<double>(u);
+  return true;
+}
+
+// Histogram export format version.
+constexpr uint64_t kExportVersion = 1;
+
+// Integer keys for the top-level CBOR map.
+constexpr uint64_t kKeyVersion = 0;
+constexpr uint64_t kKeyLowest = 1;
+constexpr uint64_t kKeyHighest = 2;
+constexpr uint64_t kKeyFigures = 3;
+constexpr uint64_t kKeyTotalCount = 4;
+constexpr uint64_t kKeyMin = 5;
+constexpr uint64_t kKeyMax = 6;
+constexpr uint64_t kKeyNormOffset = 7;
+constexpr uint64_t kKeyConvRatio = 8;
+constexpr uint64_t kKeyCountsLen = 9;
+constexpr uint64_t kKeyCounts = 10;
+constexpr uint64_t kKeyEwma = 11;
+
+// Integer keys for the EWMA sub-map.
+constexpr uint64_t kEwmaAlpha = 0;
+constexpr uint64_t kEwmaMean = 1;
+constexpr uint64_t kEwmaVariance = 2;
+constexpr uint64_t kEwmaErrorRate = 3;
+constexpr uint64_t kEwmaThreshold = 4;
 }  // namespace
 
+Histogram::MeanCIResult Histogram::MeanCI(double confidence) const {
+  RwLock::ScopedReadLock lock(mutex_);
+  int64_t count = histogram_->total_count;
+  double mean = hdr_mean(histogram_.get());
+  if (count < 2) {
+    double nan = std::numeric_limits<double>::quiet_NaN();
+    return {mean, nan, nan};
+  }
+
+  double stddev = hdr_stddev(histogram_.get());
+  if (stddev == 0.0) return {mean, mean, mean};
+
+  // HdrHistogram computes population stddev (divides by N). The confidence
+  // interval requires sample variance (divides by N-1).
+  double variance = stddev * stddev * static_cast<double>(count) /
+                    static_cast<double>(count - 1);
+  double standard_error = std::sqrt(variance / static_cast<double>(count));
+  double alpha = 1.0 - confidence;
+  double t_crit = StudentTUpperQuantile(
+      alpha / 2.0, static_cast<double>(count - 1));
+  double margin = t_crit * standard_error;
+  return {mean, mean - margin, mean + margin};
+}
+
 Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
                                                 double confidence) const {
   auto do_welch = [&]() -> WelchTestResult {
@@ -370,7 +1160,7 @@ Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
 
     // Confidence interval on the difference of means.
     double alpha = 1.0 - confidence;
-    double t_crit = StudentTQuantile(1.0 - alpha / 2.0, df);
+    double t_crit = StudentTUpperQuantile(alpha / 2.0, df);
     double margin = t_crit * std::sqrt(se_sum);
     double diff = mean1 - mean2;
 
@@ -590,8 +1380,330 @@ Histogram::PercentileCIResult Histogram::PercentileCI(double percentile,
   return {value, lower_val, upper_val};
 }
 
+// Serialize the histogram to a CBOR (RFC 8949) byte sequence. There is no
+// standard for serializing histograms, so this format is specific to this
+// implementation. But, it has been designed to be compact, extensible, and
+// portable across languages and platforms. Should be easily parseable in
+// other languages with or without a CBOR library.
+//
+// The delta-encoded sparse counts is a space-saving optimization in the
+// common case.
+//
+// Layout: a CBOR map with integer keys:
+//   0  -> uint    format version (currently 1)
+//   1  -> uint    lowest discernible value
+//   2  -> uint    highest trackable value
+//   3  -> uint    significant figures
+//   4  -> uint    total count
+//   5  -> uint    min value
+//   6  -> uint    max value
+//   7  -> uint    normalizing index offset
+//   8  -> float64 conversion ratio
+//   9  -> uint    counts array length
+//   10 -> array   delta-encoded sparse counts as flat [delta, count, ...]
+//                 (first delta is the absolute index)
+//   11 -> map     EWMA state (omitted when alpha = 0):
+//        0 -> float64 alpha
+//        1 -> float64 mean
+//        2 -> float64 variance
+//        3 -> float64 error rate
+//        4 -> uint    threshold
+std::vector<uint8_t> Histogram::Export() const {
+  RwLock::ScopedReadLock lock(mutex_);
+
+  // Count non-zero buckets for the sparse encoding.
+  int32_t non_zero = 0;
+  for (int32_t i = 0; i < histogram_->counts_len; i++) {
+    if (histogram_->counts[i] != 0) non_zero++;
+  }
+
+  bool has_ewma = ewma_alpha_ > 0;
+  uint64_t map_size = has_ewma ? 12 : 11;
+
+  std::vector<uint8_t> out;
+  out.reserve(64 + non_zero * 10);
+
+  // Top-level map.
+  CborWriteUint(out, kCborMap, map_size);
+
+  // 0: version
+  CborWriteUint(out, kCborUint, kKeyVersion);
+  CborWriteUint(out, kCborUint, kExportVersion);
+  // 1: lowest
+  CborWriteUint(out, kCborUint, kKeyLowest);
+  CborWriteUint(out,
+                kCborUint,
+                static_cast<uint64_t>(histogram_->lowest_discernible_value));
+  // 2: highest
+  CborWriteUint(out, kCborUint, kKeyHighest);
+  CborWriteUint(out,
+                kCborUint,
+                static_cast<uint64_t>(histogram_->highest_trackable_value));
+  // 3: figures
+  CborWriteUint(out, kCborUint, kKeyFigures);
+  CborWriteUint(
+      out, kCborUint, static_cast<uint64_t>(histogram_->significant_figures));
+  // 4: total_count
+  CborWriteUint(out, kCborUint, kKeyTotalCount);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->total_count));
+  // 5: min
+  CborWriteUint(out, kCborUint, kKeyMin);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->min_value));
+  // 6: max
+  CborWriteUint(out, kCborUint, kKeyMax);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->max_value));
+  // 7: normalizing_index_offset
+  CborWriteUint(out, kCborUint, kKeyNormOffset);
+  CborWriteUint(out,
+                kCborUint,
+                static_cast<uint64_t>(histogram_->normalizing_index_offset));
+  // 8: conversion_ratio
+  CborWriteUint(out, kCborUint, kKeyConvRatio);
+  CborWriteFloat64(out, histogram_->conversion_ratio);
+  // 9: counts_len
+  CborWriteUint(out, kCborUint, kKeyCountsLen);
+  CborWriteUint(out, kCborUint, static_cast<uint64_t>(histogram_->counts_len));
+  // 10: sparse counts -- array of [delta, count, ...] pairs.
+  // Indices are delta-encoded: the first value is the absolute index,
+  // each subsequent value is the difference from the previous index.
+  CborWriteUint(out, kCborUint, kKeyCounts);
+  CborWriteUint(out, kCborArray, static_cast<uint64_t>(non_zero) * 2);
+  int32_t prev_idx = 0;
+  for (int32_t i = 0; i < histogram_->counts_len; i++) {
+    if (histogram_->counts[i] != 0) {
+      CborWriteUint(out, kCborUint, static_cast<uint64_t>(i - prev_idx));
+      CborWriteUint(
+          out, kCborUint, static_cast<uint64_t>(histogram_->counts[i]));
+      prev_idx = i;
+    }
+  }
+
+  // 11: EWMA state (optional)
+  if (has_ewma) {
+    CborWriteUint(out, kCborUint, kKeyEwma);
+    CborWriteUint(out, kCborMap, 5);
+    CborWriteUint(out, kCborUint, kEwmaAlpha);
+    CborWriteFloat64(out, ewma_alpha_);
+    CborWriteUint(out, kCborUint, kEwmaMean);
+    CborWriteFloat64(out, ewma_mean_);
+    CborWriteUint(out, kCborUint, kEwmaVariance);
+    CborWriteFloat64(out, ewma_variance_);
+    CborWriteUint(out, kCborUint, kEwmaErrorRate);
+    CborWriteFloat64(out, ewma_error_rate_);
+    CborWriteUint(out, kCborUint, kEwmaThreshold);
+    CborWriteUint(out, kCborUint, static_cast<uint64_t>(threshold_));
+  }
+
+  return out;
+}
+
+std::shared_ptr<Histogram> Histogram::Import(const uint8_t* data, size_t len) {
+  const uint8_t* p = data;
+  const uint8_t* end = data + len;
+
+  // Read top-level map header.
+  if (p >= end || (*p >> 5) != 5) return nullptr;  // Must be a map.
+  uint64_t map_size;
+  if (!CborReadUint(p, end, &map_size)) return nullptr;
+
+  int64_t lowest = 1;
+  int64_t highest = std::numeric_limits<int64_t>::max();
+  int figures = 3;
+  int64_t total_count = 0;
+  int64_t min_value = std::numeric_limits<int64_t>::max();
+  int64_t max_value = 0;
+  int32_t norm_offset = 0;
+  double conv_ratio = 1.0;
+  int32_t counts_len = 0;
+  uint64_t version = 0;
+
+  // Sparse counts storage.
+  std::vector<std::pair<int32_t, int64_t>> sparse_counts;
+
+  // EWMA state.
+  double ewma_alpha = 0;
+  double ewma_mean = 0;
+  double ewma_variance = 0;
+  double ewma_error_rate = 0;
+  int64_t threshold = 0;
+
+  for (uint64_t i = 0; i < map_size; i++) {
+    // Read key (unsigned int).
+    uint64_t key;
+    if (!CborReadUint(p, end, &key)) return nullptr;
+
+    switch (key) {
+      case kKeyVersion:
+        if (!CborReadUint(p, end, &version)) return nullptr;
+        if (version != kExportVersion) return nullptr;
+        break;
+      case kKeyLowest: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        lowest = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyHighest: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        highest = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyFigures: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        figures = static_cast<int>(v);
+        break;
+      }
+      case kKeyTotalCount: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        total_count = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyMin: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        min_value = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyMax: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        max_value = static_cast<int64_t>(v);
+        break;
+      }
+      case kKeyNormOffset: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        // Reject values that cannot be represented as int32_t; the
+        // static_cast below would wrap and produce an arbitrary offset.
+        if (v > static_cast<uint64_t>(std::numeric_limits<int32_t>::max()))
+          return nullptr;
+        norm_offset = static_cast<int32_t>(v);
+        break;
+      }
+      case kKeyConvRatio:
+        if (!CborReadNumber(p, end, &conv_ratio)) return nullptr;
+        break;
+      case kKeyCountsLen: {
+        uint64_t v;
+        if (!CborReadUint(p, end, &v)) return nullptr;
+        counts_len = static_cast<int32_t>(v);
+        break;
+      }
+      case kKeyCounts: {
+        // Array of flat [delta, count, ...] pairs. Indices are
+        // delta-encoded: accumulate to recover absolute indices.
+        if (p >= end || (*p >> 5) != 4) return nullptr;
+        uint64_t arr_len;
+        if (!CborReadUint(p, end, &arr_len)) return nullptr;
+        if (arr_len % 2 != 0) return nullptr;
+        // Each element needs at least 1 byte of CBOR encoding, so
+        // arr_len can't exceed the remaining buffer. Without this
+        // check, a crafted buffer claiming arr_len=2^60 would cause
+        // reserve() to OOM-crash before the loop catches the error.
+        if (arr_len > static_cast<uint64_t>(end - p)) return nullptr;
+        sparse_counts.reserve(static_cast<size_t>(arr_len / 2));
+        int32_t acc_idx = 0;
+        for (uint64_t j = 0; j < arr_len; j += 2) {
+          uint64_t delta, cnt;
+          if (!CborReadUint(p, end, &delta)) return nullptr;
+          if (!CborReadUint(p, end, &cnt)) return nullptr;
+          acc_idx += static_cast<int32_t>(delta);
+          sparse_counts.emplace_back(acc_idx, static_cast<int64_t>(cnt));
+        }
+        break;
+      }
+      case kKeyEwma: {
+        // Sub-map for EWMA state.
+        if (p >= end || (*p >> 5) != 5) return nullptr;
+        uint64_t sub_size;
+        if (!CborReadUint(p, end, &sub_size)) return nullptr;
+        for (uint64_t j = 0; j < sub_size; j++) {
+          uint64_t sub_key;
+          if (!CborReadUint(p, end, &sub_key)) return nullptr;
+          switch (sub_key) {
+            case kEwmaAlpha:
+              if (!CborReadNumber(p, end, &ewma_alpha)) return nullptr;
+              break;
+            case kEwmaMean:
+              if (!CborReadNumber(p, end, &ewma_mean)) return nullptr;
+              break;
+            case kEwmaVariance:
+              if (!CborReadNumber(p, end, &ewma_variance)) return nullptr;
+              break;
+            case kEwmaErrorRate:
+              if (!CborReadNumber(p, end, &ewma_error_rate)) return nullptr;
+              break;
+            case kEwmaThreshold: {
+              uint64_t v;
+              if (!CborReadUint(p, end, &v)) return nullptr;
+              threshold = static_cast<int64_t>(v);
+              break;
+            }
+            default:
+              return nullptr;  // Unknown EWMA key.
+          }
+        }
+        break;
+      }
+      default:
+        return nullptr;  // Unknown key.
+    }
+  }
+
+  // Reconstruct the histogram.
+  Options opts;
+  opts.lowest = lowest;
+  opts.highest = highest;
+  opts.figures = figures;
+  // Compute half_life from alpha: alpha = 1 - 2^(-1/halfLife)
+  // => halfLife = -1 / log2(1 - alpha)
+  if (ewma_alpha > 0 && ewma_alpha < 1) {
+    opts.half_life = -1.0 / std::log2(1.0 - ewma_alpha);
+  }
+  opts.threshold = threshold;
+
+  auto histogram = Histogram::Create(opts);
+  if (!histogram) return nullptr;
+
+  // Validate counts_len matches what the options produce.
+  if (histogram->histogram_->counts_len != counts_len) return nullptr;
+
+  // The normalization offset must index into the allocated counts array.
+  // normalize_index() in hdr_histogram.c applies at most one wrap
+  // adjustment of +/-counts_len, so any offset outside [0, counts_len)
+  // can leave normalized_index out of bounds and a later record() would
+  // perform an out-of-bounds write in counts_inc_normalised().
+  if (norm_offset < 0 || norm_offset >= counts_len) return nullptr;
+
+  // Restore counts directly.
+  for (const auto& [idx, cnt] : sparse_counts) {
+    if (idx < 0 || idx >= counts_len) return nullptr;
+    histogram->histogram_->counts[idx] = cnt;
+  }
+  histogram->histogram_->total_count = total_count;
+  histogram->histogram_->min_value = min_value;
+  histogram->histogram_->max_value = max_value;
+  histogram->histogram_->normalizing_index_offset = norm_offset;
+  histogram->histogram_->conversion_ratio = conv_ratio;
+
+  // Restore EWMA state.
+  if (ewma_alpha > 0) {
+    histogram->ewma_mean_ = ewma_mean;
+    histogram->ewma_variance_ = ewma_variance;
+    histogram->ewma_error_rate_ = ewma_error_rate;
+    histogram->ewma_initialized_ = true;
+  }
+
+  return histogram;
+}
+
 HistogramImpl::HistogramImpl(const Histogram::Options& options)
-    : histogram_(new Histogram(options)) {}
+    : histogram_(Histogram::Create(options)) {
+  CHECK(histogram_);
+}
 
 HistogramImpl::HistogramImpl(std::shared_ptr<Histogram> histogram)
     : histogram_(std::move(histogram)) {}
@@ -630,6 +1742,8 @@ CFunction HistogramBase::fast_record_(
     CFunction::Make(&HistogramBase::FastRecord));
 CFunction HistogramBase::fast_record_delta_(
     CFunction::Make(&HistogramBase::FastRecordDelta));
+CFunction SlidingWindowHistogram::fast_record_(
+    CFunction::Make(&SlidingWindowHistogram::FastRecord));
 CFunction IntervalHistogram::fast_start_(
     CFunction::Make(&IntervalHistogram::FastStart));
 CFunction IntervalHistogram::fast_stop_(
@@ -675,12 +1789,14 @@ void HistogramImpl::AddMethods(Isolate* isolate, Local<FunctionTemplate> tmpl) {
   SetProtoMethodNoSideEffect(isolate, tmpl, "percentilesAt", GetPercentilesAt);
   SetProtoMethodNoSideEffect(isolate, tmpl, "linearBuckets", GetLinearBuckets);
   SetProtoMethodNoSideEffect(isolate, tmpl, "logBuckets", GetLogBuckets);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "meanCI", GetMeanCI);
   SetProtoMethodNoSideEffect(isolate, tmpl, "welchTest", GetWelchTest);
   SetProtoMethodNoSideEffect(
       isolate, tmpl, "mannWhitneyTest", GetMannWhitneyTest);
   SetProtoMethodNoSideEffect(isolate, tmpl, "cohensD", GetCohensD);
   SetProtoMethodNoSideEffect(isolate, tmpl, "cliffsD", GetCliffsD);
   SetProtoMethodNoSideEffect(isolate, tmpl, "percentileCI", GetPercentileCI);
+  SetProtoMethod(isolate, tmpl, "qrde", GetQrde);
   SetFastMethodNoSideEffect(
       isolate, instance, "ewmaMean", GetEwmaMean, &fast_get_ewma_mean_);
   SetFastMethodNoSideEffect(
@@ -690,6 +1806,7 @@ void HistogramImpl::AddMethods(Isolate* isolate, Local<FunctionTemplate> tmpl) {
                             "ewmaErrorRate",
                             GetEwmaErrorRate,
                             &fast_get_ewma_error_rate_);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "export", DoExport);
   SetFastMethod(isolate, instance, "reset", DoReset, &fast_reset_);
 }
 
@@ -728,14 +1845,17 @@ void HistogramImpl::RegisterExternalReferences(
   registry->Register(GetPercentilesAt);
   registry->Register(GetLinearBuckets);
   registry->Register(GetLogBuckets);
+  registry->Register(GetMeanCI);
   registry->Register(GetWelchTest);
   registry->Register(GetMannWhitneyTest);
   registry->Register(GetCohensD);
   registry->Register(GetCliffsD);
   registry->Register(GetPercentileCI);
+  registry->Register(GetQrde);
   registry->Register(GetEwmaMean);
   registry->Register(GetEwmaStddev);
   registry->Register(GetEwmaErrorRate);
+  registry->Register(DoExport);
   registry->Register(fast_get_ewma_mean_);
   registry->Register(fast_get_ewma_stddev_);
   registry->Register(fast_get_ewma_error_rate_);
@@ -746,24 +1866,20 @@ void HistogramImpl::RegisterExternalReferences(
   is_registered = true;
 }
 
-HistogramBase::HistogramBase(
-    Environment* env,
-    Local<Object> wrap,
-    const Histogram::Options& options)
-    : BaseObject(env, wrap),
-      HistogramImpl(options) {
+HistogramBase::HistogramBase(Environment* env,
+                             Local<Object> wrap,
+                             const Histogram::Options& options)
+    : BaseObject(env, wrap), HistogramImpl(options) {
   MakeWeak();
   wrap->SetAlignedPointerInInternalField(
       HistogramImpl::InternalFields::kImplField,
       static_cast<HistogramImpl*>(this));
 }
 
-HistogramBase::HistogramBase(
-    Environment* env,
-    Local<Object> wrap,
-    std::shared_ptr<Histogram> histogram)
-    : BaseObject(env, wrap),
-      HistogramImpl(std::move(histogram)) {
+HistogramBase::HistogramBase(Environment* env,
+                             Local<Object> wrap,
+                             std::shared_ptr<Histogram> histogram)
+    : BaseObject(env, wrap), HistogramImpl(std::move(histogram)) {
   MakeWeak();
   wrap->SetAlignedPointerInInternalField(
       HistogramImpl::InternalFields::kImplField,
@@ -792,8 +1908,8 @@ void HistogramBase::Record(const FunctionCallbackInfo<Value>& args) {
   CHECK_IMPLIES(!args[0]->IsNumber(), args[0]->IsBigInt());
   bool lossless = true;
   int64_t value = args[0]->IsBigInt()
-      ? args[0].As<BigInt>()->Int64Value(&lossless)
-      : static_cast<int64_t>(args[0].As<Number>()->Value());
+                      ? args[0].As<BigInt>()->Int64Value(&lossless)
+                      : static_cast<int64_t>(args[0].As<Number>()->Value());
   if (!lossless || value < 1)
     return THROW_ERR_OUT_OF_RANGE(env, "value is out of range");
   HistogramBase* histogram;
@@ -856,8 +1972,7 @@ void HistogramBase::RecordCorrected(const FunctionCallbackInfo<Value>& args) {
 }
 
 BaseObjectPtr<HistogramBase> HistogramBase::Create(
-    Environment* env,
-    const Histogram::Options& options) {
+    Environment* env, const Histogram::Options& options) {
   Local<Object> obj;
   if (!GetConstructorTemplate(env->isolate_data())
            ->InstanceTemplate()
@@ -870,8 +1985,7 @@ BaseObjectPtr<HistogramBase> HistogramBase::Create(
 }
 
 BaseObjectPtr<HistogramBase> HistogramBase::Create(
-    Environment* env,
-    std::shared_ptr<Histogram> histogram) {
+    Environment* env, std::shared_ptr<Histogram> histogram) {
   Local<Object> obj;
   if (!GetConstructorTemplate(env->isolate_data())
            ->InstanceTemplate()
@@ -920,10 +2034,12 @@ void HistogramBase::New(const FunctionCallbackInfo<Value>& args) {
   if (args.Length() > 4 && args[4]->IsNumber()) {
     threshold = static_cast<int64_t>(args[4].As<Number>()->Value());
   }
-  new HistogramBase(
-      env,
-      args.This(),
+  auto histogram = Histogram::Create(
       Histogram::Options{lowest, highest, figures, half_life, threshold});
+  if (!histogram) {
+    return THROW_ERR_INVALID_ARG_VALUE(env, "Invalid histogram options");
+  }
+  new HistogramBase(env, args.This(), std::move(histogram));
 }
 
 Local<FunctionTemplate> HistogramBase::GetConstructorTemplate(
@@ -958,16 +2074,17 @@ void HistogramBase::RegisterExternalReferences(
   registry->Register(RecordCorrected);
   registry->Register(fast_record_);
   registry->Register(fast_record_delta_);
+  registry->Register(HistogramImpl::DoImport);
   HistogramImpl::RegisterExternalReferences(registry);
 }
 
 void HistogramBase::Initialize(IsolateData* isolate_data,
                                Local<ObjectTemplate> target) {
-  SetConstructorFunction(isolate_data->isolate(),
-                         target,
-                         "Histogram",
-                         GetConstructorTemplate(isolate_data),
-                         SetConstructorFunctionFlag::NONE);
+  Isolate* isolate = isolate_data->isolate();
+  Local<FunctionTemplate> tmpl = GetConstructorTemplate(isolate_data);
+  SetMethodNoSideEffect(isolate, tmpl, "import", HistogramImpl::DoImport);
+  SetConstructorFunction(
+      isolate, target, "Histogram", tmpl, SetConstructorFunctionFlag::NONE);
 }
 
 BaseObjectPtr<BaseObject> HistogramBase::HistogramTransferData::Deserialize(
@@ -986,6 +2103,254 @@ void HistogramBase::HistogramTransferData::MemoryInfo(
   tracker->TrackField("histogram", histogram_);
 }
 
+SlidingWindowHistogram::SlidingWindowHistogram(
+    Environment* env,
+    Local<Object> wrap,
+    const Histogram::Options& options,
+    size_t chunk_count,
+    bool time_based,
+    uint64_t rotate_at,
+    std::shared_ptr<Histogram> spare)
+    : BaseObject(env, wrap),
+      options_(options),
+      chunks_(chunk_count),
+      generations_(chunk_count, kNoGeneration),
+      spare_(std::move(spare)),
+      time_based_(time_based),
+      rotate_at_(rotate_at),
+      origin_(uv_hrtime()) {
+  MakeWeak();
+  external_memory_ = spare_->GetMemorySize();
+  env->external_memory_accounter()->Increase(env->isolate(), external_memory_);
+}
+
+SlidingWindowHistogram::~SlidingWindowHistogram() {
+  env()->external_memory_accounter()->Decrease(env()->isolate(),
+                                               external_memory_);
+}
+
+void SlidingWindowHistogram::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackField("chunks", chunks_);
+  tracker->TrackField("generations", generations_);
+  tracker->TrackField("spare", spare_);
+}
+
+uint64_t SlidingWindowHistogram::CurrentTimeGeneration() const {
+  const uint64_t now = uv_hrtime();
+  CHECK_GE(now, origin_);
+  return (now - origin_) / rotate_at_;
+}
+
+Histogram* SlidingWindowHistogram::GetChunk(uint64_t generation) {
+  const size_t index = generation % chunks_.size();
+  if (generations_[index] == generation) {
+    CHECK(chunks_[index]);
+    return chunks_[index].get();
+  }
+
+  if (chunks_[index]) {
+    chunks_[index]->Reset();
+  } else if (spare_) {
+    chunks_[index] = std::move(spare_);
+  } else {
+    chunks_[index] = Histogram::Create(options_);
+    if (!chunks_[index]) return nullptr;
+    const size_t size = chunks_[index]->GetMemorySize();
+    external_memory_ += size;
+    env()->external_memory_accounter()->Increase(env()->isolate(), size);
+  }
+
+  generations_[index] = generation;
+  return chunks_[index].get();
+}
+
+bool SlidingWindowHistogram::RecordValue(int64_t value) {
+  uint64_t generation;
+  if (time_based_) {
+    generation = CurrentTimeGeneration();
+  } else if (records_in_current_chunk_ == rotate_at_) {
+    CHECK_LT(current_generation_, kNoGeneration - 1);
+    generation = current_generation_ + 1;
+  } else {
+    generation = current_generation_;
+  }
+
+  Histogram* chunk = GetChunk(generation);
+  if (chunk == nullptr) return false;
+
+  chunk->Record(value);
+  if (!time_based_) {
+    if (generation != current_generation_) {
+      current_generation_ = generation;
+      records_in_current_chunk_ = 0;
+    }
+    records_in_current_chunk_++;
+    has_count_records_ = true;
+  }
+  return true;
+}
+
+std::shared_ptr<Histogram> SlidingWindowHistogram::CreateSnapshot() const {
+  std::shared_ptr<Histogram> snapshot = Histogram::Create(options_);
+  if (!snapshot) return {};
+
+  uint64_t current_generation;
+  if (time_based_) {
+    current_generation = CurrentTimeGeneration();
+  } else {
+    if (!has_count_records_) return snapshot;
+    current_generation = current_generation_;
+  }
+
+  for (size_t i = 0; i < chunks_.size(); i++) {
+    const uint64_t generation = generations_[i];
+    if (generation == kNoGeneration || generation > current_generation ||
+        current_generation - generation >= chunks_.size()) {
+      continue;
+    }
+    CHECK(chunks_[i]);
+    CHECK_EQ(snapshot->Add(*chunks_[i]), 0);
+  }
+  return snapshot;
+}
+
+void SlidingWindowHistogram::ResetWindow() {
+  std::fill(generations_.begin(), generations_.end(), kNoGeneration);
+  origin_ = uv_hrtime();
+  current_generation_ = 0;
+  records_in_current_chunk_ = 0;
+  has_count_records_ = false;
+}
+
+void SlidingWindowHistogram::New(const FunctionCallbackInfo<Value>& args) {
+  CHECK(args.IsConstructCall());
+  CHECK_IMPLIES(!args[0]->IsNumber(), args[0]->IsBigInt());
+  CHECK_IMPLIES(!args[1]->IsNumber(), args[1]->IsBigInt());
+  CHECK(args[2]->IsUint32());
+  CHECK(args[3]->IsUint32());
+  CHECK(args[4]->IsBoolean());
+  CHECK(args[5]->IsBigInt());
+
+  Environment* env = Environment::GetCurrent(args);
+  bool lossless = true;
+  int64_t lowest = 1;
+  int64_t highest = std::numeric_limits<int64_t>::max();
+
+  if (args[0]->IsNumber()) {
+    lowest = args[0].As<Integer>()->Value();
+  } else {
+    lowest = args[0].As<BigInt>()->Int64Value(&lossless);
+    if (!lossless)
+      return THROW_ERR_OUT_OF_RANGE(env, "options.lowest is out of range");
+  }
+
+  if (args[1]->IsNumber()) {
+    highest = args[1].As<Integer>()->Value();
+  } else {
+    highest = args[1].As<BigInt>()->Int64Value(&lossless);
+    if (!lossless)
+      return THROW_ERR_OUT_OF_RANGE(env, "options.highest is out of range");
+  }
+
+  const int figures = args[2].As<Uint32>()->Value();
+  const uint32_t chunk_count = args[3].As<Uint32>()->Value();
+  if (chunk_count == 0)
+    return THROW_ERR_OUT_OF_RANGE(env, "options.chunks is out of range");
+
+  lossless = true;
+  const uint64_t rotate_at = args[5].As<BigInt>()->Uint64Value(&lossless);
+  if (!lossless || rotate_at == 0) {
+    return THROW_ERR_OUT_OF_RANGE(env, "rotation interval is out of range");
+  }
+
+  Histogram::Options options{lowest, highest, figures};
+  std::shared_ptr<Histogram> spare = Histogram::Create(options);
+  if (!spare)
+    return THROW_ERR_INVALID_ARG_VALUE(env, "Invalid histogram options");
+
+  new SlidingWindowHistogram(env,
+                             args.This(),
+                             options,
+                             chunk_count,
+                             args[4]->IsTrue(),
+                             rotate_at,
+                             std::move(spare));
+}
+
+void SlidingWindowHistogram::Record(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_IMPLIES(!args[0]->IsNumber(), args[0]->IsBigInt());
+  bool lossless = true;
+  const int64_t value =
+      args[0]->IsBigInt() ? args[0].As<BigInt>()->Int64Value(&lossless)
+                          : static_cast<int64_t>(args[0].As<Number>()->Value());
+  if (!lossless || value < 1)
+    return THROW_ERR_OUT_OF_RANGE(env, "value is out of range");
+
+  SlidingWindowHistogram* histogram;
+  ASSIGN_OR_RETURN_UNWRAP(&histogram, args.This());
+  if (!histogram->RecordValue(value)) THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+}
+
+void SlidingWindowHistogram::FastRecord(Local<Value> receiver,
+                                        int64_t value,
+                                        // NOLINTNEXTLINE(runtime/references)
+                                        FastApiCallbackOptions& options) {
+  CHECK_GE(value, 1);
+  TRACK_V8_FAST_API_CALL("histogram.slidingWindow.record");
+  SlidingWindowHistogram* histogram;
+  ASSIGN_OR_RETURN_UNWRAP(&histogram, receiver);
+  if (!histogram->RecordValue(value)) {
+    HandleScope scope(options.isolate);
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(histogram->env());
+  }
+}
+
+void SlidingWindowHistogram::Snapshot(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  SlidingWindowHistogram* histogram;
+  ASSIGN_OR_RETURN_UNWRAP(&histogram, args.This());
+
+  std::shared_ptr<Histogram> snapshot = histogram->CreateSnapshot();
+  if (!snapshot) return THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+
+  BaseObjectPtr<HistogramBase> result =
+      HistogramBase::Create(env, std::move(snapshot));
+  if (result) args.GetReturnValue().Set(result->object());
+}
+
+void SlidingWindowHistogram::Reset(const FunctionCallbackInfo<Value>& args) {
+  SlidingWindowHistogram* histogram;
+  ASSIGN_OR_RETURN_UNWRAP(&histogram, args.This());
+  histogram->ResetWindow();
+}
+
+void SlidingWindowHistogram::Initialize(IsolateData* isolate_data,
+                                        Local<ObjectTemplate> target) {
+  Isolate* isolate = isolate_data->isolate();
+  Local<FunctionTemplate> tmpl = NewFunctionTemplate(isolate, New);
+  tmpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "SlidingWindowHistogram"));
+  auto instance = tmpl->InstanceTemplate();
+  instance->SetInternalFieldCount(BaseObject::kInternalFieldCount);
+  SetFastMethod(isolate, instance, "record", Record, &fast_record_);
+  SetProtoMethod(isolate, tmpl, "snapshot", Snapshot);
+  SetProtoMethod(isolate, tmpl, "reset", Reset);
+  SetConstructorFunction(isolate,
+                         target,
+                         "SlidingWindowHistogram",
+                         tmpl,
+                         SetConstructorFunctionFlag::NONE);
+}
+
+void SlidingWindowHistogram::RegisterExternalReferences(
+    ExternalReferenceRegistry* registry) {
+  registry->Register(New);
+  registry->Register(Record);
+  registry->Register(fast_record_);
+  registry->Register(Snapshot);
+  registry->Register(Reset);
+}
+
 Local<FunctionTemplate> IntervalHistogram::GetConstructorTemplate(
     Environment* env) {
   Local<FunctionTemplate> tmpl = env->intervalhistogram_constructor_template();
@@ -1034,8 +2399,9 @@ BaseObjectPtr<IntervalHistogram> IntervalHistogram::Create(
     AsyncWrap::ProviderType type) {
   Local<Object> obj;
   if (!GetConstructorTemplate(env)
-          ->InstanceTemplate()
-          ->NewInstance(env->context()).ToLocal(&obj)) {
+           ->InstanceTemplate()
+           ->NewInstance(env->context())
+           .ToLocal(&obj)) {
     return nullptr;
   }
 
@@ -1059,8 +2425,7 @@ void IntervalHistogram::MemoryInfo(MemoryTracker* tracker) const {
 void IntervalHistogram::OnStart(StartFlags flags) {
   if (enabled_ || IsHandleClosing()) return;
   enabled_ = true;
-  if (flags == StartFlags::RESET)
-    histogram()->Reset();
+  if (flags == StartFlags::RESET) histogram()->Reset();
   uv_timer_start(&timer_, TimerCB, interval_, interval_);
   uv_unref(reinterpret_cast<uv_handle_t*>(&timer_));
 }
@@ -1428,6 +2793,21 @@ void HistogramImpl::GetKsTest(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set((*histogram)->KsTest(*(other->histogram())));
 }
 
+void HistogramImpl::GetMeanCI(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsNumber());
+  double confidence = args[0].As<Number>()->Value();
+
+  auto result = (*histogram)->MeanCI(confidence);
+
+  Local<Value> values[] = {Number::New(isolate, result.mean),
+                           Number::New(isolate, result.lower),
+                           Number::New(isolate, result.upper)};
+  Local<Array> arr = Array::New(isolate, &values[0], arraysize(values));
+  args.GetReturnValue().Set(arr);
+}
+
 void HistogramImpl::GetWelchTest(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = args.GetIsolate();
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
@@ -1491,6 +2871,47 @@ void HistogramImpl::GetPercentileCI(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(arr);
 }
 
+void HistogramImpl::GetQrde(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsFloat64Array());
+  CHECK(args[1]->IsUint32());
+  CHECK(args[2]->IsBoolean());
+  Local<Float64Array> input = args[0].As<Float64Array>();
+  CHECK_GE(input->Length(), 2);
+  CHECK_LE(input->Length(), 1001);
+  auto backing = input->Buffer()->GetBackingStore();
+  const double* data = reinterpret_cast<const double*>(
+      static_cast<const char*>(backing->Data()) + input->ByteOffset());
+  std::vector<double> probabilities(data, data + input->Length());
+  const uint32_t dequantization = args[1].As<Uint32>()->Value();
+  CHECK_LE(dequantization, static_cast<uint32_t>(QrdeDequantization::kAll));
+  const bool cache_snapshot = args[2]->IsTrue();
+
+  Local<Promise::Resolver> resolver;
+  if (!Promise::Resolver::New(env->context()).ToLocal(&resolver)) return;
+
+  auto histogram_ptr = histogram->histogram();
+  auto snapshot_source =
+      histogram_ptr->GetRecordedSnapshotSource(cache_snapshot);
+  if (!snapshot_source.histogram && !snapshot_source.snapshot) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return;
+  }
+  std::shared_ptr<Histogram> cache_target;
+  if (cache_snapshot && !snapshot_source.cache_hit) {
+    cache_target = histogram_ptr;
+  }
+  auto* job = new QrdeJob(env,
+                          resolver,
+                          std::move(cache_target),
+                          std::move(snapshot_source),
+                          std::move(probabilities),
+                          static_cast<QrdeDequantization>(dequantization));
+  args.GetReturnValue().Set(resolver->GetPromise());
+  job->ScheduleWork();
+}
+
 void HistogramImpl::GetEwmaMean(const FunctionCallbackInfo<Value>& args) {
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
   args.GetReturnValue().Set((*histogram)->EwmaMean());
@@ -1524,6 +2945,46 @@ double HistogramImpl::FastGetEwmaErrorRate(Local<Value> receiver) {
   return (*histogram)->EwmaErrorRate();
 }
 
+void HistogramImpl::DoExport(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  std::vector<uint8_t> data = (*histogram)->Export();
+
+  auto store = ArrayBuffer::NewBackingStore(env->isolate(), data.size());
+  memcpy(store->Data(), data.data(), data.size());
+  auto buf = ArrayBuffer::New(env->isolate(), std::move(store));
+  auto arr = Uint8Array::New(buf, 0, data.size());
+  args.GetReturnValue().Set(arr);
+}
+
+void HistogramImpl::DoImport(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  if (!args[0]->IsUint8Array()) {
+    THROW_ERR_INVALID_ARG_TYPE(env, "data must be a Uint8Array");
+    return;
+  }
+  Local<Uint8Array> input = args[0].As<Uint8Array>();
+  auto backing = input->Buffer()->GetBackingStore();
+  const uint8_t* data =
+      static_cast<const uint8_t*>(backing->Data()) + input->ByteOffset();
+  size_t len = input->ByteLength();
+
+  auto histogram = Histogram::Import(data, len);
+  if (!histogram) {
+    THROW_ERR_INVALID_ARG_VALUE(env, "Invalid histogram export data");
+    return;
+  }
+
+  // Create a new HistogramBase wrapping the imported histogram.
+  Local<FunctionTemplate> tmpl =
+      HistogramBase::GetConstructorTemplate(env->isolate_data());
+  Local<Object> obj;
+  if (!tmpl->InstanceTemplate()->NewInstance(env->context()).ToLocal(&obj))
+    return;
+  new HistogramBase(env, obj, std::move(histogram));
+  args.GetReturnValue().Set(obj);
+}
+
 void HistogramImpl::GetPercentilesAt(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
@@ -1603,8 +3064,8 @@ std::unique_ptr<worker::TransferData> IterationHistogram::CloneForMessaging()
   return std::make_unique<HistogramBase::HistogramTransferData>(histogram());
 }
 
-std::unique_ptr<worker::TransferData>
-IntervalHistogram::CloneForMessaging() const {
+std::unique_ptr<worker::TransferData> IntervalHistogram::CloneForMessaging()
+    const {
   return std::make_unique<HistogramBase::HistogramTransferData>(histogram());
 }
 
diff --git a/src/histogram.h b/src/histogram.h
index 31a2e9833d3e..bc72fa36e104 100644
--- a/src/histogram.h
+++ b/src/histogram.h
@@ -12,6 +12,7 @@
 #include "v8.h"
 
 #include <limits>
+#include <vector>
 
 namespace node {
 
@@ -36,7 +37,31 @@ class Histogram : public MemoryRetainer {
                             // exceeding this threshold.
   };
 
-  explicit Histogram(const Options& options);
+  struct RecordedBucket {
+    double value;
+    double resolution;
+    int64_t count;
+    int64_t cumulative_count;
+  };
+
+  struct RecordedSnapshot {
+    std::vector<RecordedBucket> buckets;
+    int64_t total_count = 0;
+  };
+
+  using HistogramPointer = DeleteFnPtr<hdr_histogram, hdr_close>;
+
+  struct RecordedSnapshotSource {
+    HistogramPointer histogram;
+    std::shared_ptr<const RecordedSnapshot> snapshot;
+    uint64_t generation = 0;
+    bool cache_hit = false;
+  };
+
+  // Factory method that returns nullptr on hdr_init failure.
+  static std::shared_ptr<Histogram> Create(const Options& options);
+
+  Histogram(HistogramPointer histogram, const Options& options);
   virtual ~Histogram() = default;
 
   inline bool Record(int64_t value);
@@ -74,7 +99,13 @@ class Histogram : public MemoryRetainer {
                      int64_t* values,
                      size_t length) const;
 
-  // Statistical hypothesis testing
+  // Statistical analysis
+  struct MeanCIResult {
+    double mean;
+    double lower;
+    double upper;
+  };
+
   struct WelchTestResult {
     double t_statistic;
     double degrees_of_freedom;
@@ -95,6 +126,7 @@ class Histogram : public MemoryRetainer {
     int64_t upper;
   };
 
+  MeanCIResult MeanCI(double confidence = 0.95) const;
   WelchTestResult WelchTest(const Histogram& other,
                             double confidence = 0.95) const;
   MannWhitneyResult MannWhitneyTest(const Histogram& other) const;
@@ -103,6 +135,10 @@ class Histogram : public MemoryRetainer {
   PercentileCIResult PercentileCI(double percentile,
                                   double confidence = 0.95) const;
 
+  // CBOR-encoded export/import for histogram exchange.
+  std::vector<uint8_t> Export() const;
+  static std::shared_ptr<Histogram> Import(const uint8_t* data, size_t len);
+
   inline bool RecordCorrected(int64_t value, int64_t expected_interval);
 
   template <typename Iterator>
@@ -112,6 +148,10 @@ class Histogram : public MemoryRetainer {
   void LogBuckets(int64_t first_bucket, double log_base, Iterator&& fn) const;
 
   bool IsCompatible(const Histogram& other) const;
+  RecordedSnapshotSource GetRecordedSnapshotSource(bool use_cache) const;
+  static RecordedSnapshot BuildRecordedSnapshot(const hdr_histogram* histogram);
+  void CacheRecordedSnapshot(uint64_t generation,
+                             std::shared_ptr<const RecordedSnapshot> snapshot);
 
   void MemoryInfo(MemoryTracker* tracker) const override;
   SET_MEMORY_INFO_NAME(Histogram)
@@ -119,8 +159,9 @@ class Histogram : public MemoryRetainer {
 
  private:
   inline void UpdateEwma(double value);
+  inline void InvalidateRecordedSnapshot();
+  size_t GetCachedRecordedSnapshotMemorySize() const;
 
-  using HistogramPointer = DeleteFnPtr<hdr_histogram, hdr_close>;
   HistogramPointer histogram_;
   uint64_t prev_ = 0;
   size_t exceeds_ = 0;
@@ -135,6 +176,9 @@ class Histogram : public MemoryRetainer {
   int64_t threshold_ = 0;
   double ewma_error_rate_ = 0;
 
+  uint64_t mutation_generation_ = 0;
+  std::shared_ptr<const RecordedSnapshot> recorded_snapshot_cache_;
+
   RwLock mutex_;
 };
 
@@ -180,15 +224,19 @@ class HistogramImpl {
   static void GetPercentilesAt(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLinearBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLogBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMeanCI(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetWelchTest(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetMannWhitneyTest(
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetCohensD(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetCliffsD(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetPercentileCI(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetQrde(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetEwmaMean(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetEwmaStddev(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetEwmaErrorRate(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoExport(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void DoImport(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static void FastReset(v8::Local<v8::Value> receiver);
   static double FastGetCount(v8::Local<v8::Value> receiver);
@@ -312,6 +360,60 @@ class HistogramBase final : public BaseObject, public HistogramImpl {
   static v8::CFunction fast_record_delta_;
 };
 
+// BaseObject disallows cloning and transfer, so ring state is confined to the
+// owning Environment's thread.
+class SlidingWindowHistogram final : public BaseObject {
+ public:
+  static void Initialize(IsolateData* isolate_data,
+                         v8::Local<v8::ObjectTemplate> target);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(SlidingWindowHistogram)
+  SET_SELF_SIZE(SlidingWindowHistogram)
+
+ private:
+  static constexpr uint64_t kNoGeneration =
+      std::numeric_limits<uint64_t>::max();
+
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Record(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void FastRecord(v8::Local<v8::Value> receiver,
+                         int64_t value,
+                         v8::FastApiCallbackOptions& options);
+  static void Snapshot(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Reset(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  SlidingWindowHistogram(Environment* env,
+                         v8::Local<v8::Object> wrap,
+                         const Histogram::Options& options,
+                         size_t chunk_count,
+                         bool time_based,
+                         uint64_t rotate_at,
+                         std::shared_ptr<Histogram> spare);
+  ~SlidingWindowHistogram() override;
+
+  Histogram* GetChunk(uint64_t generation);
+  bool RecordValue(int64_t value);
+  std::shared_ptr<Histogram> CreateSnapshot() const;
+  void ResetWindow();
+  uint64_t CurrentTimeGeneration() const;
+
+  Histogram::Options options_;
+  std::vector<std::shared_ptr<Histogram>> chunks_;
+  std::vector<uint64_t> generations_;
+  std::shared_ptr<Histogram> spare_;
+  bool time_based_;
+  uint64_t rotate_at_;
+  uint64_t origin_;
+  uint64_t current_generation_ = 0;
+  uint64_t records_in_current_chunk_ = 0;
+  size_t external_memory_ = 0;
+  bool has_count_records_ = false;
+
+  static v8::CFunction fast_record_;
+};
+
 // CRTP mixin for HandleWrap-based histograms with start/stop support.
 // Provides: StartFlags enum, Start/Stop slow-path handlers, enabled_ flag,
 // and InitTemplate (shared GetConstructorTemplate body).
diff --git a/src/inspector_agent.cc b/src/inspector_agent.cc
index 1f86e4bfc265..31277a74d1f3 100644
--- a/src/inspector_agent.cc
+++ b/src/inspector_agent.cc
@@ -70,19 +70,18 @@ using v8_inspector::V8InspectorClient;
 #ifdef __POSIX__
 static uv_sem_t start_io_thread_semaphore;
 #endif  // __POSIX__
-static uv_async_t start_io_thread_async;
-// This is just an additional check to make sure start_io_thread_async
-// is not accidentally re-used or used when uninitialized.
-static std::atomic_bool start_io_thread_async_initialized { false };
-// Protects the Agent* stored in start_io_thread_async.data.
-static Mutex start_io_thread_async_mutex;
-
-// Called on the main thread.
-void StartIoThreadAsyncCallback(uv_async_t* handle) {
-  static_cast<Agent*>(handle->data)->StartIoThread();
+// Agents that asked for the debug signal handler; SIGUSR1 (or the Windows
+// remote thread) starts the io thread of each. The mutex also guards the
+// once-per-process watchdog setup.
+static Mutex start_io_thread_agents_mutex;
+static std::vector<Agent*> start_io_thread_agents;
+static bool debug_signal_handler_started = false;
+
+static void RequestIoThreadStartOnAgents() {
+  Mutex::ScopedLock lock(start_io_thread_agents_mutex);
+  for (Agent* agent : start_io_thread_agents) agent->RequestIoThreadStart();
 }
 
-
 #ifdef __POSIX__
 static void StartIoThreadWakeup(int signo, siginfo_t* info, void* ucontext) {
   uv_sem_post(&start_io_thread_semaphore);
@@ -92,16 +91,11 @@ inline void* StartIoThreadMain(void* unused) {
   uv_thread_setname("SignalInspector");
   for (;;) {
     uv_sem_wait(&start_io_thread_semaphore);
-    Mutex::ScopedLock lock(start_io_thread_async_mutex);
-
-    CHECK(start_io_thread_async_initialized);
-    Agent* agent = static_cast<Agent*>(start_io_thread_async.data);
-    if (agent != nullptr)
-      agent->RequestIoThreadStart();
+    RequestIoThreadStartOnAgents();
   }
 }
 
-static int StartDebugSignalHandler() {
+static int StartWatchdogThread() {
   // Start a watchdog thread for calling v8::Debug::DebugBreak() because
   // it's not safe to call directly from the signal handler, it can
   // deadlock with the thread it interrupts.
@@ -136,14 +130,28 @@ static int StartDebugSignalHandler() {
     fprintf(stderr, "node[%u]: pthread_create: %s\n",
             uv_os_getpid(), strerror(err));
     fflush(stderr);
-    // Leave SIGUSR1 blocked.  We don't install a signal handler,
-    // receiving the signal would terminate the process.
+    uv_sem_destroy(&start_io_thread_semaphore);
     return -err;
   }
   RegisterSignalHandler(SIGUSR1, StartIoThreadWakeup);
   // Restore original mask
   CHECK_EQ(0, pthread_sigmask(SIG_SETMASK, &sigmask, nullptr));
-  // Unblock SIGUSR1.  A pending SIGUSR1 signal will now be delivered.
+  return 0;
+}
+
+static int StartDebugSignalHandler() {
+  {
+    Mutex::ScopedLock lock(start_io_thread_agents_mutex);
+    if (!debug_signal_handler_started) {
+      // Leave SIGUSR1 blocked on failure. We don't install a signal handler,
+      // receiving the signal would terminate the process.
+      if (int err = StartWatchdogThread()) return err;
+      debug_signal_handler_started = true;
+    }
+  }
+  // Unblock SIGUSR1 on this thread; PlatformInit() left it blocked. A pending
+  // SIGUSR1 signal will now be delivered.
+  sigset_t sigmask;
   sigemptyset(&sigmask);
   sigaddset(&sigmask, SIGUSR1);
   CHECK_EQ(0, pthread_sigmask(SIG_UNBLOCK, &sigmask, nullptr));
@@ -154,11 +162,7 @@ static int StartDebugSignalHandler() {
 
 #ifdef _WIN32
 DWORD WINAPI StartIoThreadProc(void* arg) {
-  Mutex::ScopedLock lock(start_io_thread_async_mutex);
-  CHECK(start_io_thread_async_initialized);
-  Agent* agent = static_cast<Agent*>(start_io_thread_async.data);
-  if (agent != nullptr)
-    agent->RequestIoThreadStart();
+  RequestIoThreadStartOnAgents();
   return 0;
 }
 
@@ -168,6 +172,9 @@ static int GetDebugSignalHandlerMappingName(DWORD pid, wchar_t* buf,
 }
 
 static int StartDebugSignalHandler() {
+  Mutex::ScopedLock lock(start_io_thread_agents_mutex);
+  if (debug_signal_handler_started) return 0;
+  debug_signal_handler_started = true;
   wchar_t mapping_name[32];
   HANDLE mapping_handle;
   DWORD pid;
@@ -800,7 +807,9 @@ class NodeInspectorClient : public V8InspectorClient {
   }
 
   double currentTimeMS() override {
-    return env_->isolate_data()->platform()->CurrentClockTimeMillis();
+    MultiIsolatePlatform* platform = env_->isolate_data()->platform();
+    if (platform == nullptr) return GetCurrentTimeInMicroseconds() / 1000;
+    return platform->CurrentClockTimeMillis();
   }
 
   std::unique_ptr<StringBuffer> resourceNameToUrl(
@@ -835,7 +844,21 @@ Agent::Agent(Environment* env)
       debug_options_(env->options()->debug_options()),
       host_port_(env->inspector_host_port()) {}
 
-Agent::~Agent() = default;
+Agent::~Agent() {
+  StopAcceptingIoThreadStarts();
+}
+
+void Agent::StopAcceptingIoThreadStarts() {
+  if (start_io_thread_async_ == nullptr) return;
+  {
+    Mutex::ScopedLock lock(start_io_thread_agents_mutex);
+    std::erase(start_io_thread_agents, this);
+  }
+  parent_env_->RemoveCleanupHook(StopAcceptingIoThreadStartsHook, this);
+  parent_env_->CloseHandle(start_io_thread_async_,
+                           [](uv_async_t* handle) { delete handle; });
+  start_io_thread_async_ = nullptr;
+}
 
 bool Agent::Start(const std::string& path,
                   const DebugOptions& options,
@@ -847,33 +870,25 @@ bool Agent::Start(const std::string& path,
   host_port_ = host_port;
 
   client_ = std::make_shared<NodeInspectorClient>(parent_env_, is_main);
-  if (parent_env_->owns_inspector()) {
-    Mutex::ScopedLock lock(start_io_thread_async_mutex);
-    CHECK_EQ(start_io_thread_async_initialized.exchange(true), false);
-    CHECK_EQ(0, uv_async_init(parent_env_->event_loop(),
-                              &start_io_thread_async,
-                              StartIoThreadAsyncCallback));
-    uv_unref(reinterpret_cast<uv_handle_t*>(&start_io_thread_async));
-    start_io_thread_async.data = this;
-    if (parent_env_->should_start_debug_signal_handler()) {
-      // Ignore failure, SIGUSR1 won't work, but that should not block node
-      // start.
-      StartDebugSignalHandler();
+  if (parent_env_->owns_inspector() &&
+      parent_env_->should_start_debug_signal_handler()) {
+    start_io_thread_async_ = new uv_async_t;
+    start_io_thread_async_->data = this;
+    CHECK_EQ(0,
+             uv_async_init(parent_env_->event_loop(),
+                           start_io_thread_async_,
+                           [](uv_async_t* handle) {
+                             static_cast<Agent*>(handle->data)->StartIoThread();
+                           }));
+    uv_unref(reinterpret_cast<uv_handle_t*>(start_io_thread_async_));
+    {
+      Mutex::ScopedLock lock(start_io_thread_agents_mutex);
+      start_io_thread_agents.push_back(this);
     }
-
-    parent_env_->AddCleanupHook([](void* data) {
-      Environment* env = static_cast<Environment*>(data);
-
-      {
-        Mutex::ScopedLock lock(start_io_thread_async_mutex);
-        start_io_thread_async.data = nullptr;
-      }
-
-      // This is global, will never get freed
-      env->CloseHandle(&start_io_thread_async, [](uv_async_t*) {
-        CHECK(start_io_thread_async_initialized.exchange(false));
-      });
-    }, parent_env_);
+    parent_env_->AddCleanupHook(StopAcceptingIoThreadStartsHook, this);
+    // Ignore failure, SIGUSR1 won't work, but that should not block node
+    // start.
+    StartDebugSignalHandler();
   }
 
   AtExit(parent_env_, [](void* env) {
@@ -1152,6 +1167,10 @@ void Agent::AllAsyncTasksCanceled() {
   client_->AllAsyncTasksCanceled();
 }
 
+void Agent::StopAcceptingIoThreadStartsHook(void* agent) {
+  static_cast<Agent*>(agent)->StopAcceptingIoThreadStarts();
+}
+
 void Agent::RequestIoThreadStart() {
   // We need to attempt to interrupt V8 flow (in case Node is running
   // continuous JS code) and to wake up libuv thread (in case Node is waiting
@@ -1159,14 +1178,10 @@ void Agent::RequestIoThreadStart() {
   if (!options().allow_attaching_debugger) {
     return;
   }
-  CHECK(start_io_thread_async_initialized);
-  uv_async_send(&start_io_thread_async);
   parent_env_->RequestInterrupt([this](Environment*) {
     StartIoThread();
   });
-
-  CHECK(start_io_thread_async_initialized);
-  uv_async_send(&start_io_thread_async);
+  uv_async_send(start_io_thread_async_);
 }
 
 void Agent::ContextCreated(Local<Context> context, const ContextInfo& info) {
diff --git a/src/inspector_agent.h b/src/inspector_agent.h
index 932e4e8dce89..5a1d1de26547 100644
--- a/src/inspector_agent.h
+++ b/src/inspector_agent.h
@@ -8,6 +8,7 @@
 #endif
 
 #include "node_options.h"
+#include "uv.h"
 #include "v8.h"
 
 #include <cstddef>
@@ -117,7 +118,8 @@ class Agent {
   // Can only be called from the main thread.
   bool StartIoThread();
 
-  // Calls StartIoThread() from off the main thread.
+  // Calls StartIoThread() from off the main thread. Only valid while the
+  // Environment owns the inspector and has not started cleanup.
   void RequestIoThreadStart();
 
   const DebugOptions& options() { return debug_options_; }
@@ -156,6 +158,12 @@ class Agent {
   bool async_hook_enabled_ = false;
   bool syncing_async_hook_state_ = false;
 
+  // Woken by the SIGUSR1 watchdog; closed by the cleanup hook or ~Agent(),
+  // whichever runs first, and freed by its close callback.
+  uv_async_t* start_io_thread_async_ = nullptr;
+  void StopAcceptingIoThreadStarts();
+  static void StopAcceptingIoThreadStartsHook(void* agent);
+
   bool network_tracking_enabled_ = false;
   bool pending_enable_network_tracking = false;
   bool pending_disable_network_tracking = false;
diff --git a/src/js_native_api.h b/src/js_native_api.h
index d2375ecd3248..2a36c4e3ddf3 100644
--- a/src/js_native_api.h
+++ b/src/js_native_api.h
@@ -55,8 +55,8 @@ NAPI_EXTERN napi_status NAPI_CDECL napi_create_object(napi_env env,
 NAPI_EXTERN napi_status NAPI_CDECL
 node_api_create_object_with_properties(napi_env env,
                                        napi_value prototype_or_null,
-                                       napi_value* property_names,
-                                       napi_value* property_values,
+                                       const napi_value* property_names,
+                                       const napi_value* property_values,
                                        size_t property_count,
                                        napi_value* result);
 #endif  // NAPI_EXPERIMENTAL
diff --git a/src/js_native_api_v8.cc b/src/js_native_api_v8.cc
index 75ce4c921b5a..5c4a7b611888 100644
--- a/src/js_native_api_v8.cc
+++ b/src/js_native_api_v8.cc
@@ -1615,8 +1615,8 @@ napi_status NAPI_CDECL napi_create_object(napi_env env, napi_value* result) {
 napi_status NAPI_CDECL
 node_api_create_object_with_properties(napi_env env,
                                        napi_value prototype_or_null,
-                                       napi_value* property_names,
-                                       napi_value* property_values,
+                                       const napi_value* property_names,
+                                       const napi_value* property_values,
                                        size_t property_count,
                                        napi_value* result) {
   CHECK_ENV_NOT_IN_GC(env);
diff --git a/src/node.cc b/src/node.cc
index 838106acff8f..92c5fd8cb66f 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -786,8 +786,10 @@ static ExitCode ProcessGlobalArgsInternal(std::vector<std::string>* args,
     v8_args.emplace_back("--js-source-phase-imports");
   }
 
+#if V8_ENABLE_WEBASSEMBLY
   // WebAssembly JS Promise Integration
   v8_args.emplace_back("--experimental-wasm-jspi");
+#endif  // V8_ENABLE_WEBASSEMBLY
 
 #ifdef __POSIX__
   // Block SIGPROF signals when sleeping in epoll_wait/kevent/etc.  Avoids the
@@ -1144,7 +1146,8 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     }
   }
 
-  if (!per_process::cli_options->run.empty()) {
+  // A bare `--run` (empty value) lists the available scripts; a value runs it.
+  if (per_process::cli_options->has_run) {
     auto positional_args = task_runner::GetPositionalArgs(args);
     result->early_return_ = true;
     task_runner::RunTask(
@@ -1232,6 +1235,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     }
 
     OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
+    CHECK_NOT_NULL(settings);
     OPENSSL_INIT_set_config_filename(settings, conf_file);
     OPENSSL_INIT_set_config_appname(settings, conf_section_name);
     OPENSSL_INIT_set_config_file_flags(settings,
@@ -1261,6 +1265,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
       result->errors_.emplace_back(std::move(*fips_error));
       return result;
     }
+    crypto::InstallFipsIndicatorCallback();
 
     // Ensure CSPRNG is properly seeded.
     CHECK(ncrypto::CSPRNG(nullptr, 0));
diff --git a/src/node.h b/src/node.h
index d922352b1941..9f9ba48eb8e2 100644
--- a/src/node.h
+++ b/src/node.h
@@ -239,8 +239,10 @@ enum Flags : uint32_t {
   kNoICU = 1 << 3,
   // Do not modify stdio file descriptor or TTY state.
   kNoStdioInitialization = 1 << 4,
-  // Do not register Node.js-specific signal handlers
-  // and reset other signal handlers to default state.
+  // Do not register Node.js-specific signal handlers, reset other signal
+  // handlers to default state, or replace the calling thread's signal mask
+  // (without this flag, POSIX builds with the inspector set it to block
+  // SIGUSR1 and nothing else).
   kNoDefaultSignalHandling = 1 << 5,
   // Do not perform V8 initialization.
   kNoInitializeV8 = 1 << 6,
@@ -884,6 +886,9 @@ NODE_EXTERN v8::MaybeLocal<v8::Value> LoadEnvironment(
     const ModuleData* entry_point,
     EmbedderPreloadCallback preload = nullptr);
 
+// Runs `env`'s event loop until its handles have closed, with JavaScript
+// execution disallowed on the isolate; see doc/api/embedding.md if that loop
+// is shared with other Environments.
 NODE_EXTERN void FreeEnvironment(Environment* env);
 
 // Set a callback that is called when process.exit() is called from JS,
@@ -1019,6 +1024,9 @@ class NODE_EXTERN CommonEnvironmentSetup {
   // will be empty.
   // env_args will be passed through as arguments to CreateEnvironment(), after
   // `isolate_data` and `context`.
+  // `snapshot_data` has to stay alive as long as the setup created from it,
+  // and every setup in a process has to use the same snapshot: all isolates
+  // are created from the blob the first one used.
   template <typename... EnvironmentArgs>
   static std::unique_ptr<CommonEnvironmentSetup> Create(
       MultiIsolatePlatform* platform,
diff --git a/src/node_blob.cc b/src/node_blob.cc
index d05a693120f2..ef1482037138 100644
--- a/src/node_blob.cc
+++ b/src/node_blob.cc
@@ -110,9 +110,12 @@ void BlobFromFilePath(const FunctionCallbackInfo<Value>& args) {
   ToNamespacedPath(env, &path);
   THROW_IF_INSUFFICIENT_PERMISSIONS(
       env, permission::PermissionScope::kFileSystemRead, path.ToStringView());
-  auto entry = DataQueue::CreateFdEntry(env, args[0]);
+  int status = 0;
+  auto entry = DataQueue::CreateFdEntry(env, args[0], &status);
   if (entry == nullptr) {
-    return THROW_ERR_INVALID_ARG_VALUE(env, "Unable to open file as blob");
+    // The file could not be stat'd. Report the libuv error so callers can tell
+    // ENOENT apart from any other reason the path could not be used.
+    return env->ThrowUVException(status, "stat", nullptr, *path);
   }
 
   std::vector<std::unique_ptr<DataQueue::Entry>> entries;
@@ -420,20 +423,16 @@ void Blob::Reader::SetWakeup(const FunctionCallbackInfo<Value>& args) {
   reader->wakeup_.Reset(args.GetIsolate(), args[0].As<Function>());
 }
 
-void Blob::Reader::NotifyPull(bool fin) {
+void Blob::Reader::NotifyPull() {
   if (wakeup_.IsEmpty() || !env()->can_call_into_js()) return;
-  // FIN notifications always fire — they must not be suppressed by
-  // pull_pending_ because there will be no further notifications to
-  // wake the iterator. Regular data notifications respect pull_pending_
-  // to coalesce multiple deliveries within a single packet.
-  if (!fin && pull_pending_) return;
+  // Coalesce notifications: if a wakeup is already pending and the reader
+  // has not yet pulled, skip re-notifying to avoid redundant wakeups
+  // within a single packet.
+  if (pull_pending_) return;
   pull_pending_ = true;
   HandleScope handle_scope(env()->isolate());
   Local<Function> fn = wakeup_.Get(env()->isolate());
-  // Pass fin as the first argument so the JS iterator knows EOS is
-  // imminent and should pull again without waiting for another wakeup.
-  Local<Value> argv[] = {v8::Boolean::New(env()->isolate(), fin)};
-  MakeCallback(fn, 1, argv);
+  MakeCallback(fn, 0, nullptr);
 }
 
 BaseObjectPtr<BaseObject> Blob::BlobTransferData::Deserialize(
diff --git a/src/node_blob.h b/src/node_blob.h
index e782b96594b5..06d3a151cfa5 100644
--- a/src/node_blob.h
+++ b/src/node_blob.h
@@ -82,7 +82,7 @@ class Blob : public BaseObject {
                                         BaseObjectPtr<Blob> blob);
     static void Pull(const v8::FunctionCallbackInfo<v8::Value>& args);
     static void SetWakeup(const v8::FunctionCallbackInfo<v8::Value>& args);
-    void NotifyPull(bool fin = false);
+    void NotifyPull();
 
     explicit Reader(Environment* env,
                     v8::Local<v8::Object> obj,
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 7d52d835ca4c..99cb556ecd9b 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -48,9 +48,11 @@ namespace crypto {
   V(Hmac)                                                                      \
   V(Keygen)                                                                    \
   V(Keys)                                                                      \
+  V(Mac)                                                                       \
   V(NativeCryptoKey)                                                           \
   V(NativeKeyObject)                                                           \
   V(PBKDF2Job)                                                                 \
+  V(PKCS12Parser)                                                              \
   V(Random)                                                                    \
   V(RSAAlg)                                                                    \
   V(SecureContext)                                                             \
diff --git a/src/node_crypto.h b/src/node_crypto.h
index 3bb95cb340d2..e15e5958808c 100644
--- a/src/node_crypto.h
+++ b/src/node_crypto.h
@@ -48,7 +48,9 @@
 #endif
 #include "crypto/crypto_keygen.h"
 #include "crypto/crypto_keys.h"
+#include "crypto/crypto_mac.h"
 #include "crypto/crypto_pbkdf2.h"
+#include "crypto/crypto_pkcs12.h"
 #include "crypto/crypto_pqc.h"
 #include "crypto/crypto_random.h"
 #include "crypto/crypto_rsa.h"
diff --git a/src/node_diagnostics_channel.cc b/src/node_diagnostics_channel.cc
index ab67e6d7c5fa..d12f7d54c5f0 100644
--- a/src/node_diagnostics_channel.cc
+++ b/src/node_diagnostics_channel.cc
@@ -127,10 +127,38 @@ void BindingData::Deserialize(Local<Context> context,
   CHECK_NOT_NULL(binding);
 }
 
+void BindingData::SetChannelStatusCallback(uint32_t index,
+                                           ChannelStatusCallback cb) {
+  channel_status_callbacks_[index] = std::move(cb);
+}
+
+void BindingData::NotifyChannelActive(const FunctionCallbackInfo<Value>& args) {
+  Realm* realm = Realm::GetCurrent(args);
+  BindingData* binding = realm->GetBindingData<BindingData>();
+  if (binding == nullptr) return;
+  CHECK(args[0]->IsUint32());
+  uint32_t index = args[0].As<v8::Uint32>()->Value();
+  auto it = binding->channel_status_callbacks_.find(index);
+  if (it != binding->channel_status_callbacks_.end()) it->second(true);
+}
+
+void BindingData::NotifyChannelInactive(
+    const FunctionCallbackInfo<Value>& args) {
+  Realm* realm = Realm::GetCurrent(args);
+  BindingData* binding = realm->GetBindingData<BindingData>();
+  if (binding == nullptr) return;
+  CHECK(args[0]->IsUint32());
+  uint32_t index = args[0].As<v8::Uint32>()->Value();
+  auto it = binding->channel_status_callbacks_.find(index);
+  if (it != binding->channel_status_callbacks_.end()) it->second(false);
+}
+
 void BindingData::CreatePerIsolateProperties(IsolateData* isolate_data,
                                              Local<ObjectTemplate> target) {
   Isolate* isolate = isolate_data->isolate();
   SetMethod(isolate, target, "linkNativeChannel", LinkNativeChannel);
+  SetMethod(isolate, target, "notifyChannelActive", NotifyChannelActive);
+  SetMethod(isolate, target, "notifyChannelInactive", NotifyChannelInactive);
 }
 
 void BindingData::CreatePerContextProperties(Local<Object> target,
@@ -145,6 +173,8 @@ void BindingData::CreatePerContextProperties(Local<Object> target,
 void BindingData::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(LinkNativeChannel);
+  registry->Register(NotifyChannelActive);
+  registry->Register(NotifyChannelInactive);
 }
 
 Channel::Channel(Environment* env,
diff --git a/src/node_diagnostics_channel.h b/src/node_diagnostics_channel.h
index ca68e75a4361..c8c1a79994b2 100644
--- a/src/node_diagnostics_channel.h
+++ b/src/node_diagnostics_channel.h
@@ -4,6 +4,7 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include <cinttypes>
+#include <functional>
 #include <string>
 #include <unordered_map>
 #include <vector>
@@ -52,6 +53,14 @@ class BindingData : public SnapshotableObject {
   static void LinkNativeChannel(
       const v8::FunctionCallbackInfo<v8::Value>& args);
 
+  using ChannelStatusCallback = std::function<void(bool is_active)>;
+  void SetChannelStatusCallback(uint32_t index, ChannelStatusCallback cb);
+
+  static void NotifyChannelActive(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void NotifyChannelInactive(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
+
   static void CreatePerIsolateProperties(IsolateData* isolate_data,
                                          v8::Local<v8::ObjectTemplate> target);
   static void CreatePerContextProperties(v8::Local<v8::Object> target,
@@ -62,6 +71,7 @@ class BindingData : public SnapshotableObject {
 
  private:
   InternalFieldInfo* internal_field_info_ = nullptr;
+  std::unordered_map<uint32_t, ChannelStatusCallback> channel_status_callbacks_;
 };
 
 class Channel : public BaseObject {
diff --git a/src/node_errors.cc b/src/node_errors.cc
index d79d8d0a1ed6..9a7c89b22fe3 100644
--- a/src/node_errors.cc
+++ b/src/node_errors.cc
@@ -191,6 +191,9 @@ static std::string GetErrorSource(Isolate* isolate,
 
 static std::atomic<bool> is_in_oom{false};
 static thread_local std::atomic<bool> is_retrieving_js_stacktrace{false};
+// This is thread-local because it only guards re-entrancy within the current
+// thread's uncaught-exception path; no cross-thread synchronization is needed.
+static thread_local bool is_in_uncaught_exception = false;
 MaybeLocal<StackTrace> GetCurrentStackTrace(Isolate* isolate, int frame_count) {
   if (isolate == nullptr) {
     return MaybeLocal<StackTrace>();
@@ -1302,6 +1305,26 @@ void TriggerUncaughtException(Isolate* isolate,
   CHECK(isolate->InContext());
   Local<Context> context = isolate->GetCurrentContext();
   Environment* env = Environment::GetCurrent(context);
+  // Re-entrancy guard: prevent infinite recursion when the JS-level
+  // exception handler (process._fatalException) itself triggers another
+  // exception through the inspector protocol, causing V8's pending message
+  // reporting to call TriggerUncaughtException reentrantly.
+  if (is_in_uncaught_exception) {
+    PrintToStderrAndFlush(
+        "FATAL ERROR: Re-entrant uncaught exception detected.\n"
+        "The exception handler threw an error while processing a\n"
+        "previous uncaught exception, likely due to an inspector\n"
+        "protocol issue. Aborting to prevent infinite recursion.\n" +
+        FormatCaughtException(isolate, context, error, message));
+    ABORT();
+  }
+  // RAII guard to ensure the flag is cleared when TriggerUncaughtException
+  // returns normally. Note: ABORT() and env->Exit() do not run this
+  // destructor, which is intentional — the process is terminating.
+  struct UncaughtExceptionGuard {
+    UncaughtExceptionGuard() { is_in_uncaught_exception = true; }
+    ~UncaughtExceptionGuard() { is_in_uncaught_exception = false; }
+  } uncaught_exception_guard;
   if (env == nullptr) {
     // This means that the exception happens before Environment is assigned
     // to the context e.g. when there is a SyntaxError in a per-context
diff --git a/src/node_errors.h b/src/node_errors.h
index 3041a07995c9..3ea1fdf0dcd8 100644
--- a/src/node_errors.h
+++ b/src/node_errors.h
@@ -62,12 +62,15 @@ void OOMErrorHandler(const char* location, const v8::OOMDetails& details);
   V(ERR_CRYPTO_INVALID_KEYLEN, RangeError)                                     \
   V(ERR_CRYPTO_INVALID_KEYPAIR, RangeError)                                    \
   V(ERR_CRYPTO_INVALID_KEYTYPE, RangeError)                                    \
+  V(ERR_CRYPTO_INVALID_MAC, TypeError)                                         \
   V(ERR_CRYPTO_INVALID_MESSAGELEN, RangeError)                                 \
   V(ERR_CRYPTO_INVALID_SCRYPT_PARAMS, RangeError)                              \
   V(ERR_CRYPTO_INVALID_STATE, Error)                                           \
   V(ERR_CRYPTO_INVALID_TAG_LENGTH, RangeError)                                 \
   V(ERR_CRYPTO_JWK_UNSUPPORTED_CURVE, Error)                                   \
   V(ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE, Error)                                \
+  V(ERR_CRYPTO_MAC_NOT_SUPPORTED, Error)                                       \
+  V(ERR_CRYPTO_MAC_UPDATE_FAILED, Error)                                       \
   V(ERR_CRYPTO_OPERATION_FAILED, Error)                                        \
   V(ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH, RangeError)                           \
   V(ERR_CRYPTO_UNKNOWN_CIPHER, Error)                                          \
diff --git a/src/node_file.cc b/src/node_file.cc
index a576b4a9d4eb..acb9e9d66983 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -1745,6 +1745,41 @@ static void RMDir(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+#ifdef _WIN32
+static void ClearReadOnlyAttributeWHelper(const wchar_t* path) {
+  DWORD attrs = GetFileAttributesW(path);
+  if (attrs != INVALID_FILE_ATTRIBUTES && (attrs & FILE_ATTRIBUTE_READONLY)) {
+    SetFileAttributesW(path, attrs & ~FILE_ATTRIBUTE_READONLY);
+  }
+}
+
+static void ClearReadOnlyAttributeW(const std::filesystem::path& path,
+                                    bool recursive) {
+  std::error_code ec;
+  auto file_status = std::filesystem::symlink_status(path, ec);
+  if (ec) return;
+
+  if (recursive &&
+      file_status.type() == std::filesystem::file_type::directory) {
+    for (const auto& entry : std::filesystem::recursive_directory_iterator(
+             path,
+             std::filesystem::directory_options::skip_permission_denied,
+             ec)) {
+      std::error_code entry_ec;
+      auto entry_status = entry.symlink_status(entry_ec);
+      if (entry_ec) continue;
+      if (entry_status.type() != std::filesystem::file_type::symlink) {
+        ClearReadOnlyAttributeWHelper(entry.path().c_str());
+      }
+    }
+  }
+
+  if (file_status.type() != std::filesystem::file_type::symlink) {
+    ClearReadOnlyAttributeWHelper(path.c_str());
+  }
+}
+#endif
+
 static void RmSync(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = env->isolate();
@@ -1792,6 +1827,9 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
   };
 
   int i = 1;
+#ifdef _WIN32
+  bool cleared_readonly = false;
+#endif
 
   while (maxRetries >= 0) {
     if (recursive) {
@@ -1800,6 +1838,22 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
       std::filesystem::remove(file_path, error);
     }
 
+#ifdef _WIN32
+    // On Windows, libc++ does not clear the read-only attribute before
+    // removing a file (unlike MSVC STL which does). Attempt to clear it
+    // manually when we get EPERM (operation_not_permitted) so that read-only
+    // files can be deleted, matching the behavior of official Node.js builds.
+    if (error == std::errc::operation_not_permitted && !cleared_readonly) {
+      cleared_readonly = true;
+      ClearReadOnlyAttributeW(file_path, recursive);
+      if (recursive) {
+        std::filesystem::remove_all(file_path, error);
+      } else {
+        std::filesystem::remove(file_path, error);
+      }
+    }
+#endif  // _WIN32
+
     if (!error || error == std::errc::no_such_file_or_directory) {
       return;
     } else if (!can_omit_error(error)) {
@@ -1820,7 +1874,7 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
   }
 
   // On Windows path::c_str() returns wide char, convert to std::string first.
-  std::string file_path_str = file_path.string();
+  std::string file_path_str = ConvertPathToUTF8(file_path);
   const char* path_c_str = file_path_str.c_str();
 #ifdef _WIN32
   int permission_denied_error = EPERM;
@@ -1829,14 +1883,14 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
 #endif  // !_WIN32
 
   if (error == std::errc::operation_not_permitted) {
-    std::string message = "Operation not permitted: " + file_path_str;
+    std::string message = "Operation not permitted:";
     return env->ThrowErrnoException(EPERM, "rm", message.c_str(), path_c_str);
   } else if (error == std::errc::directory_not_empty) {
-    std::string message = "Directory not empty: " + file_path_str;
+    std::string message = "Directory not empty:";
     return env->ThrowErrnoException(
         ENOTEMPTY, "rm", message.c_str(), path_c_str);
   } else if (error == std::errc::not_a_directory) {
-    std::string message = "Not a directory: " + file_path_str;
+    std::string message = "Not a directory:";
     return env->ThrowErrnoException(ENOTDIR, "rm", message.c_str(), path_c_str);
 #ifdef _AIX
   } else if (error == std::errc::permission_denied ||
@@ -1847,7 +1901,7 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
 #else
   } else if (error == std::errc::permission_denied) {
 #endif
-    std::string message = "Permission denied: " + file_path_str;
+    std::string message = "Permission denied:";
     return env->ThrowErrnoException(
         permission_denied_error, "rm", message.c_str(), path_c_str);
   }
@@ -3791,6 +3845,7 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
   auto dest_path = dest.ToPath();
 
   std::error_code error;
+  const bool dest_existed = std::filesystem::exists(dest_path, error);
   std::filesystem::create_directories(dest_path, error);
   if (error) {
     return env->ThrowStdErrException(error, "cp", *dest);
@@ -3910,11 +3965,28 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
         }
       } else if (dir_entry.is_directory()) {
         auto entry_dir_path = src / dir_entry.path().filename();
-        std::filesystem::create_directory(dest_file_path);
+        const bool created =
+            std::filesystem::create_directory(dest_file_path, error);
+        if (error) {
+          env->ThrowStdErrException(
+              error, "cp", ConvertPathToUTF8(dest_file_path).c_str());
+          return false;
+        }
         auto success = copy_dir_contents(entry_dir_path, dest_file_path);
         if (!success) {
           return false;
         }
+        // A directory created by the copy gets the mode of its source once
+        // its contents are in (the source may be read-only).
+        if (created) {
+          std::filesystem::permissions(
+              dest_file_path, dir_entry.status().permissions(), error);
+          if (error) {
+            env->ThrowStdErrException(
+                error, "cp", ConvertPathToUTF8(dest_file_path).c_str());
+            return false;
+          }
+        }
       } else if (dir_entry.is_regular_file()) {
         std::filesystem::copy_file(
             dir_entry.path(), dest_file_path, file_copy_opts, error);
@@ -3939,7 +4011,13 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
     return true;
   };
 
-  copy_dir_contents(src_path, dest_path);
+  if (copy_dir_contents(src_path, dest_path) && !dest_existed) {
+    std::filesystem::permissions(
+        dest_path, std::filesystem::status(src_path).permissions(), error);
+    if (error) {
+      return env->ThrowStdErrException(error, "cp", *dest);
+    }
+  }
 }
 
 BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
diff --git a/src/node_http2.cc b/src/node_http2.cc
index b6bbb1a4edc3..010109791f0b 100644
--- a/src/node_http2.cc
+++ b/src/node_http2.cc
@@ -970,45 +970,24 @@ ssize_t Http2Session::OnMaxFrameSizePadding(size_t frameLen,
 // quite expensive. This is a potential performance optimization target later.
 void Http2Session::ConsumeHTTP2Data() {
   CHECK_NOT_NULL(stream_buf_.base);
-  CHECK_LE(stream_buf_offset_, stream_buf_.len);
-  size_t read_len = stream_buf_.len - stream_buf_offset_;
 
   // multiple side effects.
-  Debug(this, "receiving %d bytes [wants data? %d]",
-        read_len,
+  Debug(this,
+        "receiving %d bytes [wants data? %d]",
+        stream_buf_.len,
         nghttp2_session_want_read(session_.get()));
-  set_receive_paused(false);
   custom_recv_error_code_ = nullptr;
   set_receiving();
   ssize_t ret =
-    nghttp2_session_mem_recv(session_.get(),
-                             reinterpret_cast<uint8_t*>(stream_buf_.base) +
-                                 stream_buf_offset_,
-                             read_len);
+      nghttp2_session_mem_recv(session_.get(),
+                               reinterpret_cast<uint8_t*>(stream_buf_.base),
+                               stream_buf_.len);
   set_receiving(false);
   CHECK_NE(ret, NGHTTP2_ERR_NOMEM);
   CHECK_IMPLIES(custom_recv_error_code_ != nullptr, ret < 0);
 
-  if (is_receive_paused()) {
-    CHECK(is_reading_stopped());
-
-    CHECK_GT(ret, 0);
-    CHECK_LE(static_cast<size_t>(ret), read_len);
-
-    // Mark the remainder of the data as available for later consumption.
-    // Even if all bytes were received, a paused stream may delay the
-    // nghttp2_on_frame_recv_callback which may have an END_STREAM flag.
-    stream_buf_offset_ += ret;
-    // Still complete a Close() deferred during mem_recv; do not fall through
-    // to SendPendingData() here (paused receives historically skip that flush
-    // because a write may already be in progress).
-    MaybeFinishPendingClose();
-    goto done;
-  }
-
   // We are done processing the current input chunk.
   DecrementCurrentSessionMemory(stream_buf_.len);
-  stream_buf_offset_ = 0;
   stream_buf_ab_.Reset();
   stream_buf_allocation_.reset();
   stream_buf_ = uv_buf_init(nullptr, 0);
@@ -1017,14 +996,6 @@ void Http2Session::ConsumeHTTP2Data() {
   // not written after pending RST_STREAM frames.
   MaybeFinishPendingClose();
 
-done:
-  // Finish a Close() deferred above before flushing, so GOAWAY is not written
-  // after pending RST_STREAM frames.
-  if (is_close_pending() && !is_destroyed()) {
-    set_close_pending(false);
-    FinishClose(pending_close_code_, pending_close_socket_closed_);
-  }
-
   // Send any data that was queued up while processing the received data.
   if (ret >= 0 && !is_destroyed()) {
     SendPendingData();
@@ -1083,6 +1054,16 @@ int Http2Session::OnBeginHeadersCallback(nghttp2_session* handle,
   // The common case is that we're creating a new stream. The less likely
   // case is that we're receiving a set of trailers
   if (!stream) [[likely]] {
+    // Close() may be deferred while mem_recv is in progress (see
+    // Http2Session::Close). A 'stream' handler that calls session.destroy()
+    // runs via nextTick from MakeCallback during that window, so later
+    // HEADERS in the same receive buffer must not create a C++ stream
+    // whose JS wrapper (and onread) is never installed.
+    if (session->is_closing()) {
+      nghttp2_submit_rst_stream(
+          session->session(), NGHTTP2_FLAG_NONE, id, NGHTTP2_REFUSED_STREAM);
+      return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+    }
     if (!session->CanAddStream() ||
         Http2Stream::New(session, id, frame->headers.cat) == nullptr)
         [[unlikely]] {
@@ -1158,6 +1139,13 @@ int Http2Session::OnFrameReceive(nghttp2_session* handle,
     case NGHTTP2_HEADERS:
       session->HandleHeadersFrame(frame);
       break;
+    case NGHTTP2_RST_STREAM:
+      // Distinguish a peer reset from a natural close with the same code.
+      if (BaseObjectPtr<Http2Stream> stream =
+              session->FindStream(frame->hd.stream_id)) {
+        stream->set_peer_reset();
+      }
+      break;
     case NGHTTP2_SETTINGS:
       session->HandleSettingsFrame(frame);
       break;
@@ -1367,9 +1355,12 @@ int Http2Session::OnStreamClose(nghttp2_session* handle,
   // ever passed on to the javascript side. If that happens, the callback
   // will return false.
   if (env->can_call_into_js()) {
-    Local<Value> arg = Integer::NewFromUnsigned(isolate, code);
+    Local<Value> argv[] = {
+        Integer::NewFromUnsigned(isolate, code),
+        Boolean::New(isolate, stream->peer_reset()),
+    };
     MaybeLocal<Value> answer = stream->MakeCallback(
-        env->http2session_on_stream_close_function(), 1, &arg);
+        env->http2session_on_stream_close_function(), arraysize(argv), argv);
     if (answer.IsEmpty() || answer.ToLocalChecked()->IsFalse()) {
       // Skip to destroy
       stream->Destroy();
@@ -1478,15 +1469,6 @@ int Http2Session::OnDataChunkReceived(nghttp2_session* handle,
     }
   } while (len != 0);
 
-  // If we are currently waiting for a write operation to finish, we should
-  // tell nghttp2 that we want to wait before we process more input data.
-  if (session->is_write_in_progress()) {
-    CHECK(session->is_reading_stopped());
-    session->set_receive_paused();
-    Debug(session, "receive paused");
-    return NGHTTP2_ERR_PAUSE;
-  }
-
   return 0;
 }
 
@@ -1569,7 +1551,6 @@ void Http2StreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
   size_t offset = buf.base - session->stream_buf_.base;
 
   // Verify that the data offset is inside the current read buffer.
-  CHECK_GE(offset, session->stream_buf_offset_);
   CHECK_LE(offset, session->stream_buf_.len);
   CHECK_LE(offset + buf.len, session->stream_buf_.len);
 
@@ -1883,11 +1864,6 @@ void Http2Session::OnStreamAfterWrite(WriteWrap* w, int status) {
     return;
   }
 
-  // If there is more incoming data queued up, consume it.
-  if (stream_buf_offset_ > 0) {
-    ConsumeHTTP2Data();
-  }
-
   if (!is_write_scheduled() && !is_destroyed()) {
     // Schedule a new write if nghttp2 wants to send data.
     MaybeScheduleWrite();
@@ -1934,7 +1910,7 @@ void Http2Session::MaybeStopReading() {
   if (is_reading_stopped() || is_closing()) return;
   int want_read = nghttp2_session_want_read(session_.get());
   Debug(this, "wants read? %d", want_read);
-  if (want_read == 0 || is_write_in_progress()) {
+  if (want_read == 0) {
     set_reading_stopped();
     stream_->ReadStop();
   }
@@ -2199,7 +2175,7 @@ void Http2Session::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
   Context::Scope context_scope(env()->context());
   Http2Scope h2scope(this);
   CHECK_NOT_NULL(stream_);
-  Debug(this, "receiving %d bytes, offset %d", nread, stream_buf_offset_);
+  Debug(this, "receiving %d bytes", nread);
   std::unique_ptr<BackingStore> bs = env()->release_managed_buffer(buf_);
 
   // Only pass data on if nread > 0
@@ -2214,8 +2190,11 @@ void Http2Session::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
 
   statistics_.data_received += nread;
 
-  if (stream_buf_offset_ == 0 && static_cast<size_t>(nread) != bs->ByteLength())
-      [[likely]] {
+  // ConsumeHTTP2Data() always consumes the whole chunk, so there is never a
+  // partially processed buffer left over from a previous read.
+  DCHECK_NULL(stream_buf_.base);
+
+  if (static_cast<size_t>(nread) != bs->ByteLength()) [[likely]] {
     // Shrink to the actual amount of used data.
     std::unique_ptr<BackingStore> old_bs = std::move(bs);
     bs = ArrayBuffer::NewBackingStore(
@@ -2223,31 +2202,6 @@ void Http2Session::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
         nread,
         BackingStoreInitializationMode::kUninitialized);
     memcpy(bs->Data(), old_bs->Data(), nread);
-  } else {
-    // This is a very unlikely case, and should only happen if the ReadStart()
-    // call in OnStreamAfterWrite() immediately provides data. If that does
-    // happen, we concatenate the data we received with the already-stored
-    // pending input data, slicing off the already processed part.
-    size_t pending_len = stream_buf_.len - stream_buf_offset_;
-    std::unique_ptr<BackingStore> new_bs = ArrayBuffer::NewBackingStore(
-        env()->isolate(),
-        pending_len + nread,
-        BackingStoreInitializationMode::kUninitialized);
-    memcpy(static_cast<char*>(new_bs->Data()),
-           stream_buf_.base + stream_buf_offset_,
-           pending_len);
-    memcpy(static_cast<char*>(new_bs->Data()) + pending_len,
-           bs->Data(),
-           nread);
-
-    bs = std::move(new_bs);
-    nread = bs->ByteLength();
-    stream_buf_offset_ = 0;
-    stream_buf_ab_.Reset();
-
-    // We have now fully processed the stream_buf_ input chunk (by moving the
-    // remaining part into buf, which will be accounted for below).
-    DecrementCurrentSessionMemory(stream_buf_.len);
   }
 
   IncrementCurrentSessionMemory(nread);
diff --git a/src/node_http2.h b/src/node_http2.h
index f321bf0c1601..94e77cbc6fa6 100644
--- a/src/node_http2.h
+++ b/src/node_http2.h
@@ -65,6 +65,7 @@ constexpr int kStreamStateReadPaused = 0x4;
 constexpr int kStreamStateClosed = 0x8;
 constexpr int kStreamStateDestroyed = 0x10;
 constexpr int kStreamStateTrailers = 0x20;
+constexpr int kStreamStatePeerReset = 0x40;
 
 // Http2Session internal states
 constexpr int kSessionStateNone = 0x0;
@@ -75,9 +76,8 @@ constexpr int kSessionStateClosing = 0x8;
 constexpr int kSessionStateSending = 0x10;
 constexpr int kSessionStateWriteInProgress = 0x20;
 constexpr int kSessionStateReadingStopped = 0x40;
-constexpr int kSessionStateReceivePaused = 0x80;
-constexpr int kSessionStateReceiving = 0x100;
-constexpr int kSessionStateClosePending = 0x200;
+constexpr int kSessionStateReceiving = 0x80;
+constexpr int kSessionStateClosePending = 0x100;
 
 // The Padding Strategy determines the method by which extra padding is
 // selected for HEADERS and DATA frames. These are configurable via the
@@ -353,6 +353,10 @@ class Http2Stream : public AsyncWrap,
     return flags_ & kStreamStateClosed;
   }
 
+  bool peer_reset() const { return flags_ & kStreamStatePeerReset; }
+
+  void set_peer_reset() { flags_ |= kStreamStatePeerReset; }
+
   bool has_trailers() const {
     return flags_ & kStreamStateTrailers;
   }
@@ -664,7 +668,6 @@ class Http2Session : public AsyncWrap,
   IS_FLAG(sending, kSessionStateSending)
   IS_FLAG(write_in_progress, kSessionStateWriteInProgress)
   IS_FLAG(reading_stopped, kSessionStateReadingStopped)
-  IS_FLAG(receive_paused, kSessionStateReceivePaused)
   IS_FLAG(receiving, kSessionStateReceiving)
   IS_FLAG(close_pending, kSessionStateClosePending)
 
@@ -945,7 +948,6 @@ class Http2Session : public AsyncWrap,
   // will be set. stream_buf_ab_ is lazily created from stream_buf_allocation_.
   v8::Global<v8::ArrayBuffer> stream_buf_ab_;
   std::unique_ptr<v8::BackingStore> stream_buf_allocation_;
-  size_t stream_buf_offset_ = 0;
   // Custom error code for errors that originated inside one of the callbacks
   // called by nghttp2_session_mem_recv.
   const char* custom_recv_error_code_ = nullptr;
diff --git a/src/node_internals.h b/src/node_internals.h
index 8e930a6fecd6..dc228f8e1e24 100644
--- a/src/node_internals.h
+++ b/src/node_internals.h
@@ -355,6 +355,8 @@ void DefineZlibConstants(v8::Local<v8::Object> target);
 // addresses, so this should be used with care.
 v8::IsolateGroup GetOrCreateIsolateGroup();
 
+// The blob every isolate is created from, see NewIsolate(). It is never freed.
+bool IsFirstSnapshotBlob(const char* data);
 v8::Isolate* NewIsolate(v8::Isolate::CreateParams* params,
                         uv_loop_t* event_loop,
                         MultiIsolatePlatform* platform,
@@ -387,7 +389,6 @@ class InitializationResultImpl final : public InitializationResult {
   MultiIsolatePlatform* platform_ = nullptr;
 };
 
-void SetIsolateErrorHandlers(v8::Isolate* isolate, const IsolateSettings& s);
 void SetIsolateMiscHandlers(v8::Isolate* isolate, const IsolateSettings& s);
 void SetIsolateCreateParamsForNode(v8::Isolate::CreateParams* params);
 
diff --git a/src/node_locks.cc b/src/node_locks.cc
index 26fac6b62c4c..4fca3a7df94e 100644
--- a/src/node_locks.cc
+++ b/src/node_locks.cc
@@ -2,6 +2,7 @@
 
 #include "base_object-inl.h"
 #include "env-inl.h"
+#include "node_debug.h"
 #include "node_errors.h"
 #include "node_external_reference.h"
 #include "node_internals.h"
@@ -237,8 +238,8 @@ void LockManager::ProcessQueue(Environment* env) {
      * 1- Build first_seen_for_resource: the oldest pending request
      *   for every resource name we encounter
      * 2- Decide what to do with each entry:
-     *     – If it belongs to another Environment, remember that env so we
-     *       can wake it later
+     *     – If it belongs to another Environment, remember that env only if
+     *       the request can make progress
      *     – For our Environment, pick one of:
      *         * grantable_request  – can be granted now
      *         * if_available_request – user asked for ifAvailable and the
@@ -255,11 +256,6 @@ void LockManager::ProcessQueue(Environment* env) {
            ++queue_iter) {
         LockRequest* request = queue_iter->get();
 
-        // Collect unique environments to wake up later
-        if (request->env() != env) {
-          other_envs_to_wake.insert(request->env());
-        }
-
         // During a single pass, the first time we see a resource name is the
         // earliest pending request
         auto& first_for_resource = first_seen_for_resource[request->name()];
@@ -283,12 +279,21 @@ void LockManager::ProcessQueue(Environment* env) {
           // If both are shared, they're compatible and can proceed
         }
 
-        // Only process requests from the current environment
+        bool is_grantable =
+            !should_wait_for_earlier_requests && IsGrantable(request);
+
+        // Requests must be processed on their Environment's event loop. Wake
+        // another Environment only when it has a request that can make
+        // progress; otherwise blocked Environments would continuously wake
+        // each other.
         if (request->env() != env) {
+          if (is_grantable || request->if_available()) {
+            other_envs_to_wake.insert(request->env());
+          }
           continue;
         }
 
-        if (should_wait_for_earlier_requests || !IsGrantable(request)) {
+        if (!is_grantable) {
           if (request->if_available()) {
             // ifAvailable request when resource not available: grant with null
             if_available_request = std::move(*queue_iter);
@@ -754,6 +759,8 @@ void LockManager::ReleaseLock(Lock* lock) {
 void LockManager::WakeEnvironment(Environment* target_env) {
   if (target_env == nullptr || target_env->is_stopping()) return;
 
+  COUNT_GENERIC_USAGE("LockManager.WakeEnvironment");
+
   // Schedule ProcessQueue in the target Environment on its event loop.
   target_env->SetImmediateThreadsafe([](Environment* env_to_wake) {
     if (env_to_wake != nullptr && !env_to_wake->is_stopping()) {
diff --git a/src/node_main_instance.cc b/src/node_main_instance.cc
index 6f674df3ed0d..bc07d6aaf426 100644
--- a/src/node_main_instance.cc
+++ b/src/node_main_instance.cc
@@ -51,11 +51,11 @@ NodeMainInstance::NodeMainInstance(const SnapshotData* snapshot_data,
 
   // If the indexes are not nullptr, we are not deserializing
   isolate_data_.reset(
-      CreateIsolateData(isolate_,
-                        event_loop,
-                        platform,
-                        array_buffer_allocator_.get(),
-                        snapshot_data->AsEmbedderWrapper().get()));
+      IsolateData::CreateIsolateData(isolate_,
+                                     event_loop,
+                                     platform,
+                                     array_buffer_allocator_.get(),
+                                     snapshot_data));
 
   isolate_data_->max_young_gen_size =
       isolate_params_->constraints.max_young_generation_size_in_bytes();
diff --git a/src/node_options-inl.h b/src/node_options-inl.h
index 877e8ce4ded9..0f93455e93f3 100644
--- a/src/node_options-inl.h
+++ b/src/node_options-inl.h
@@ -6,6 +6,7 @@
 #include <algorithm>
 #include <cstdlib>
 #include <ranges>
+#include <type_traits>
 #include "node_options.h"
 #include "util.h"
 
@@ -453,18 +454,21 @@ void OptionsParser<Options>::Parse(
 
     std::string value;
     if (info.type != kBoolean && info.type != kNoOp && info.type != kV8Option) {
+      // `--run` may be passed without a script name to list available scripts,
+      // so an omitted value is not an error and must not swallow a later flag.
+      const bool optional_value = name == "--run";
       if (equals_index != std::string::npos) {
         value = arg.substr(equals_index + 1);
-        if (value.empty()) {
+        if (value.empty() && !optional_value) {
           missing_argument();
           break;
         }
-      } else {
-        if (args.empty()) {
+      } else if (args.empty() || (optional_value && args.first()[0] == '-')) {
+        if (!optional_value) {
           missing_argument();
           break;
         }
-
+      } else {
         value = args.pop_first();
 
         if (!value.empty() && value[0] == '-') {
@@ -512,6 +516,12 @@ void OptionsParser<Options>::Parse(
       default:
         UNREACHABLE();
     }
+
+    // Record that `--run` was seen so an empty value can be distinguished from
+    // the option being absent. Guarded so it only compiles for the owning type.
+    if constexpr (std::is_same_v<Options, PerProcessOptions>) {
+      if (name == "--run") options->has_run = true;
+    }
   }
   options->CheckOptions(errors, orig_args);
 }
diff --git a/src/node_options.cc b/src/node_options.cc
index 5cbb2e7c593f..9ccad939f1ae 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -9,7 +9,7 @@
 #include "node_sea.h"
 #include "uv.h"
 #if HAVE_OPENSSL
-#include "openssl/opensslv.h"
+#include "ncrypto.h"  // Defines OPENSSL_VERSION_PREREQ for BoringSSL.
 #include "quic/guard.h"
 #endif
 
@@ -84,6 +84,23 @@ void PerProcessOptions::CheckOptions(std::vector<std::string>* errors,
                       "used, not both");
   }
 
+  if (force_fips_crypto_policy != "provider" &&
+      force_fips_crypto_policy != "strict") {
+    errors->push_back(
+        "invalid value for --force-fips; expected 'provider' or 'strict'");
+  }
+
+#if defined(OPENSSL_IS_BORINGSSL) || !OPENSSL_VERSION_PREREQ(3, 4)
+  if (enable_fips_indicator_events) {
+    errors->push_back(
+        "--enable-fips-indicator-events requires OpenSSL 3.4 or later");
+  }
+
+  if (force_fips_crypto && force_fips_crypto_policy == "strict") {
+    errors->push_back("--force-fips=strict requires OpenSSL 3.4 or later");
+  }
+#endif
+
   // Any value less than 2 disables use of the secure heap.
 #ifndef V8_ENABLE_SANDBOX
   // The secure heap is not supported when V8_ENABLE_SANDBOX is enabled.
@@ -1447,10 +1464,20 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             "enable FIPS crypto at startup",
             &PerProcessOptions::enable_fips_crypto,
             kAllowedInEnvvar);
+  AddOption("--enable-fips-indicator-events",
+            "publish FIPS indicator results to the "
+            "crypto.fips.indicator diagnostics channel",
+            &PerProcessOptions::enable_fips_indicator_events,
+            kAllowedInEnvvar);
   AddOption("--force-fips",
-            "force FIPS crypto (cannot be disabled)",
+            "force FIPS crypto (optional mode: provider or strict)",
             &PerProcessOptions::force_fips_crypto,
             kAllowedInEnvvar);
+  AddOption("[force_fips_crypto_policy]",
+            "",
+            &PerProcessOptions::force_fips_crypto_policy,
+            kAllowedInEnvvar);
+  AddAlias("--force-fips=", {"[force_fips_crypto_policy]", "--force-fips"});
 #ifndef V8_ENABLE_SANDBOX
   AddOption("--secure-heap",
             "total size of the OpenSSL secure heap",
@@ -2047,6 +2074,12 @@ void GetOptionsAsFlags(const FunctionCallbackInfo<Value>& args) {
     switch (option_info.type) {
       case kBoolean: {
         bool current_value = *_ppop_instance.Lookup<bool>(field, opts);
+#if HAVE_OPENSSL
+        if (option_name == "--force-fips" && current_value) {
+          flags.push_back(option_name + "=" + opts->force_fips_crypto_policy);
+          break;
+        }
+#endif
         // For boolean options with default_is_true, we want the opposite logic
         if (option_info.default_is_true) {
           if (!current_value) {
diff --git a/src/node_options.h b/src/node_options.h
index 870a6babc770..b55fae0a3217 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -371,7 +371,9 @@ class PerProcessOptions : public Options {
   bool use_openssl_ca = false;
   bool use_bundled_ca = false;
   bool enable_fips_crypto = false;
+  bool enable_fips_indicator_events = false;
   bool force_fips_crypto = false;
+  std::string force_fips_crypto_policy = "provider";
 #endif
 #if OPENSSL_VERSION_MAJOR >= 3
   bool openssl_legacy_provider = false;
@@ -389,6 +391,9 @@ class PerProcessOptions : public Options {
   // TODO(addaleax): Some of these could probably be per-Environment.
   std::string use_largepages = "off";
   bool trace_sigint = false;
+  // Tracks whether `--run` was passed, since an empty `run` is ambiguous
+  // between "not passed" and "passed without a script name" (lists scripts).
+  bool has_run = false;
   std::vector<std::string> cmdline;
 
   inline PerIsolateOptions* get_per_isolate_options();
diff --git a/src/node_perf.cc b/src/node_perf.cc
index 177c2a789854..b4c74e9a09a7 100644
--- a/src/node_perf.cc
+++ b/src/node_perf.cc
@@ -14,7 +14,6 @@
 namespace node {
 namespace performance {
 
-using v8::Array;
 using v8::Context;
 using v8::DontDelete;
 using v8::Function;
@@ -57,7 +56,12 @@ PerformanceState::PerformanceState(Isolate* isolate,
                 offsetof(performance_state_internal, observers),
                 NODE_PERFORMANCE_ENTRY_TYPE_INVALID,
                 root,
-                MAYBE_FIELD_PTR(info, observers)) {
+                MAYBE_FIELD_PTR(info, observers)),
+      uv_metrics(isolate,
+                 offsetof(performance_state_internal, uv_metrics),
+                 3,
+                 root,
+                 MAYBE_FIELD_PTR(info, uv_metrics)) {
   if (info == nullptr) {
     // For performance states initialized from scratch, reset
     // all the milestones and initialize the time origin.
@@ -81,9 +85,15 @@ PerformanceState::SerializeInfo PerformanceState::Serialize(
   // We'll re-initialize them after deserialization.
   ResetMilestones();
 
+  // Do not retain runtime metrics in the snapshot.
+  for (size_t i = 0; i < uv_metrics.Length(); ++i) {
+    uv_metrics[i] = 0;
+  }
+
   SerializeInfo info{root.Serialize(context, creator),
                      milestones.Serialize(context, creator),
-                     observers.Serialize(context, creator)};
+                     observers.Serialize(context, creator),
+                     uv_metrics.Serialize(context, creator)};
   return info;
 }
 
@@ -105,6 +115,7 @@ void PerformanceState::Deserialize(v8::Local<v8::Context> context,
   root.Deserialize(context);
   milestones.Deserialize(context);
   observers.Deserialize(context);
+  uv_metrics.Deserialize(context);
 
   // Re-initialize the time origin and timestamp i.e. the process start time.
   Initialize(time_origin, time_origin_timestamp);
@@ -116,6 +127,7 @@ std::ostream& operator<<(std::ostream& o,
     << "  " << i.root << ",  // root\n"
     << "  " << i.milestones << ",  // milestones\n"
     << "  " << i.observers << ",  // observers\n"
+    << "  " << i.uv_metrics << ",  // uv_metrics\n"
     << "}";
   return o;
 }
@@ -265,17 +277,13 @@ void LoopIdleTime(const FunctionCallbackInfo<Value>& args) {
 
 void UvMetricsInfo(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
   uv_metrics_t metrics;
   // uv_metrics_info always return 0
   CHECK_EQ(uv_metrics_info(env->event_loop(), &metrics), 0);
-  Local<Value> data[] = {
-      Integer::New(isolate, metrics.loop_count),
-      Integer::New(isolate, metrics.events),
-      Integer::New(isolate, metrics.events_waiting),
-  };
-  Local<Array> arr = Array::New(env->isolate(), data, arraysize(data));
-  args.GetReturnValue().Set(arr);
+  AliasedInt32Array& buffer = env->performance_state()->uv_metrics;
+  buffer[0] = static_cast<int32_t>(metrics.loop_count);
+  buffer[1] = static_cast<int32_t>(metrics.events);
+  buffer[2] = static_cast<int32_t>(metrics.events_waiting);
 }
 
 void CreateELDHistogram(const FunctionCallbackInfo<Value>& args) {
@@ -333,6 +341,7 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   Isolate* isolate = isolate_data->isolate();
 
   HistogramBase::Initialize(isolate_data, target);
+  SlidingWindowHistogram::Initialize(isolate_data, target);
 
   SetMethod(isolate, target, "setupObservers", SetupPerformanceObservers);
   SetMethod(isolate,
@@ -366,6 +375,11 @@ void CreatePerContextProperties(Local<Object> target,
   target->Set(context,
               FIXED_ONE_BYTE_STRING(isolate, "milestones"),
               state->milestones.GetJSArray()).Check();
+  target
+      ->Set(context,
+            FIXED_ONE_BYTE_STRING(isolate, "uvMetricsBuffer"),
+            state->uv_metrics.GetJSArray())
+      .Check();
 
   Local<Object> constants = Object::New(isolate);
 
@@ -419,6 +433,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(SlowPerformanceNow);
   registry->Register(fast_performance_now);
   HistogramBase::RegisterExternalReferences(registry);
+  SlidingWindowHistogram::RegisterExternalReferences(registry);
   IntervalHistogram::RegisterExternalReferences(registry);
   IterationHistogram::RegisterExternalReferences(registry);
 }
diff --git a/src/node_perf_common.h b/src/node_perf_common.h
index 01e7f35241ac..aa84ba55b08e 100644
--- a/src/node_perf_common.h
+++ b/src/node_perf_common.h
@@ -62,6 +62,7 @@ class PerformanceState {
     AliasedBufferIndex root;
     AliasedBufferIndex milestones;
     AliasedBufferIndex observers;
+    AliasedBufferIndex uv_metrics;
   };
 
   explicit PerformanceState(v8::Isolate* isolate,
@@ -78,6 +79,7 @@ class PerformanceState {
   AliasedUint8Array root;
   AliasedFloat64Array milestones;
   AliasedUint32Array observers;
+  AliasedInt32Array uv_metrics;
 
   uint64_t performance_last_gc_start_mark = 0;
   uint16_t current_gc_type = 0;
@@ -92,6 +94,7 @@ class PerformanceState {
     // doubles first so that they are always sizeof(double)-aligned
     double milestones[NODE_PERFORMANCE_MILESTONE_INVALID];
     uint32_t observers[NODE_PERFORMANCE_ENTRY_TYPE_INVALID];
+    int32_t uv_metrics[3];
   };
 };
 
diff --git a/src/node_platform.cc b/src/node_platform.cc
index 7f4004b4cb94..0598f17eeb4a 100644
--- a/src/node_platform.cc
+++ b/src/node_platform.cc
@@ -125,7 +125,7 @@ class WorkerThreadsTaskRunner::DelayedTaskScheduler {
 
     // The delayed task scheuler is on is own thread with its own loop that
     // runs the timers for the scheduled tasks to pop the original task back
-    // into the the worker task queue. This first pushes the tasks that
+    // into the worker task queue. This first pushes the tasks that
     // schedules the timers into the local task queue that will be flushed
     // by the local event loop.
     locked.Push(std::move(delayed));
diff --git a/src/node_realm-inl.h b/src/node_realm-inl.h
index 0af487a9abc9..d527a4d4c620 100644
--- a/src/node_realm-inl.h
+++ b/src/node_realm-inl.h
@@ -135,11 +135,13 @@ void Realm::TrackBaseObject(BaseObject* bo) {
   ++base_object_count_;
 }
 
-CppgcWrapperListNode::CppgcWrapperListNode(CppgcMixin* ptr) : persistent(ptr) {}
+CppgcWrapperListNode::CppgcWrapperListNode(Realm* realm, CppgcMixin* wrapper)
+    : realm(realm), persistent(wrapper) {}
 
-void Realm::TrackCppgcWrapper(CppgcMixin* handle) {
-  DCHECK_EQ(handle->realm(), this);
-  cppgc_wrapper_list_.PushFront(new CppgcWrapperListNode(handle));
+CppgcWrapperListNode* Realm::TrackCppgcWrapper(CppgcMixin* handle) {
+  CppgcWrapperListNode* node = new CppgcWrapperListNode(this, handle);
+  cppgc_wrapper_list_.PushFront(node);
+  return node;
 }
 
 void Realm::UntrackBaseObject(BaseObject* bo) {
@@ -148,7 +150,7 @@ void Realm::UntrackBaseObject(BaseObject* bo) {
 }
 
 bool Realm::PendingCleanup() const {
-  return !base_object_list_.IsEmpty();
+  return !base_object_list_.IsEmpty() || !cppgc_wrapper_list_.IsEmpty();
 }
 
 }  // namespace node
diff --git a/src/node_realm.cc b/src/node_realm.cc
index 6d2e4eb641a8..05c370671248 100644
--- a/src/node_realm.cc
+++ b/src/node_realm.cc
@@ -10,41 +10,24 @@ namespace node {
 
 using v8::Context;
 using v8::EscapableHandleScope;
-using v8::GCCallbackFlags;
-using v8::GCType;
 using v8::HandleScope;
-using v8::Isolate;
 using v8::Local;
 using v8::MaybeLocal;
 using v8::Object;
 using v8::SnapshotCreator;
 using v8::String;
+using v8::TryCatch;
 using v8::Value;
 
 Realm::Realm(Environment* env, v8::Local<v8::Context> context, Kind kind)
     : env_(env), isolate_(context->GetIsolate()), kind_(kind) {
   context_.Reset(isolate_, context);
   env->AssignToContext(context, this, ContextInfo(""));
-  // The environment can also purge empty wrappers in the check callback,
-  // though that may be a bit excessive depending on usage patterns.
-  // For now using the GC epilogue is adequate.
-  isolate_->AddGCEpilogueCallback(PurgeEmptyCppgcWrappers, this);
 }
 
 Realm::~Realm() {
-  isolate_->RemoveGCEpilogueCallback(PurgeEmptyCppgcWrappers, this);
   CHECK_EQ(base_object_count_, 0);
-}
-
-void Realm::PurgeEmptyCppgcWrappers(Isolate* isolate,
-                                    GCType type,
-                                    GCCallbackFlags flags,
-                                    void* data) {
-  Realm* realm = static_cast<Realm*>(data);
-  if (realm->should_purge_empty_cppgc_wrappers_) {
-    realm->cppgc_wrapper_list_.PurgeEmpty();
-    realm->should_purge_empty_cppgc_wrappers_ = false;
-  }
+  CHECK(cppgc_wrapper_list_.IsEmpty());
 }
 
 void Realm::MemoryInfo(MemoryTracker* tracker) const {
@@ -64,11 +47,22 @@ void Realm::CreateProperties() {
   Local<Context> ctx = context();
 
   // Store primordials setup by the per-context script in the environment.
-  Local<Object> per_context_bindings =
-      GetPerContextExports(ctx, env_->isolate_data()).ToLocalChecked();
-  Local<Value> primordials =
-      per_context_bindings->Get(ctx, env_->primordials_string())
-          .ToLocalChecked();
+  TryCatch try_catch(isolate_);
+  Local<Object> per_context_bindings;
+  Local<Value> primordials;
+  if (!GetPerContextExports(ctx, env_->isolate_data())
+           .ToLocal(&per_context_bindings) ||
+      !per_context_bindings->Get(ctx, env_->primordials_string())
+           .ToLocal(&primordials)) {
+    // In general, this should only throw exceptions during local development
+    // when there's a temporary bug in the scripts. Print the exception here to
+    // facilitate debugging.
+    if (try_catch.HasCaught() && !try_catch.HasTerminated()) {
+      PrintCaughtException(isolate_, ctx, try_catch);
+    }
+    env_->Exit(ExitCode::kBootstrapFailure);
+    return;
+  }
   CHECK(primordials->IsObject());
   set_primordials(primordials.As<Object>());
 
diff --git a/src/node_realm.h b/src/node_realm.h
index 2ed04aa271b4..4cb20d151d4d 100644
--- a/src/node_realm.h
+++ b/src/node_realm.h
@@ -27,16 +27,16 @@ using BindingDataStore =
                static_cast<size_t>(BindingDataType::kBindingDataTypeCount)>;
 
 /**
- * This is a wrapper around a weak persistent of CppgcMixin, used in the
- * CppgcWrapperList to avoid accessing already garbage collected CppgcMixins.
+ * Owned by a CppgcMixin and linked into its Realm's list until the Realm
+ * cleans up and clears `realm`. The Realm only calls into wrappers the GC
+ * still considers alive (the weak persistent); a collected wrapper whose
+ * destructor runs later sees `realm == nullptr` instead of a freed Realm.
  */
 class CppgcWrapperListNode {
  public:
-  explicit inline CppgcWrapperListNode(CppgcMixin* ptr);
-  inline explicit operator bool() const { return !persistent; }
-  inline CppgcMixin* operator->() const { return persistent.Get(); }
-  inline CppgcMixin* operator*() const { return persistent.Get(); }
+  inline CppgcWrapperListNode(Realm* realm, CppgcMixin* wrapper);
 
+  Realm* realm;
   cppgc::WeakPersistent<CppgcMixin> persistent;
   // Used by ContainerOf in the ListNode implementation for fast manipulation of
   // CppgcWrapperList.
@@ -53,7 +53,6 @@ class CppgcWrapperList
       public MemoryRetainer {
  public:
   void Cleanup();
-  void PurgeEmpty();
 
   SET_MEMORY_INFO_NAME(CppgcWrapperList)
   SET_SELF_SIZE(CppgcWrapperList)
@@ -148,7 +147,7 @@ class Realm : public MemoryRetainer {
   // Base object count created after the bootstrap of the realm.
   inline int64_t base_object_created_after_bootstrap() const;
 
-  inline void TrackCppgcWrapper(CppgcMixin* handle);
+  inline CppgcWrapperListNode* TrackCppgcWrapper(CppgcMixin* handle);
   inline CppgcWrapperList* cppgc_wrapper_list() { return &cppgc_wrapper_list_; }
 
 #define V(PropertyName, TypeName)                                              \
@@ -164,14 +163,6 @@ class Realm : public MemoryRetainer {
   // it's only used for tests.
   std::vector<std::string> builtins_in_snapshot;
 
-  // This used during the destruction of cppgc wrappers to inform a GC epilogue
-  // callback to clean up the weak persistents used to track cppgc wrappers if
-  // the wrappers are already garbage collected to prevent holding on to
-  // excessive useless persistents.
-  inline void set_should_purge_empty_cppgc_wrappers(bool value) {
-    should_purge_empty_cppgc_wrappers_ = value;
-  }
-
  protected:
   ~Realm();
 
@@ -181,17 +172,11 @@ class Realm : public MemoryRetainer {
   // Shorthand for isolate pointer.
   v8::Isolate* isolate_;
   v8::Global<v8::Context> context_;
-  bool should_purge_empty_cppgc_wrappers_ = false;
 
 #define V(PropertyName, TypeName) v8::Global<TypeName> PropertyName##_;
   PER_REALM_STRONG_PERSISTENT_VALUES(V)
 #undef V
 
-  static void PurgeEmptyCppgcWrappers(v8::Isolate* isolate,
-                                      v8::GCType type,
-                                      v8::GCCallbackFlags flags,
-                                      void* data);
-
  private:
   void InitializeContext(v8::Local<v8::Context> context,
                          const RealmSerializeInfo* realm_info);
diff --git a/src/node_snapshotable.cc b/src/node_snapshotable.cc
index 41b0773f4c37..1d0702ba59be 100644
--- a/src/node_snapshotable.cc
+++ b/src/node_snapshotable.cc
@@ -394,6 +394,7 @@ size_t SnapshotSerializer::Write(const ImmediateInfo::SerializeInfo& data) {
 // [ 4/8 bytes ]  snapshot index of root
 // [ 4/8 bytes ]  snapshot index of milestones
 // [ 4/8 bytes ]  snapshot index of observers
+// [ 4/8 bytes ]  snapshot index of uv_metrics
 template <>
 performance::PerformanceState::SerializeInfo SnapshotDeserializer::Read() {
   Debug("Read<PerformanceState::SerializeInfo>()\n");
@@ -402,6 +403,7 @@ performance::PerformanceState::SerializeInfo SnapshotDeserializer::Read() {
   result.root = ReadArithmetic<AliasedBufferIndex>();
   result.milestones = ReadArithmetic<AliasedBufferIndex>();
   result.observers = ReadArithmetic<AliasedBufferIndex>();
+  result.uv_metrics = ReadArithmetic<AliasedBufferIndex>();
   if (is_debug) {
     std::string str = ToStr(result);
     Debug("Read<PerformanceState::SerializeInfo>() %s\n", str);
@@ -420,6 +422,7 @@ size_t SnapshotSerializer::Write(
   size_t written_total = WriteArithmetic<AliasedBufferIndex>(data.root);
   written_total += WriteArithmetic<AliasedBufferIndex>(data.milestones);
   written_total += WriteArithmetic<AliasedBufferIndex>(data.observers);
+  written_total += WriteArithmetic<AliasedBufferIndex>(data.uv_metrics);
 
   Debug("Write<PerformanceState::SerializeInfo>() wrote %d bytes\n",
         written_total);
@@ -630,10 +633,6 @@ const SnapshotData* SnapshotData::FromEmbedderWrapper(
   return data != nullptr ? data->impl_ : nullptr;
 }
 
-EmbedderSnapshotData::Pointer SnapshotData::AsEmbedderWrapper() const {
-  return EmbedderSnapshotData::Pointer{new EmbedderSnapshotData(this, false)};
-}
-
 bool SnapshotData::FromFile(SnapshotData* out, FILE* in) {
   return FromBlob(out, ReadFileSync(in));
 }
@@ -703,7 +702,8 @@ bool SnapshotData::Check() const {
 
 SnapshotData::~SnapshotData() {
   if (data_ownership == DataOwnership::kOwned &&
-      v8_snapshot_blob_data.data != nullptr) {
+      v8_snapshot_blob_data.data != nullptr &&
+      !IsFirstSnapshotBlob(v8_snapshot_blob_data.data)) {
     delete[] v8_snapshot_blob_data.data;
   }
 }
@@ -1570,17 +1570,17 @@ void CompileSerializeMain(const FunctionCallbackInfo<Value>& args) {
   CHECK(args[0]->IsString());
   Local<String> filename = args[0].As<String>();
   Local<String> source = args[1].As<String>();
+  Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = args.GetIsolate();
   Local<Context> context = isolate->GetCurrentContext();
   // TODO(joyeecheung): do we need all of these? Maybe we would want a less
   // internal version of them.
-  LocalVector<String> parameters(
-      isolate,
-      {
-          FIXED_ONE_BYTE_STRING(isolate, "require"),
-          FIXED_ONE_BYTE_STRING(isolate, "__filename"),
-          FIXED_ONE_BYTE_STRING(isolate, "__dirname"),
-      });
+  LocalVector<String> parameters(isolate,
+                                 {
+                                     env->require_string(),
+                                     env->__filename_string(),
+                                     env->__dirname_string(),
+                                 });
 
   ScriptOrigin script_origin(filename, 0, 0, true);
   ScriptCompiler::Source script_source(source, script_origin);
diff --git a/src/node_snapshotable.h b/src/node_snapshotable.h
index 31be74bcfd56..ce9d791c623f 100644
--- a/src/node_snapshotable.h
+++ b/src/node_snapshotable.h
@@ -47,8 +47,11 @@ struct InternalFieldInfoBase {
                       std::is_same_v<InternalFieldInfoBase, T>,
                   "Can only accept InternalFieldInfoBase subclasses");
     void* buf = ::operator new[](sizeof(T));
-    memset(buf, 0, sizeof(T));  // Make the padding reproducible.
     T* result = new (buf) T;
+    // Zero the padding to make the bytes handed to V8 reproducible. Must come
+    // after the placement new, or -flifetime-dse drops it as a dead store.
+    // https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-fno-lifetime-dse
+    memset(static_cast<void*>(result), 0, sizeof(T));
     result->type = type;
     result->length = sizeof(T);
     return result;
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index ee6a2ece5426..a0a13c3537e7 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -5,7 +5,9 @@
 #include "env-inl.h"
 #include "memory_tracker-inl.h"
 #include "node.h"
+#include "node_diagnostics_channel.h"
 #include "node_errors.h"
+#include "node_external_reference.h"
 #include "node_mem-inl.h"
 #include "node_url.h"
 #include "simdutf.h"
@@ -79,6 +81,30 @@ inline MaybeLocal<String> Utf8StringMaybeOneByte(Isolate* isolate,
       isolate, input.data(), NewStringType::kNormal, len);
 }
 
+BindingData::BindingData(Realm* realm, Local<Object> wrap)
+    : BaseObject(realm, wrap) {
+  MakeWeak();
+}
+
+void BindingData::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackFieldWithSize("open_databases",
+                              open_databases.size() * sizeof(DatabaseSync*),
+                              "open_databases");
+}
+
+void BindingData::CreatePerContextProperties(Local<Object> target,
+                                             Local<Value> unused,
+                                             Local<Context> context,
+                                             void* priv) {
+  Realm* realm = Realm::GetCurrent(context);
+  Environment* env = realm->env();
+  Realm* principal = env->principal_realm();
+
+  if (principal->GetBindingData<BindingData>() != nullptr) return;
+
+  principal->AddBindingData<BindingData>(target);
+}
+
 #define CHECK_ERROR_OR_THROW(isolate, db, expr, expected, ret)                 \
   do {                                                                         \
     int r_ = (expr);                                                           \
@@ -96,6 +122,27 @@ inline MaybeLocal<String> Utf8StringMaybeOneByte(Isolate* isolate,
     }                                                                          \
   } while (0)
 
+// SQLite requires that an authorizer callback not modify the connection that
+// invoked it. Preparing and stepping statements both count as modifying it.
+// See https://www.sqlite.org/c3ref/set_authorizer.html.
+#define THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db)                             \
+  THROW_AND_RETURN_ON_BAD_STATE(                                               \
+      (env),                                                                   \
+      (db)->IsInAuthorizerCallback(),                                          \
+      "database cannot be accessed from an authorizer callback")
+
+// A statement's virtual machine cannot be reentered while sqlite3_step() is
+// running it. Finalizing it frees the VM outright, and re-running it resets the
+// VM mid-execution; both are use-after-free rather than merely a contract
+// violation. Callbacks that SQLite invokes during execution are therefore
+// barred from reaching the statement being stepped, though other statements on
+// the connection stay usable.
+#define THROW_AND_RETURN_IF_STEPPING(env, stmt)                                \
+  THROW_AND_RETURN_ON_BAD_STATE(                                               \
+      (env),                                                                   \
+      (stmt)->db_->IsSteppingStatement((stmt)->statement_),                    \
+      "statement is already being executed")
+
 #define SQLITE_VALUE_TO_JS(from, isolate, use_big_int_args, result, ...)       \
   do {                                                                         \
     switch (sqlite3_##from##_type(__VA_ARGS__)) {                              \
@@ -176,59 +223,49 @@ static constexpr const LimitInfo* GetLimitInfoFromName(std::string_view name) {
   return nullptr;
 }
 
-inline MaybeLocal<Object> CreateSQLiteError(Isolate* isolate,
-                                            const char* message) {
+namespace {
+MaybeLocal<Object> CreateSQLiteErrorImpl(Isolate* isolate,
+                                         const char* message,
+                                         const char* errstr,
+                                         int errcode) {
+  Environment* env = Environment::GetCurrent(isolate);
+  Local<Context> context = isolate->GetCurrentContext();
   Local<String> js_msg;
   Local<Object> e;
-  Environment* env = Environment::GetCurrent(isolate);
   if (!String::NewFromUtf8(isolate, message).ToLocal(&js_msg) ||
-      !Exception::Error(js_msg)
-           ->ToObject(isolate->GetCurrentContext())
-           .ToLocal(&e) ||
-      e->Set(isolate->GetCurrentContext(),
-             env->code_string(),
-             env->err_sqlite_error_string())
+      !Exception::Error(js_msg)->ToObject(context).ToLocal(&e) ||
+      e->Set(context, env->code_string(), env->err_sqlite_error_string())
           .IsNothing()) {
     return MaybeLocal<Object>();
   }
+
+  if (errstr != nullptr) {
+    Local<String> js_errstr;
+    if (!String::NewFromUtf8(isolate, errstr).ToLocal(&js_errstr) ||
+        e->Set(context, env->errcode_string(), Integer::New(isolate, errcode))
+            .IsNothing() ||
+        e->Set(context, env->errstr_string(), js_errstr).IsNothing()) {
+      return MaybeLocal<Object>();
+    }
+  }
   return e;
 }
+}  // namespace
+
+inline MaybeLocal<Object> CreateSQLiteError(Isolate* isolate,
+                                            const char* message) {
+  return CreateSQLiteErrorImpl(isolate, message, nullptr, 0);
+}
 
 inline MaybeLocal<Object> CreateSQLiteError(Isolate* isolate, int errcode) {
   const char* errstr = sqlite3_errstr(errcode);
-  Local<String> js_errmsg;
-  Local<Object> e;
-  Environment* env = Environment::GetCurrent(isolate);
-  if (!String::NewFromUtf8(isolate, errstr).ToLocal(&js_errmsg) ||
-      !CreateSQLiteError(isolate, errstr).ToLocal(&e) ||
-      e->Set(env->context(),
-             env->errcode_string(),
-             Integer::New(isolate, errcode))
-          .IsNothing() ||
-      e->Set(env->context(), env->errstr_string(), js_errmsg).IsNothing()) {
-    return MaybeLocal<Object>();
-  }
-  return e;
+  return CreateSQLiteErrorImpl(isolate, errstr, errstr, errcode);
 }
 
 inline MaybeLocal<Object> CreateSQLiteError(Isolate* isolate, sqlite3* db) {
   int errcode = sqlite3_extended_errcode(db);
-  const char* errstr = sqlite3_errstr(errcode);
-  const char* errmsg = sqlite3_errmsg(db);
-  Local<String> js_errmsg;
-  Local<Object> e;
-  Environment* env = Environment::GetCurrent(isolate);
-  if (!String::NewFromUtf8(isolate, errstr).ToLocal(&js_errmsg) ||
-      !CreateSQLiteError(isolate, errmsg).ToLocal(&e) ||
-      e->Set(isolate->GetCurrentContext(),
-             env->errcode_string(),
-             Integer::New(isolate, errcode))
-          .IsNothing() ||
-      e->Set(isolate->GetCurrentContext(), env->errstr_string(), js_errmsg)
-          .IsNothing()) {
-    return MaybeLocal<Object>();
-  }
-  return e;
+  return CreateSQLiteErrorImpl(
+      isolate, sqlite3_errmsg(db), sqlite3_errstr(errcode), errcode);
 }
 
 void JSValueToSQLiteResult(Isolate* isolate,
@@ -313,14 +350,14 @@ inline MaybeLocal<Value> NullableSQLiteStringToValue(Isolate* isolate,
 class CustomAggregate {
  public:
   explicit CustomAggregate(Environment* env,
-                           DatabaseSync* db,
+                           BaseObjectWeakPtr<DatabaseSync> db,
                            bool use_bigint_args,
                            Local<Value> start,
                            Local<Function> step_fn,
                            Local<Function> inverse_fn,
                            Local<Function> result_fn)
       : env_(env),
-        db_(db),
+        db_(std::move(db)),
         use_bigint_args_(use_bigint_args),
         start_(env->isolate(), start),
         step_fn_(env->isolate(), step_fn),
@@ -356,6 +393,7 @@ class CustomAggregate {
                                Global<Function> CustomAggregate::*mptr) {
     CustomAggregate* self =
         static_cast<CustomAggregate*>(sqlite3_user_data(ctx));
+    CallbackDepthGuard guard(self->db_.get());
     Environment* env = self->env_;
     Isolate* isolate = env->isolate();
     auto agg = self->GetAggregate(ctx);
@@ -402,12 +440,18 @@ class CustomAggregate {
       return;
     }
 
+    if (!self->db_->IsOpen()) {
+      THROW_ERR_INVALID_STATE(env, "database is not open");
+      return;
+    }
+
     agg->value.Reset(isolate, ret);
   }
 
   static inline void xValueBase(sqlite3_context* ctx, bool is_final) {
     CustomAggregate* self =
         static_cast<CustomAggregate*>(sqlite3_user_data(ctx));
+    CallbackDepthGuard guard(self->db_.get());
     Environment* env = self->env_;
     Isolate* isolate = env->isolate();
     auto agg = self->GetAggregate(ctx);
@@ -433,6 +477,9 @@ class CustomAggregate {
                .ToLocal(&result)) {
         self->db_->SetIgnoreNextSQLiteError(true);
         sqlite3_result_error(ctx, "", 0);
+      } else if (!self->db_->IsOpen()) {
+        THROW_ERR_INVALID_STATE(env, "database is not open");
+        return;
       }
     } else {
       result = Local<Value>::New(isolate, agg->value);
@@ -464,6 +511,10 @@ class CustomAggregate {
         auto fn = start_v.As<Function>();
         MaybeLocal<Value> retval =
             fn->Call(env_->context(), Null(isolate), 0, nullptr);
+        if (!db_->IsOpen()) {
+          THROW_ERR_INVALID_STATE(env_, "database is not open");
+          return nullptr;
+        }
         if (!retval.ToLocal(&start_v)) {
           db_->SetIgnoreNextSQLiteError(true);
           sqlite3_result_error(ctx, "", 0);
@@ -479,7 +530,7 @@ class CustomAggregate {
   }
 
   Environment* env_;
-  DatabaseSync* db_;
+  BaseObjectWeakPtr<DatabaseSync> db_;
   bool use_bigint_args_;
   Global<Value> start_;
   Global<Function> step_fn_;
@@ -538,9 +589,13 @@ class BackupJob : public ThreadPoolWork {
   }
 
   void AfterThreadPoolWork(int status) override {
-    HandleScope handle_scope(env()->isolate());
+    Isolate* isolate = env()->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env()->context());
+    InternalCallbackScope callback_scope(
+        env(), Object::New(isolate), {0, 0}, InternalCallbackScope::kNoFlags);
     Local<Promise::Resolver> resolver =
-        Local<Promise::Resolver>::New(env()->isolate(), resolver_);
+        Local<Promise::Resolver>::New(isolate, resolver_);
 
     if (!(backup_status_ == SQLITE_OK || backup_status_ == SQLITE_DONE ||
           backup_status_ == SQLITE_BUSY || backup_status_ == SQLITE_LOCKED)) {
@@ -662,11 +717,11 @@ class BackupJob : public ThreadPoolWork {
 
 UserDefinedFunction::UserDefinedFunction(Environment* env,
                                          Local<Function> fn,
-                                         DatabaseSync* db,
+                                         BaseObjectWeakPtr<DatabaseSync> db,
                                          bool use_bigint_args)
     : env_(env),
       fn_(env->isolate(), fn),
-      db_(db),
+      db_(std::move(db)),
       use_bigint_args_(use_bigint_args) {}
 
 UserDefinedFunction::~UserDefinedFunction() {}
@@ -676,6 +731,7 @@ void UserDefinedFunction::xFunc(sqlite3_context* ctx,
                                 sqlite3_value** argv) {
   UserDefinedFunction* self =
       static_cast<UserDefinedFunction*>(sqlite3_user_data(ctx));
+  CallbackDepthGuard guard(self->db_.get());
   Environment* env = self->env_;
   Isolate* isolate = env->isolate();
   auto recv = Undefined(isolate);
@@ -707,6 +763,12 @@ void UserDefinedFunction::xFunc(sqlite3_context* ctx,
 
   MaybeLocal<Value> retval =
       fn->Call(env->context(), recv, argc, js_argv.data());
+
+  if (!self->db_->IsOpen()) {
+    THROW_ERR_INVALID_STATE(env, "database is not open");
+    return;
+  }
+
   Local<Value> result;
   if (!retval.ToLocal(&result)) {
     // Ignore the SQLite error because a JavaScript exception is pending.
@@ -814,6 +876,12 @@ Intercepted DatabaseSyncLimits::LimitsSetter(
     return Intercepted::kYes;
   }
 
+  if (limits->database_->IsInAuthorizerCallback()) {
+    THROW_ERR_INVALID_STATE(
+        env, "database cannot be accessed from an authorizer callback");
+    return Intercepted::kYes;
+  }
+
   if (!value->IsNumber()) {
     THROW_ERR_INVALID_ARG_TYPE(
         isolate, "Limit value must be a non-negative integer or Infinity.");
@@ -903,6 +971,9 @@ DatabaseSync::DatabaseSync(Environment* env,
   enable_load_extension_ = allow_load_extension;
   ignore_next_sqlite_error_ = false;
 
+  BindingData* binding = env->principal_realm()->GetBindingData<BindingData>();
+  if (binding != nullptr) binding->open_databases.insert(this);
+
   if (open) {
     Open();
   }
@@ -925,6 +996,10 @@ void DatabaseSync::DeleteSessions() {
 }
 
 DatabaseSync::~DatabaseSync() {
+  BindingData* binding =
+      env()->principal_realm()->GetBindingData<BindingData>();
+  if (binding != nullptr) binding->open_databases.erase(this);
+
   FinalizeBackups();
 
   if (IsOpen()) {
@@ -1022,10 +1097,29 @@ bool DatabaseSync::Open() {
         env()->isolate(), this, load_extension_ret, SQLITE_OK, false);
   }
 
+  trace_channel_ = diagnostics_channel::Channel::Get(env(), "sqlite.db.query");
+  if (trace_channel_ && trace_channel_->HasSubscribers()) {
+    sqlite3_trace_v2(connection_, SQLITE_TRACE_PROFILE, TraceCallback, this);
+  }
+
   opened = true;
   return true;
 }
 
+void DatabaseSync::EnableTracing() {
+  if (!IsOpen()) return;
+  if (!trace_channel_) {
+    trace_channel_ =
+        diagnostics_channel::Channel::Get(env(), "sqlite.db.query");
+  }
+  sqlite3_trace_v2(connection_, SQLITE_TRACE_PROFILE, TraceCallback, this);
+}
+
+void DatabaseSync::DisableTracing() {
+  if (!IsOpen()) return;
+  sqlite3_trace_v2(connection_, 0, nullptr, nullptr);
+}
+
 void DatabaseSync::FinalizeBackups() {
   for (auto backup : backups_) {
     backup->Cleanup();
@@ -1043,10 +1137,7 @@ void DatabaseSync::FinalizeStatements() {
 }
 
 void DatabaseSync::UntrackStatement(StatementSync* statement) {
-  auto it = statements_.find(statement);
-  if (it != statements_.end()) {
-    statements_.erase(it);
-  }
+  statements_.erase(statement);
 }
 
 inline bool DatabaseSync::IsOpen() {
@@ -1073,6 +1164,7 @@ void DatabaseSync::CreateTagStore(const FunctionCallbackInfo<Value>& args) {
     THROW_ERR_INVALID_STATE(env, "database is not open");
     return;
   }
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
   int capacity = 1000;
   if (args.Length() > 0 && !args[0]->IsUndefined()) {
     if (!args[0]->IsNumber()) {
@@ -1129,7 +1221,11 @@ std::optional<std::string> ValidateDatabasePath(Environment* env,
       Utf8Value location_value(env->isolate(), href.As<String>());
       auto location = location_value.ToStringView();
       if (!has_null_bytes(location)) {
-        CHECK(ada::can_parse(location));
+        if (!ada::can_parse(location)) {
+          THROW_ERR_INVALID_URL(env->isolate(), "Invalid URL");
+          return std::nullopt;
+        }
+
         if (!location.starts_with("file:")) {
           THROW_ERR_INVALID_URL_SCHEME(env->isolate());
           return std::nullopt;
@@ -1453,6 +1549,8 @@ void DatabaseSync::Close(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env, db->IsInCallback(), "database cannot be closed while in a callback");
   db->FinalizeStatements();
   db->DeleteSessions();
   int r = sqlite3_close_v2(db->connection_);
@@ -1473,6 +1571,7 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   if (!args[0]->IsString()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -1606,6 +1705,7 @@ void DatabaseSync::Exec(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   if (!args[0]->IsString()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -1630,6 +1730,7 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   if (!args[0]->IsString()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -1744,8 +1845,8 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
     argc = js_len.As<Int32>()->Value();
   }
 
-  UserDefinedFunction* user_data =
-      new UserDefinedFunction(env, fn, db, use_bigint_args);
+  UserDefinedFunction* user_data = new UserDefinedFunction(
+      env, fn, BaseObjectWeakPtr<DatabaseSync>(db), use_bigint_args);
   int text_rep = SQLITE_UTF8;
 
   if (deterministic) {
@@ -1803,6 +1904,7 @@ void DatabaseSync::Serialize(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   std::string db_name = "main";
   if (!args[0]->IsUndefined()) {
@@ -1858,6 +1960,10 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env,
+      db->IsInCallback(),
+      "database cannot be deserialized while in a callback");
 
   if (!args[0]->IsUint8Array()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -1933,6 +2039,7 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
   Utf8Value name(env->isolate(), args[0].As<String>());
   Local<Object> options = args[1].As<Object>();
   Local<Value> start_v;
@@ -2066,22 +2173,23 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
 
   auto xInverse = !inverseFunc.IsEmpty() ? CustomAggregate::xInverse : nullptr;
   auto xValue = xInverse ? CustomAggregate::xValue : nullptr;
-  int r = sqlite3_create_window_function(db->connection_,
-                                         *name,
-                                         argc,
-                                         text_rep,
-                                         new CustomAggregate(env,
-                                                             db,
-                                                             use_bigint_args,
-                                                             start_v,
-                                                             stepFunction,
-                                                             inverseFunc,
-                                                             resultFunction),
-                                         CustomAggregate::xStep,
-                                         CustomAggregate::xFinal,
-                                         xValue,
-                                         xInverse,
-                                         CustomAggregate::xDestroy);
+  int r = sqlite3_create_window_function(
+      db->connection_,
+      *name,
+      argc,
+      text_rep,
+      new CustomAggregate(env,
+                          BaseObjectWeakPtr<DatabaseSync>(db),
+                          use_bigint_args,
+                          start_v,
+                          stepFunction,
+                          inverseFunc,
+                          resultFunction),
+      CustomAggregate::xStep,
+      CustomAggregate::xFinal,
+      xValue,
+      xInverse,
+      CustomAggregate::xDestroy);
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
 }
 
@@ -2143,6 +2251,7 @@ void DatabaseSync::CreateSession(const FunctionCallbackInfo<Value>& args) {
   DatabaseSync* db;
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   sqlite3_session* pSession;
   int r = sqlite3session_create(db->connection_, db_name.c_str(), &pSession);
@@ -2312,6 +2421,7 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   if (!args[0]->IsUint8Array()) {
     THROW_ERR_INVALID_ARG_TYPE(
@@ -2321,6 +2431,7 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
 
   Local<Function> conflictFunc;
   Local<Function> filterFunc;
+  bool filterCallbackFailed = false;
   if (args.Length() > 1 && !args[1]->IsUndefined()) {
     if (!args[1]->IsObject()) {
       THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -2382,25 +2493,25 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
 
       filterFunc = filterValue.As<Function>();
 
-      context.filterCallback =
-          [env, db, &filterFunc](std::string_view item) -> bool {
+      context.filterCallback = [env, &filterFunc, &filterCallbackFailed](
+                                   std::string_view item) -> bool {
         // If there was an error in the previous call to the filter's
         // callback, we skip calling it again.
-        if (db->ignore_next_sqlite_error_) {
+        if (filterCallbackFailed) {
           return false;
         }
 
         Local<Value> argv[1];
         if (!ToV8Value(env->context(), item, env->isolate())
                  .ToLocal(&argv[0])) {
-          db->SetIgnoreNextSQLiteError(true);
+          filterCallbackFailed = true;
           return false;
         }
 
         Local<Value> result;
         if (!filterFunc->Call(env->context(), Null(env->isolate()), 1, argv)
                  .ToLocal(&result)) {
-          db->SetIgnoreNextSQLiteError(true);
+          filterCallbackFailed = true;
           return false;
         }
 
@@ -2417,13 +2528,17 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
   BaseObjectPtr<DatabaseSync> guard(db);
 
   ArrayBufferViewContents<uint8_t> buf(args[0]);
-  int r = sqlite3changeset_apply(
-      db->connection_,
-      buf.length(),
-      const_cast<void*>(static_cast<const void*>(buf.data())),
-      context.filterCallback ? xFilter : nullptr,
-      xConflict,
-      static_cast<void*>(&context));
+  int r;
+  {
+    CallbackDepthGuard guard(db);
+    r = sqlite3changeset_apply(
+        db->connection_,
+        buf.length(),
+        const_cast<void*>(static_cast<const void*>(buf.data())),
+        context.filterCallback ? xFilter : nullptr,
+        xConflict,
+        static_cast<void*>(&context));
+  }
   if (r == SQLITE_OK) {
     args.GetReturnValue().Set(true);
     return;
@@ -2442,6 +2557,7 @@ void DatabaseSync::EnableLoadExtension(
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   Isolate* isolate = env->isolate();
   if (!args[0]->IsBoolean()) {
@@ -2470,6 +2586,7 @@ void DatabaseSync::EnableDefensive(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   Isolate* isolate = env->isolate();
   if (!args[0]->IsBoolean()) {
@@ -2495,6 +2612,7 @@ void DatabaseSync::LoadExtension(const FunctionCallbackInfo<Value>& args) {
       env, !db->allow_load_extension_, "extension loading is not allowed");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !db->enable_load_extension_, "extension loading is not allowed");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   if (!args[0]->IsString()) {
     THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -2523,6 +2641,7 @@ void DatabaseSync::SetAuthorizer(const FunctionCallbackInfo<Value>& args) {
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   Isolate* isolate = env->isolate();
 
@@ -2558,6 +2677,8 @@ int DatabaseSync::AuthorizerCallback(void* user_data,
                                      const char* param3,
                                      const char* param4) {
   DatabaseSync* db = static_cast<DatabaseSync*>(user_data);
+  CallbackDepthGuard guard(db);
+  AuthorizerDepthGuard authorizer_guard(db);
   Environment* env = db->env();
   Isolate* isolate = env->isolate();
   HandleScope handle_scope(isolate);
@@ -2625,6 +2746,67 @@ int DatabaseSync::AuthorizerCallback(void* user_data,
   return int_result;
 }
 
+int DatabaseSync::TraceCallback(unsigned int type,
+                                void* user_data,
+                                void* p,
+                                void* x) {
+  if (type != SQLITE_TRACE_PROFILE) {
+    return 0;
+  }
+
+  DatabaseSync* db = static_cast<DatabaseSync*>(user_data);
+  Environment* env = db->env();
+
+  diagnostics_channel::Channel* ch = db->trace_channel_.get();
+  if (ch == nullptr || !ch->HasSubscribers() ||
+      db->AreTraceEventsSuppressed()) {
+    return 0;
+  }
+
+  Isolate* isolate = env->isolate();
+  HandleScope handle_scope(isolate);
+
+  char* expanded = sqlite3_expanded_sql(static_cast<sqlite3_stmt*>(p));
+  Local<Value> sql_string;
+  if (expanded != nullptr) {
+    bool ok = String::NewFromUtf8(isolate, expanded).ToLocal(&sql_string);
+    sqlite3_free(expanded);
+    if (!ok) {
+      return 0;
+    }
+  } else {
+    // Fallback to source SQL if expanded is unavailable
+    const char* source = sqlite3_sql(static_cast<sqlite3_stmt*>(p));
+    if (source == nullptr ||
+        !String::NewFromUtf8(isolate, source).ToLocal(&sql_string)) {
+      return 0;
+    }
+  }
+
+  // x points to the estimated statement run time in nanoseconds. A double is
+  // sufficient since 2^53 ns (~104 days) exceeds any realistic query duration.
+  sqlite3_int64 duration_ns = *static_cast<sqlite3_int64*>(x);
+
+  Local<Name> keys[3] = {
+      env->sql_string().As<Name>(),
+      env->database_string().As<Name>(),
+      env->duration_string().As<Name>(),
+  };
+
+  Local<Value> values[3] = {
+      sql_string,
+      db->object(),
+      Number::New(isolate, static_cast<double>(duration_ns)),
+  };
+
+  Local<Object> payload = Object::New(isolate, Null(isolate), keys, values, 3);
+
+  CallbackDepthGuard guard(db);
+  ch->Publish(env, payload);
+
+  return 0;
+}
+
 StatementSync::StatementSync(Environment* env,
                              Local<Object> object,
                              BaseObjectPtr<DatabaseSync> db,
@@ -2641,6 +2823,10 @@ StatementSync::StatementSync(Environment* env,
 }
 
 StatementSync::~StatementSync() {
+  Close();
+}
+
+void StatementSync::Close() {
   if (!IsFinalized()) {
     db_->UntrackStatement(this);
     Finalize();
@@ -2648,6 +2834,7 @@ StatementSync::~StatementSync() {
 }
 
 void StatementSync::Finalize() {
+  TraceEventSuppressionGuard trace_guard(db_.get());
   sqlite3_finalize(statement_);
   statement_ = nullptr;
   InvalidateColumnNameCache();
@@ -2661,6 +2848,29 @@ inline bool StatementSync::IsFinalized() {
   return statement_ == nullptr;
 }
 
+void StatementSync::Close(const FunctionCallbackInfo<Value>& args) {
+  StatementSync* stmt;
+  ASSIGN_OR_RETURN_UNWRAP(&stmt, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  THROW_AND_RETURN_ON_BAD_STATE(
+      env, stmt->IsFinalized(), "statement has been finalized");
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
+  stmt->Close();
+}
+
+void StatementSync::Dispose(const FunctionCallbackInfo<Value>& args) {
+  StatementSync* stmt;
+  ASSIGN_OR_RETURN_UNWRAP(&stmt, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  // Disposal is idempotent, so an already-finalized statement is a no-op even
+  // inside a callback.
+  if (stmt->IsFinalized()) {
+    return;
+  }
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
+  stmt->Close();
+}
+
 inline int StatementSync::ResetStatement() {
   reset_generation_++;
   return sqlite3_reset(statement_);
@@ -2938,6 +3148,7 @@ MaybeLocal<Value> StatementExecutionHelper::All(Environment* env,
   LocalVector<Value> row_values(isolate);
   LocalVector<Name> row_keys(isolate);
 
+  SteppingStatementGuard stepping(db, stmt);
   while ((r = sqlite3_step(stmt)) == SQLITE_ROW) {
     if (num_cols == 0) {
       num_cols = sqlite3_column_count(stmt);
@@ -2980,6 +3191,9 @@ MaybeLocal<Object> StatementExecutionHelper::Run(Environment* env,
                                                  bool use_big_ints) {
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
+  // Declared before the reset below so that it outlives it: sqlite3_reset()
+  // can run JavaScript through an aggregate's xFinal.
+  SteppingStatementGuard stepping(db, stmt);
   sqlite3_step(stmt);
   int r = sqlite3_reset(stmt);
   CHECK_ERROR_OR_THROW(isolate, db, r, SQLITE_OK, MaybeLocal<Object>());
@@ -3056,6 +3270,9 @@ MaybeLocal<Value> StatementExecutionHelper::Get(Environment* env,
                                                 bool use_big_ints) {
   Isolate* isolate = env->isolate();
   EscapableHandleScope scope(isolate);
+  // Declared before the reset below so that it outlives it: sqlite3_reset()
+  // can run JavaScript through an aggregate's xFinal.
+  SteppingStatementGuard stepping(db, stmt);
   auto reset = OnScopeLeave([&]() { sqlite3_reset(stmt); });
 
   int r = sqlite3_step(stmt);
@@ -3102,6 +3319,8 @@ void StatementSync::All(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
   Isolate* isolate = env->isolate();
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(isolate, stmt->db_.get(), r, SQLITE_OK, void());
@@ -3129,6 +3348,8 @@ void StatementSync::Iterate(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 
@@ -3152,6 +3373,8 @@ void StatementSync::Get(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 
@@ -3176,6 +3399,8 @@ void StatementSync::Run(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_AND_RETURN_ON_BAD_STATE(
       env, stmt->IsFinalized(), "statement has been finalized");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, stmt->db_.get());
+  THROW_AND_RETURN_IF_STEPPING(env, stmt);
   int r = stmt->ResetStatement();
   CHECK_ERROR_OR_THROW(env->isolate(), stmt->db_.get(), r, SQLITE_OK, void());
 
@@ -3458,6 +3683,7 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
 
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !session->database_->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   BaseObjectPtr<StatementSync> stmt = PrepareStatement(args);
 
@@ -3465,6 +3691,8 @@ void SQLTagStore::Run(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  THROW_AND_RETURN_IF_STEPPING(env, stmt.get());
+
   if (!ResetAndBindStatement(env, stmt.get(), args)) {
     return;
   }
@@ -3484,6 +3712,7 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
 
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !session->database_->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   BaseObjectPtr<StatementSync> stmt = PrepareStatement(args);
 
@@ -3491,6 +3720,8 @@ void SQLTagStore::Iterate(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  THROW_AND_RETURN_IF_STEPPING(env, stmt.get());
+
   if (!ResetAndBindStatement(env, stmt.get(), args)) {
     return;
   }
@@ -3512,6 +3743,7 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
 
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !session->database_->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   BaseObjectPtr<StatementSync> stmt = PrepareStatement(args);
 
@@ -3519,6 +3751,8 @@ void SQLTagStore::Get(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  THROW_AND_RETURN_IF_STEPPING(env, stmt.get());
+
   if (!ResetAndBindStatement(env, stmt.get(), args)) {
     return;
   }
@@ -3541,6 +3775,7 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 
   THROW_AND_RETURN_ON_BAD_STATE(
       env, !session->database_->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   BaseObjectPtr<StatementSync> stmt = PrepareStatement(args);
 
@@ -3548,6 +3783,8 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  THROW_AND_RETURN_IF_STEPPING(env, stmt.get());
+
   if (!ResetAndBindStatement(env, stmt.get(), args)) {
     return;
   }
@@ -3567,6 +3804,10 @@ void SQLTagStore::All(const FunctionCallbackInfo<Value>& args) {
 void SQLTagStore::Clear(const FunctionCallbackInfo<Value>& args) {
   SQLTagStore* store;
   ASSIGN_OR_RETURN_UNWRAP(&store, args.This());
+  // Clearing the cache drops strong references to the cached statements but
+  // never finalizes one synchronously, so it touches no SQLite state and stays
+  // available from a callback. Invalidating the cache after a schema change is
+  // a legitimate use of an authorizer.
   store->sql_tags_.Clear();
 }
 
@@ -3699,6 +3940,8 @@ Local<FunctionTemplate> StatementSync::GetConstructorTemplate(
         isolate, tmpl, "setReadBigInts", StatementSync::SetReadBigInts);
     SetProtoMethod(
         isolate, tmpl, "setReturnArrays", StatementSync::SetReturnArrays);
+    SetProtoMethod(isolate, tmpl, "close", StatementSync::Close);
+    SetProtoDispose(isolate, tmpl, StatementSync::Dispose);
     env->set_sqlite_statement_sync_constructor_template(tmpl);
   }
   return tmpl;
@@ -3769,6 +4012,8 @@ void StatementSyncIterator::Next(const FunctionCallbackInfo<Value>& args) {
 
   auto iter_template = getLazyIterTemplate(env);
 
+  // A drained iterator touches no SQLite state, so it stays usable from a
+  // callback and is checked before the guards below.
   if (iter->done_) {
     MaybeLocal<Value> values[]{
         Boolean::New(isolate, true),
@@ -3782,11 +4027,18 @@ void StatementSyncIterator::Next(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, iter->stmt_->db_.get());
+  THROW_AND_RETURN_IF_STEPPING(env, iter->stmt_.get());
+
   THROW_AND_RETURN_ON_BAD_STATE(
       env,
       iter->statement_reset_generation_ != iter->stmt_->reset_generation_,
       "iterator was invalidated");
 
+  // sqlite3_reset() can run JavaScript through an aggregate's xFinal, so it
+  // stays inside the guard.
+  SteppingStatementGuard stepping(iter->stmt_->db_.get(),
+                                  iter->stmt_->statement_);
   int r = sqlite3_step(iter->stmt_->statement_);
   if (r != SQLITE_ROW) {
     CHECK_ERROR_OR_THROW(
@@ -3844,7 +4096,18 @@ void StatementSyncIterator::Return(const FunctionCallbackInfo<Value>& args) {
       env, iter->stmt_->IsFinalized(), "statement has been finalized");
   Isolate* isolate = env->isolate();
 
-  sqlite3_reset(iter->stmt_->statement_);
+  if (!iter->done_) {
+    // A language-invoked return() cannot be reached mid-step, since the loop
+    // body only runs after next() has returned, so these guards only reject an
+    // explicit call from inside a callback.
+    THROW_AND_RETURN_IF_IN_AUTHORIZER(env, iter->stmt_->db_.get());
+    THROW_AND_RETURN_IF_STEPPING(env, iter->stmt_.get());
+    // Unlike Next(), the reset result is intentionally ignored here: Return()
+    // is invoked by the language during abrupt completion (e.g. a `throw`
+    // inside a `for...of` body), and throwing on a deferred SQLite error
+    // would discard the caller's already-pending exception.
+    sqlite3_reset(iter->stmt_->statement_);
+  }
   iter->done_ = true;
 
   auto iter_template = getLazyIterTemplate(env);
@@ -3920,6 +4183,7 @@ void Session::Changeset(const FunctionCallbackInfo<Value>& args) {
       env, !session->database_->IsOpen(), "database is not open");
   THROW_AND_RETURN_ON_BAD_STATE(
       env, session->session_ == nullptr, "session is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, session->database_.get());
 
   session->is_generating_changeset_ = true;
   auto changeset_guard =
@@ -4031,7 +4295,31 @@ static void Initialize(Local<Object> target,
                        Local<Context> context,
                        void* priv) {
   Environment* env = Environment::GetCurrent(context);
+  Realm* realm = env->principal_realm();
   Isolate* isolate = env->isolate();
+
+  // Set up the per-Environment database registry.
+  BindingData::CreatePerContextProperties(target, unused, context, priv);
+
+  // Register a native callback on the sqlite.db.query diagnostic channel so
+  // that SQLite tracing is enabled/disabled as subscribers come and go.
+  auto* diag_binding =
+      realm->GetBindingData<diagnostics_channel::BindingData>();
+  auto* sqlite_bd = realm->GetBindingData<BindingData>();
+  if (diag_binding != nullptr && sqlite_bd != nullptr) {
+    uint32_t idx = diag_binding->GetOrCreateChannelIndex("sqlite.db.query");
+    BaseObjectPtr<BindingData> bd_ptr(sqlite_bd);
+    diag_binding->SetChannelStatusCallback(idx, [bd_ptr](bool is_active) {
+      BindingData* bd = bd_ptr.get();
+      if (bd == nullptr) return;
+      for (DatabaseSync* db : bd->open_databases) {
+        if (is_active)
+          db->EnableTracing();
+        else
+          db->DisableTracing();
+      }
+    });
+  }
   Local<FunctionTemplate> db_tmpl =
       NewFunctionTemplate(isolate, DatabaseSync::New);
   db_tmpl->InstanceTemplate()->SetInternalFieldCount(
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 9c7a4380dcf5..442f291b05d6 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -9,6 +9,7 @@
 #include "sqlite3.h"
 #include "util.h"
 
+#include <algorithm>
 #include <array>
 #include <list>
 #include <map>
@@ -18,6 +19,13 @@
 #include <vector>
 
 namespace node {
+
+namespace diagnostics_channel {
+class Channel;
+}  // namespace diagnostics_channel
+
+class ExternalReferenceRegistry;
+
 namespace sqlite {
 
 // Mapping from JavaScript property names to SQLite limit constants
@@ -162,6 +170,27 @@ class StatementExecutionHelper {
                                        bool use_big_ints);
 };
 
+class DatabaseSync;
+
+class BindingData : public BaseObject {
+ public:
+  SET_BINDING_ID(sqlite_binding_data)
+
+  BindingData(Realm* realm, v8::Local<v8::Object> wrap);
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(BindingData)
+  SET_SELF_SIZE(BindingData)
+
+  std::unordered_set<DatabaseSync*> open_databases;
+
+  static void CreatePerContextProperties(v8::Local<v8::Object> target,
+                                         v8::Local<v8::Value> unused,
+                                         v8::Local<v8::Context> context,
+                                         void* priv);
+  static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
+};
+
 class DatabaseSync : public BaseObject {
  public:
   enum InternalFields {
@@ -206,6 +235,10 @@ class DatabaseSync : public BaseObject {
                                 const char* param2,
                                 const char* param3,
                                 const char* param4);
+  static int TraceCallback(unsigned int type,
+                           void* user_data,
+                           void* p,
+                           void* x);
   void FinalizeStatements();
   void RemoveBackup(BackupJob* backup);
   void AddBackup(BackupJob* backup);
@@ -228,6 +261,36 @@ class DatabaseSync : public BaseObject {
   // enable that use case.
   void SetIgnoreNextSQLiteError(bool ignore);
   bool ShouldIgnoreSQLiteError();
+  void EnableTracing();
+  void DisableTracing();
+
+  void IncrementCallbackDepth() { ++callback_depth_; }
+  void DecrementCallbackDepth() { --callback_depth_; }
+  bool IsInCallback() const { return callback_depth_ > 0; }
+
+  // SQLite forbids an authorizer callback from doing anything that modifies
+  // the database connection that invoked it, which includes preparing and
+  // stepping statements. See https://www.sqlite.org/c3ref/set_authorizer.html.
+  void IncrementAuthorizerDepth() { ++authorizer_depth_; }
+  void DecrementAuthorizerDepth() { --authorizer_depth_; }
+  bool IsInAuthorizerCallback() const { return authorizer_depth_ > 0; }
+
+  // Finalizing a statement frees its virtual machine, so a callback that
+  // SQLite invokes from inside sqlite3_step() must not finalize the statement
+  // being stepped. Other statements on the connection are safe to finalize.
+  void PushSteppingStatement(sqlite3_stmt* stmt) {
+    stepping_statements_.push_back(stmt);
+  }
+  void PopSteppingStatement() { stepping_statements_.pop_back(); }
+  bool IsSteppingStatement(sqlite3_stmt* stmt) const {
+    return std::find(stepping_statements_.begin(),
+                     stepping_statements_.end(),
+                     stmt) != stepping_statements_.end();
+  }
+
+  void IncrementTraceSuppressionDepth() { ++trace_suppression_depth_; }
+  void DecrementTraceSuppressionDepth() { --trace_suppression_depth_; }
+  bool AreTraceEventsSuppressed() const { return trace_suppression_depth_ > 0; }
 
   SET_MEMORY_INFO_NAME(DatabaseSync)
   SET_SELF_SIZE(DatabaseSync)
@@ -242,10 +305,15 @@ class DatabaseSync : public BaseObject {
   bool enable_load_extension_;
   sqlite3* connection_;
   bool ignore_next_sqlite_error_;
+  int callback_depth_ = 0;
+  int authorizer_depth_ = 0;
+  int trace_suppression_depth_ = 0;
+  std::vector<sqlite3_stmt*> stepping_statements_;
 
   std::set<BackupJob*> backups_;
   std::unordered_set<Session*> sessions_;
   std::unordered_set<StatementSync*> statements_;
+  BaseObjectPtr<diagnostics_channel::Channel> trace_channel_;
 
   friend class DatabaseSyncLimits;
   friend class Session;
@@ -279,6 +347,8 @@ class StatementSync : public BaseObject {
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetReadBigInts(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetReturnArrays(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Close(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Dispose(const v8::FunctionCallbackInfo<v8::Value>& args);
   v8::MaybeLocal<v8::Value> ColumnToValue(const int column);
   v8::MaybeLocal<v8::Name> ColumnNameToName(const int column);
   bool GetCachedColumnNames(v8::LocalVector<v8::Name>* keys);
@@ -290,6 +360,7 @@ class StatementSync : public BaseObject {
 
  private:
   ~StatementSync() override;
+  void Close();
   BaseObjectPtr<DatabaseSync> db_;
   sqlite3_stmt* statement_;
   bool return_arrays_ = false;
@@ -406,11 +477,64 @@ class SQLTagStore : public BaseObject {
   friend class StatementExecutionHelper;
 };
 
+class CallbackDepthGuard {
+ public:
+  explicit CallbackDepthGuard(DatabaseSync* db) : db_(db) {
+    db_->IncrementCallbackDepth();
+  }
+  ~CallbackDepthGuard() { db_->DecrementCallbackDepth(); }
+  CallbackDepthGuard(const CallbackDepthGuard&) = delete;
+  CallbackDepthGuard& operator=(const CallbackDepthGuard&) = delete;
+
+ private:
+  DatabaseSync* db_;
+};
+
+class TraceEventSuppressionGuard {
+ public:
+  explicit TraceEventSuppressionGuard(DatabaseSync* db) : db_(db) {
+    db_->IncrementTraceSuppressionDepth();
+  }
+  ~TraceEventSuppressionGuard() { db_->DecrementTraceSuppressionDepth(); }
+  TraceEventSuppressionGuard(const TraceEventSuppressionGuard&) = delete;
+  TraceEventSuppressionGuard& operator=(const TraceEventSuppressionGuard&) =
+      delete;
+
+ private:
+  DatabaseSync* db_;
+};
+
+class SteppingStatementGuard {
+ public:
+  SteppingStatementGuard(DatabaseSync* db, sqlite3_stmt* stmt) : db_(db) {
+    db_->PushSteppingStatement(stmt);
+  }
+  ~SteppingStatementGuard() { db_->PopSteppingStatement(); }
+  SteppingStatementGuard(const SteppingStatementGuard&) = delete;
+  SteppingStatementGuard& operator=(const SteppingStatementGuard&) = delete;
+
+ private:
+  DatabaseSync* db_;
+};
+
+class AuthorizerDepthGuard {
+ public:
+  explicit AuthorizerDepthGuard(DatabaseSync* db) : db_(db) {
+    db_->IncrementAuthorizerDepth();
+  }
+  ~AuthorizerDepthGuard() { db_->DecrementAuthorizerDepth(); }
+  AuthorizerDepthGuard(const AuthorizerDepthGuard&) = delete;
+  AuthorizerDepthGuard& operator=(const AuthorizerDepthGuard&) = delete;
+
+ private:
+  DatabaseSync* db_;
+};
+
 class UserDefinedFunction {
  public:
   UserDefinedFunction(Environment* env,
                       v8::Local<v8::Function> fn,
-                      DatabaseSync* db,
+                      BaseObjectWeakPtr<DatabaseSync> db,
                       bool use_bigint_args);
   ~UserDefinedFunction();
   static void xFunc(sqlite3_context* ctx, int argc, sqlite3_value** argv);
@@ -419,7 +543,7 @@ class UserDefinedFunction {
  private:
   Environment* env_;
   v8::Global<v8::Function> fn_;
-  DatabaseSync* db_;
+  BaseObjectWeakPtr<DatabaseSync> db_;
   bool use_bigint_args_;
 };
 
diff --git a/src/node_task_runner.cc b/src/node_task_runner.cc
index 4e20279fa2e7..55f348afc69a 100644
--- a/src/node_task_runner.cc
+++ b/src/node_task_runner.cc
@@ -127,7 +127,7 @@ void ProcessRunner::SetEnvironmentVariables() {
   // Add NODE_RUN_PACKAGE_JSON_PATH environment variable to the environment to
   // indicate which package.json is being processed.
   env_vars_.push_back("NODE_RUN_PACKAGE_JSON_PATH=" +
-                      package_json_path_.string());
+                      ConvertPathToUTF8(package_json_path_));
 
   env_ = std::unique_ptr<char*[]>(new char*[env_vars_.size() + 1]);
   options_.env = env_.get();
@@ -211,7 +211,7 @@ void ProcessRunner::OnExit(int64_t exit_status, int term_signal) {
 
 void ProcessRunner::Run() {
   // keeps the string alive until destructor
-  cwd_ = package_json_path_.parent_path().string();
+  cwd_ = ConvertPathToUTF8(package_json_path_.parent_path());
   options_.cwd = cwd_.c_str();
   if (int r = uv_spawn(loop_, &process_, &options_)) {
     fprintf(stderr, "Error: %s\n", uv_strerror(r));
@@ -233,14 +233,14 @@ FindPackageJson(const std::filesystem::path& cwd) {
     // Append "path/node_modules/.bin" to the env var, if it is a directory.
     auto node_modules_bin = directory_path / "node_modules" / ".bin";
     if (std::filesystem::is_directory(node_modules_bin)) {
-      path_env_var += node_modules_bin.string() + env_var_separator;
+      path_env_var += ConvertPathToUTF8(node_modules_bin) + env_var_separator;
     }
 
     if (raw_content.empty()) {
       package_json_path = directory_path / "package.json";
       // This is required for Windows because std::filesystem::path::c_str()
       // returns wchar_t* on Windows, and char* on other platforms.
-      std::string contents = package_json_path.string();
+      std::string contents = ConvertPathToUTF8(package_json_path);
       USE(ReadFileSync(&raw_content, contents.c_str()) > 0);
     }
   }
@@ -254,6 +254,27 @@ FindPackageJson(const std::filesystem::path& cwd) {
   return {{package_json_path, raw_content, path_env_var}};
 }
 
+// Prints every "name: command" pair in the scripts object to the given stream.
+static void PrintScripts(FILE* out,
+                         simdjson::ondemand::object& scripts_object) {
+  // Reset the object to iterate from the beginning, in case it was read before.
+  scripts_object.reset();
+  simdjson::ondemand::value value;
+  for (auto field : scripts_object) {
+    std::string_view key_str;
+    std::string_view value_str;
+    if (!field.unescaped_key().get(key_str) && !field.value().get(value) &&
+        !value.get_string().get(value_str)) {
+      fprintf(out,
+              "  %.*s: %.*s\n",
+              static_cast<int>(key_str.size()),
+              key_str.data(),
+              static_cast<int>(value_str.size()),
+              value_str.data());
+    }
+  }
+}
+
 void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
              std::string_view command_id,
              const std::vector<std::string_view>& positional_args) {
@@ -263,7 +284,7 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
   if (!package_json.has_value()) {
     fprintf(stderr,
             "Can't find package.json for directory %s\n",
-            cwd.string().c_str());
+            ConvertPathToUTF8(cwd).c_str());
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
   }
@@ -279,7 +300,7 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
   simdjson::ondemand::object main_object;
 
   if (json_parser.iterate(raw_json).get(document)) {
-    fprintf(stderr, "Can't parse %s\n", path.string().c_str());
+    fprintf(stderr, "Can't parse %s\n", ConvertPathToUTF8(path).c_str());
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
   }
@@ -288,9 +309,9 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
     if (root_error == simdjson::error_code::INCORRECT_TYPE) {
       fprintf(stderr,
               "Root value unexpected not an object for %s\n\n",
-              path.string().c_str());
+              ConvertPathToUTF8(path).c_str());
     } else {
-      fprintf(stderr, "Can't parse %s\n", path.string().c_str());
+      fprintf(stderr, "Can't parse %s\n", ConvertPathToUTF8(path).c_str());
     }
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
@@ -299,12 +320,23 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
   // If package_json object doesn't have "scripts" field, throw an error.
   simdjson::ondemand::object scripts_object;
   if (main_object["scripts"].get_object().get(scripts_object)) {
-    fprintf(
-        stderr, "Can't find \"scripts\" field in %s\n", path.string().c_str());
+    fprintf(stderr,
+            "Can't find \"scripts\" field in %s\n",
+            ConvertPathToUTF8(path).c_str());
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
   }
 
+  // With no command (e.g. bare `node --run`), list the available scripts but
+  // exit non-zero so a script invoking `node --run $CMD` with an unset
+  // variable still fails, as it did before bare `--run` was allowed.
+  if (command_id.empty()) {
+    fprintf(stderr, "Available scripts are:\n");
+    PrintScripts(stderr, scripts_object);
+    result->exit_code_ = ExitCode::kInvalidCommandLineArgument;
+    return;
+  }
+
   // If the command_id is not found in the scripts object, throw an error.
   std::string_view command;
   if (auto command_error =
@@ -314,31 +346,15 @@ void RunTask(const std::shared_ptr<InitializationResultImpl>& result,
               "Script \"%.*s\" is unexpectedly not a string for %s\n\n",
               static_cast<int>(command_id.size()),
               command_id.data(),
-              path.string().c_str());
+              ConvertPathToUTF8(path).c_str());
     } else {
       fprintf(stderr,
               "Missing script: \"%.*s\" for %s\n\n",
               static_cast<int>(command_id.size()),
               command_id.data(),
-              path.string().c_str());
+              ConvertPathToUTF8(path).c_str());
       fprintf(stderr, "Available scripts are:\n");
-
-      // Reset the object to iterate over it again
-      scripts_object.reset();
-      simdjson::ondemand::value value;
-      for (auto field : scripts_object) {
-        std::string_view key_str;
-        std::string_view value_str;
-        if (!field.unescaped_key().get(key_str) && !field.value().get(value) &&
-            !value.get_string().get(value_str)) {
-          fprintf(stderr,
-                  "  %.*s: %.*s\n",
-                  static_cast<int>(key_str.size()),
-                  key_str.data(),
-                  static_cast<int>(value_str.size()),
-                  value_str.data());
-        }
-      }
+      PrintScripts(stderr, scripts_object);
     }
     result->exit_code_ = ExitCode::kGenericUserError;
     return;
diff --git a/src/node_trace_events.cc b/src/node_trace_events.cc
index 5e01f64a5039..08eb71c5122d 100644
--- a/src/node_trace_events.cc
+++ b/src/node_trace_events.cc
@@ -114,6 +114,10 @@ void NodeCategorySet::Disable(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+static void HasAgent(const FunctionCallbackInfo<Value>& args) {
+  args.GetReturnValue().Set(tracing::Agent::GetInstance() != nullptr);
+}
+
 void GetEnabledCategories(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   std::string categories =
@@ -160,6 +164,7 @@ void NodeCategorySet::Initialize(Local<Object> target,
   Environment* env = Environment::GetCurrent(context);
   Isolate* isolate = env->isolate();
 
+  SetMethod(context, target, "hasAgent", HasAgent);
   SetMethod(context, target, "getEnabledCategories", GetEnabledCategories);
   SetMethod(context,
             target,
@@ -193,6 +198,7 @@ void NodeCategorySet::Initialize(Local<Object> target,
 
 void NodeCategorySet::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
+  registry->Register(HasAgent);
   registry->Register(GetEnabledCategories);
   registry->Register(SetTraceCategoryStateUpdateHandler);
   registry->Register(GetCategoryEnabledBuffer);
diff --git a/src/node_url_pattern.cc b/src/node_url_pattern.cc
index bc007db47dac..63f01d58170f 100644
--- a/src/node_url_pattern.cc
+++ b/src/node_url_pattern.cc
@@ -307,32 +307,21 @@ MaybeLocal<Value> URLPattern::URLPatternInit::ToJsObject(
   auto tmpl = env->urlpatterninit_template();
   if (tmpl.IsEmpty()) {
     static constexpr std::string_view namesVec[] = {
-        "protocol",
-        "username",
-        "password",
+        "baseURL",
+        "hash",
         "hostname",
-        "port",
+        "password",
         "pathname",
+        "port",
+        "protocol",
         "search",
-        "hash",
-        "baseURL",
+        "username",
     };
     tmpl = DictionaryTemplate::New(isolate, namesVec);
     env->set_urlpatterninit_template(tmpl);
   }
 
-  MaybeLocal<Value> values[] = {
-      Undefined(isolate),  // protocol
-      Undefined(isolate),  // username
-      Undefined(isolate),  // password
-      Undefined(isolate),  // hostname
-      Undefined(isolate),  // port
-      Undefined(isolate),  // pathname
-      Undefined(isolate),  // search
-      Undefined(isolate),  // hash
-      Undefined(isolate),  // baseURL
-  };
-
+  MaybeLocal<Value> values[9];
   int idx = 0;
   Local<Value> temp;
   const auto trySet = [&](const std::optional<std::string>& val) {
@@ -346,28 +335,28 @@ MaybeLocal<Value> URLPattern::URLPatternInit::ToJsObject(
     return true;
   };
 
-  if (!trySet(init.protocol) || !trySet(init.username) ||
-      !trySet(init.password) || !trySet(init.hostname) || !trySet(init.port) ||
-      !trySet(init.pathname) || !trySet(init.search) || !trySet(init.hash) ||
-      !trySet(init.base_url)) {
+  if (!trySet(init.base_url) || !trySet(init.hash) || !trySet(init.hostname) ||
+      !trySet(init.password) || !trySet(init.pathname) || !trySet(init.port) ||
+      !trySet(init.protocol) || !trySet(init.search) ||
+      !trySet(init.username)) {
     return {};
   }
-  return NewDictionaryInstance(env->context(), tmpl, values);
+  return tmpl->NewInstance(context, values);
 }
 
 std::optional<ada::url_pattern_init> URLPattern::URLPatternInit::FromJsObject(
     Environment* env, Local<Object> obj) {
   ada::url_pattern_init init{};
   Local<String> components[] = {
-      env->protocol_string(),
-      env->username_string(),
-      env->password_string(),
+      env->base_url_string(),
+      env->hash_string(),
       env->hostname_string(),
-      env->port_string(),
+      env->password_string(),
       env->pathname_string(),
+      env->port_string(),
+      env->protocol_string(),
       env->search_string(),
-      env->hash_string(),
-      env->base_url_string(),
+      env->username_string(),
   };
   auto isolate = env->isolate();
   const auto set_parameter = [&](std::string_view key, std::string_view value) {
@@ -697,7 +686,13 @@ static void Initialize(Local<Object> target,
   auto ctor_tmpl = NewFunctionTemplate(isolate, URLPattern::New);
   auto instance_template = ctor_tmpl->InstanceTemplate();
   auto prototype_template = ctor_tmpl->PrototypeTemplate();
-  ctor_tmpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "URLPattern"));
+  Local<String> url_pattern_string =
+      FIXED_ONE_BYTE_STRING(isolate, "URLPattern");
+  ctor_tmpl->SetClassName(url_pattern_string);
+  prototype_template->Set(
+      v8::Symbol::GetToStringTag(isolate),
+      url_pattern_string,
+      static_cast<PropertyAttribute>(ReadOnly | v8::DontEnum));
 
   // The signature is used to prevent the property accessors from being
   // called on the wrong receiver object (`this`)
diff --git a/src/node_util.cc b/src/node_util.cc
index 027f668c2194..96c0c9397546 100644
--- a/src/node_util.cc
+++ b/src/node_util.cc
@@ -18,15 +18,18 @@ using v8::CFunction;
 using v8::Context;
 using v8::DictionaryTemplate;
 using v8::External;
+using v8::Function;
 using v8::FunctionCallbackInfo;
 using v8::IndexFilter;
 using v8::Integer;
 using v8::Isolate;
 using v8::KeyCollectionMode;
+using v8::kPromiseHandlerAddedAfterReject;
 using v8::Local;
 using v8::LocalVector;
 using v8::MaybeLocal;
 using v8::Name;
+using v8::Number;
 using v8::Object;
 using v8::ObjectTemplate;
 using v8::ONLY_CONFIGURABLE;
@@ -467,6 +470,26 @@ void MarkPromiseAsHandled(const FunctionCallbackInfo<Value>& args) {
   Local<Promise> promise = args[0].As<Promise>();
   promise->MarkAsHandled();
   promise->MarkAsSilent();
+
+  // If the promise is already rejected, then it may have already been
+  // reported to the unhandled rejection handler. Marking it as handled
+  // above does not trigger the v8 callback that updates it's status.
+  // So to avoid the notification we call out manually.
+  if (promise->State() == v8::Promise::kRejected) {
+    Environment* env = Environment::GetCurrent(args);
+    Local<Function> callback = env->promise_reject_callback();
+    CHECK(!callback.IsEmpty());
+
+    Local<Value> type =
+        Number::New(env->isolate(), kPromiseHandlerAddedAfterReject);
+    Local<Value> vargs[] = {type, promise, Undefined(env->isolate())};
+
+    USE(callback->Call(
+        env->context(), Undefined(env->isolate()), arraysize(vargs), vargs));
+
+    // Note that if callback->Call throws here, we go ahead and let that
+    // propagate.
+  }
 }
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
@@ -497,6 +520,25 @@ void Initialize(Local<Object> target,
   Environment* env = Environment::GetCurrent(context);
   Isolate* isolate = env->isolate();
 
+  {
+    const Local<Object> prototype =
+        SharedArrayBuffer::New(isolate, 0)->GetPrototypeV2().As<Object>();
+    const Local<Object> descriptor =
+        prototype
+            ->GetOwnPropertyDescriptor(
+                context, FIXED_ONE_BYTE_STRING(isolate, "growable"))
+            .ToLocalChecked()
+            .As<Object>();
+    const Local<Value> getter =
+        descriptor->Get(context, env->get_string()).ToLocalChecked();
+    CHECK(getter->IsFunction());
+    target
+        ->Set(context,
+              FIXED_ONE_BYTE_STRING(isolate, "getSharedArrayBufferGrowable"),
+              getter)
+        .Check();
+  }
+
   {
     Local<ObjectTemplate> tmpl = ObjectTemplate::New(isolate);
 #define V(PropertyName, _)                                                     \
diff --git a/src/node_version.h b/src/node_version.h
index 62247db748c5..2651ed269b1f 100644
--- a/src/node_version.h
+++ b/src/node_version.h
@@ -23,13 +23,13 @@
 #define SRC_NODE_VERSION_H_
 
 #define NODE_MAJOR_VERSION 24
-#define NODE_MINOR_VERSION 21
-#define NODE_PATCH_VERSION 1
+#define NODE_MINOR_VERSION 22
+#define NODE_PATCH_VERSION 0
 
 #define NODE_VERSION_IS_LTS 1
 #define NODE_VERSION_LTS_CODENAME "Krypton"
 
-#define NODE_VERSION_IS_RELEASE 0
+#define NODE_VERSION_IS_RELEASE 1
 
 #ifndef NODE_STRINGIFY
 #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)
diff --git a/src/node_worker.cc b/src/node_worker.cc
index e743cb45359a..fd6a0d90afaa 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -192,8 +192,6 @@ class WorkerThreadData {
       return;
     }
 
-    SetIsolateUpForNode(isolate);
-
     // Be sure it's called before Environment::InitializeDiagnostics()
     // so that this callback stays when the callback of
     // --heapsnapshot-near-heap-limit gets is popped.
@@ -207,13 +205,13 @@ class WorkerThreadData {
       isolate->SetStackLimit(w->stack_base_);
 
       HandleScope handle_scope(isolate);
-      isolate_data_.reset(IsolateData::CreateIsolateData(
-          isolate,
-          &loop_,
-          w_->platform_,
-          allocator.get(),
-          w->snapshot_data()->AsEmbedderWrapper().get(),
-          std::move(w_->per_isolate_opts_)));
+      isolate_data_.reset(
+          IsolateData::CreateIsolateData(isolate,
+                                         &loop_,
+                                         w_->platform_,
+                                         allocator.get(),
+                                         w->snapshot_data(),
+                                         std::move(w_->per_isolate_opts_)));
       CHECK(isolate_data_);
       CHECK(!isolate_data_->is_building_snapshot());
       isolate_data_->set_worker_context(w_);
@@ -316,11 +314,6 @@ void Worker::Run() {
 
     DeleteFnPtr<Environment, FreeEnvironment> env_;
     auto cleanup_env = OnScopeLeave([&]() {
-      // TODO(addaleax): This call is harmless but should not be necessary.
-      // Figure out why V8 is raising a DCHECK() here without it
-      // (in test/parallel/test-async-hooks-worker-asyncfn-terminate-4.js).
-      isolate_->CancelTerminateExecution();
-
       if (!env_) return;
       env_->set_can_call_into_js(false);
 
diff --git a/src/node_zlib.cc b/src/node_zlib.cc
index af82aa2ae73b..810df1c779fd 100644
--- a/src/node_zlib.cc
+++ b/src/node_zlib.cc
@@ -336,7 +336,8 @@ class ZstdCompressContext final : public ZstdContext {
 
   // Zstd specific:
   CompressionError Init(uint64_t pledged_src_size,
-                        std::string_view dictionary = {});
+                        std::string_view dictionary = {},
+                        bool reject_garbage_after_end = false);
   CompressionError SetParameter(int key, int value);
 
   // Wrap ZSTD_freeCCtx to remove the return type.
@@ -365,7 +366,8 @@ class ZstdDecompressContext final : public ZstdContext {
 
   // Zstd specific:
   CompressionError Init(uint64_t pledged_src_size,
-                        std::string_view dictionary = {});
+                        std::string_view dictionary = {},
+                        bool reject_garbage_after_end = false);
 
   CompressionError SetParameter(int key, int value);
 
@@ -379,6 +381,11 @@ class ZstdDecompressContext final : public ZstdContext {
  private:
   DeleteFnPtr<ZSTD_DCtx, ZstdDecompressContext::FreeZstd> dctx_;
   bool frame_complete_ = false;
+  bool decoding_frame_after_complete_ = false;
+  bool reject_garbage_after_end_ = false;
+  bool ignoring_trailing_input_ = false;
+  size_t frame_prefix_size_ = 0;
+  uint8_t possible_frame_types_ = 0;
 };
 
 class CompressionStreamMemoryOwner {
@@ -947,9 +954,9 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
   }
 
   static void Init(const FunctionCallbackInfo<Value>& args) {
-    CHECK((args.Length() == 4 || args.Length() == 5) &&
+    CHECK((args.Length() >= 4 && args.Length() <= 6) &&
           "init(params, pledgedSrcSize, writeResult, writeCallback[, "
-          "dictionary])");
+          "dictionary[, rejectGarbageAfterEnd]])");
 
     ZstdStream* wrap;
     ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
@@ -986,7 +993,7 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
     AllocScope alloc_scope(wrap);
     std::string_view dictionary;
     ArrayBufferViewContents<char> contents;
-    if (args.Length() == 5 && !args[4]->IsUndefined()) {
+    if (args.Length() >= 5 && !args[4]->IsUndefined()) {
       if (!args[4]->IsArrayBufferView()) {
         THROW_ERR_INVALID_ARG_TYPE(
             wrap->env(), "dictionary must be an ArrayBufferView if provided");
@@ -996,7 +1003,14 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
       dictionary = std::string_view(contents.data(), contents.length());
     }
 
-    CompressionError err = wrap->context()->Init(pledged_src_size, dictionary);
+    bool reject_garbage_after_end = false;
+    if (args.Length() == 6) {
+      CHECK(args[5]->IsBoolean());
+      reject_garbage_after_end = args[5]->IsTrue();
+    }
+
+    CompressionError err = wrap->context()->Init(
+        pledged_src_size, dictionary, reject_garbage_after_end);
     if (err.IsError()) {
       wrap->EmitError(err);
       THROW_ERR_ZLIB_INITIALIZATION_FAILED(wrap->env(), err.message);
@@ -1661,7 +1675,8 @@ void ZstdCompressContext::Close() {
 }
 
 CompressionError ZstdCompressContext::Init(uint64_t pledged_src_size,
-                                           std::string_view dictionary) {
+                                           std::string_view dictionary,
+                                           bool) {
   pledged_src_size_ = pledged_src_size;
   if (pledged_src_size == ZSTD_CONTENTSIZE_UNKNOWN) {
     consumed_src_size_.reset();
@@ -1703,7 +1718,29 @@ CompressionError ZstdCompressContext::Init(uint64_t pledged_src_size,
 }
 
 CompressionError ZstdCompressContext::ResetStream() {
-  return Init(pledged_src_size_);
+  size_t result = ZSTD_CCtx_reset(cctx_.get(), ZSTD_reset_session_only);
+  if (ZSTD_isError(result)) {
+    const ZSTD_ErrorCode error = ZSTD_getErrorCode(result);
+    return CompressionError(
+        ZSTD_getErrorString(error), ZstdStrerror(error), error);
+  }
+
+  result = ZSTD_CCtx_setPledgedSrcSize(cctx_.get(), pledged_src_size_);
+  if (ZSTD_isError(result)) {
+    const ZSTD_ErrorCode error = ZSTD_getErrorCode(result);
+    return CompressionError(
+        ZSTD_getErrorString(error), ZstdStrerror(error), error);
+  }
+
+  if (pledged_src_size_ == ZSTD_CONTENTSIZE_UNKNOWN) {
+    consumed_src_size_.reset();
+  } else {
+    consumed_src_size_ = 0;
+  }
+  error_ = ZSTD_error_no_error;
+  error_string_.clear();
+  error_code_string_.clear();
+  return {};
 }
 
 void ZstdCompressContext::DoThreadPoolWork() {
@@ -1745,8 +1782,14 @@ void ZstdDecompressContext::Close() {
 }
 
 CompressionError ZstdDecompressContext::Init(uint64_t pledged_src_size,
-                                             std::string_view dictionary) {
+                                             std::string_view dictionary,
+                                             bool reject_garbage_after_end) {
   frame_complete_ = false;
+  decoding_frame_after_complete_ = false;
+  reject_garbage_after_end_ = reject_garbage_after_end;
+  ignoring_trailing_input_ = false;
+  frame_prefix_size_ = 0;
+  possible_frame_types_ = 0;
 
 #ifdef NODE_BUNDLED_ZSTD
   ZSTD_customMem custom_mem = {
@@ -1777,12 +1820,29 @@ CompressionError ZstdDecompressContext::Init(uint64_t pledged_src_size,
 }
 
 CompressionError ZstdDecompressContext::ResetStream() {
-  // We pass ZSTD_CONTENTSIZE_UNKNOWN because the argument is ignored for
-  // decompression.
-  return Init(ZSTD_CONTENTSIZE_UNKNOWN);
+  const size_t result = ZSTD_DCtx_reset(dctx_.get(), ZSTD_reset_session_only);
+  if (ZSTD_isError(result)) {
+    const ZSTD_ErrorCode error = ZSTD_getErrorCode(result);
+    return CompressionError(
+        ZSTD_getErrorString(error), ZstdStrerror(error), error);
+  }
+
+  frame_complete_ = false;
+  decoding_frame_after_complete_ = false;
+  ignoring_trailing_input_ = false;
+  frame_prefix_size_ = 0;
+  possible_frame_types_ = 0;
+  error_ = ZSTD_error_no_error;
+  error_string_.clear();
+  error_code_string_.clear();
+  return {};
 }
 
 void ZstdDecompressContext::DoThreadPoolWork() {
+  if (ignoring_trailing_input_) {
+    return;
+  }
+
   // The JavaScript processing loop retries with an empty input buffer when the
   // previous call filled the output buffer. Avoid interpreting that retry as
   // the beginning of a new, incomplete frame.
@@ -1790,15 +1850,64 @@ void ZstdDecompressContext::DoThreadPoolWork() {
     return;
   }
 
-  size_t const ret = ZSTD_decompressStream(dctx_.get(), &output_, &input_);
-  if (ZSTD_isError(ret)) {
-    frame_complete_ = false;
-    error_ = ZSTD_getErrorCode(ret);
-    error_code_string_ = ZstdStrerror(error_);
-    error_string_ = ZSTD_getErrorString(error_);
-  } else {
+  do {
+    if (frame_complete_) {
+      decoding_frame_after_complete_ = true;
+      frame_prefix_size_ = 0;
+      possible_frame_types_ = 0b11;
+    }
+
+    if (decoding_frame_after_complete_ && frame_prefix_size_ < 4) {
+      static constexpr uint8_t zstd_magic[] = {0x28, 0xb5, 0x2f, 0xfd};
+      static constexpr uint8_t skippable_magic[] = {0x50, 0x2a, 0x4d, 0x18};
+      const auto* data = static_cast<const uint8_t*>(input_.src);
+      size_t input_prefix_offset = 0;
+
+      while (frame_prefix_size_ < 4 &&
+             input_.pos + input_prefix_offset < input_.size) {
+        const size_t index = frame_prefix_size_;
+        const uint8_t byte = data[input_.pos + input_prefix_offset];
+        if (byte != zstd_magic[index]) {
+          possible_frame_types_ &= ~0b01;
+        }
+        if ((index == 0 && (byte & 0xf0) != skippable_magic[0]) ||
+            (index != 0 && byte != skippable_magic[index])) {
+          possible_frame_types_ &= ~0b10;
+        }
+        frame_prefix_size_++;
+        input_prefix_offset++;
+      }
+
+      if (possible_frame_types_ == 0) {
+        frame_complete_ = true;
+        decoding_frame_after_complete_ = false;
+        if (reject_garbage_after_end_) {
+          error_ = ZSTD_error_GENERIC;
+          error_code_string_ = "ERR_TRAILING_JUNK_AFTER_STREAM_END";
+          error_string_ =
+              "Trailing junk found after the end of the compressed stream";
+        } else {
+          ignoring_trailing_input_ = true;
+        }
+        return;
+      }
+    }
+
+    const size_t ret = ZSTD_decompressStream(dctx_.get(), &output_, &input_);
+    if (ZSTD_isError(ret)) {
+      frame_complete_ = false;
+      error_ = ZSTD_getErrorCode(ret);
+      error_code_string_ = ZstdStrerror(error_);
+      error_string_ = ZSTD_getErrorString(error_);
+      return;
+    }
+
     frame_complete_ = ret == 0;
-  }
+    if (frame_complete_) {
+      decoding_frame_after_complete_ = false;
+    }
+  } while (frame_complete_ && input_.pos < input_.size &&
+           output_.pos < output_.size);
 }
 
 CompressionError ZstdDecompressContext::GetErrorInfo() const {
@@ -1809,6 +1918,17 @@ CompressionError ZstdDecompressContext::GetErrorInfo() const {
 
   if (flush_ == ZSTD_e_end && !frame_complete_ && input_.pos == input_.size &&
       output_.pos < output_.size) {
+    if (decoding_frame_after_complete_) {
+      if (frame_prefix_size_ < 4) {
+        if (reject_garbage_after_end_) {
+          return CompressionError(
+              "Trailing junk found after the end of the compressed stream",
+              "ERR_TRAILING_JUNK_AFTER_STREAM_END",
+              -1);
+        }
+        return {};
+      }
+    }
     return CompressionError(
         "unexpected end of file", "Z_BUF_ERROR", Z_BUF_ERROR);
   }
diff --git a/src/process_wrap.cc b/src/process_wrap.cc
index 4d9420757122..1277581784d8 100644
--- a/src/process_wrap.cc
+++ b/src/process_wrap.cc
@@ -112,6 +112,7 @@ class ProcessWrap : public HandleWrap {
                    object,
                    reinterpret_cast<uv_handle_t*>(&process_),
                    AsyncWrap::PROVIDER_PROCESSWRAP) {
+    process_.pid = 0;
     MarkAsUninitialized();
   }
 
@@ -355,7 +356,10 @@ class ProcessWrap : public HandleWrap {
       signal = SIGKILL;
     }
 #endif
-    int err = uv_process_kill(&wrap->process_, signal);
+    // uv_spawn() only assigns a pid when it succeeds, and kill(0, signal)
+    // signals every process in our own process group.
+    int err = wrap->process_.pid > 0 ? uv_process_kill(&wrap->process_, signal)
+                                     : UV_ESRCH;
     args.GetReturnValue().Set(err);
   }
 
diff --git a/src/quic/application.cc b/src/quic/application.cc
index d3c5e2611f5f..790a79a76e36 100644
--- a/src/quic/application.cc
+++ b/src/quic/application.cc
@@ -347,11 +347,6 @@ class DefaultApplication final : public Session::Application {
   }
 
   int GetStreamData(Session::StreamData* stream_data) override {
-    // Reset the state of stream_data before proceeding...
-    stream_data->id = -1;
-    stream_data->count = 0;
-    stream_data->fin = false;
-    stream_data->stream.reset();
     Debug(&session(), "Default application getting stream data");
     DCHECK_NOT_NULL(stream_data);
     // If the queue is empty, there aren't any streams with data yet
diff --git a/src/quic/endpoint.cc b/src/quic/endpoint.cc
index ed82437fd281..ebd0eabc43be 100644
--- a/src/quic/endpoint.cc
+++ b/src/quic/endpoint.cc
@@ -248,6 +248,17 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
     return Nothing<Options>();
   }
 
+  // SocketAddressLRU::Upsert requires a positive capacity. With max_size_ ==
+  // 0, the newly inserted entry is immediately evicted, and the final
+  // map_[address] creates a default list iterator that is then
+  // dereferenced, causing UB (observed as a SIGSEGV in Endpoint::Receive on
+  // the first accepted connection).
+  if (options.address_lru_size == 0) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env, "The addressLRUSize option must be greater than 0");
+    return Nothing<Options>();
+  }
+
   Local<Value> address;
   if (!params->Get(env->context(), env->address_string()).ToLocal(&address)) {
     return Nothing<Options>();
diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index ff54bba0354f..4c78f694d920 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -212,7 +212,6 @@ class Http3ApplicationImpl final : public Session::Application {
 
   bool Start() override {
     if (started_) return true;
-    started_ = true;
     Debug(&session(), "Starting HTTP/3 application.");
 
     const auto params = session().remote_transport_params();
@@ -246,7 +245,7 @@ class Http3ApplicationImpl final : public Session::Application {
     }
 
     Debug(&session(), "Creating and binding HTTP/3 control streams");
-    bool ret =
+    started_ =
         session().OpenUnidirectionalStream(&control_stream_id_) &&
         session().OpenUnidirectionalStream(&qpack_enc_stream_id_) &&
         session().OpenUnidirectionalStream(&qpack_dec_stream_id_) &&
@@ -254,7 +253,7 @@ class Http3ApplicationImpl final : public Session::Application {
         nghttp3_conn_bind_qpack_streams(
             *this, qpack_enc_stream_id_, qpack_dec_stream_id_) == 0;
 
-    if (env()->enabled_debug_list()->enabled(DebugCategory::QUIC) && ret) {
+    if (env()->enabled_debug_list()->enabled(DebugCategory::QUIC) && started_) {
       Debug(&session(),
             "Created and bound control stream %" PRIi64,
             control_stream_id_);
@@ -266,7 +265,7 @@ class Http3ApplicationImpl final : public Session::Application {
             qpack_dec_stream_id_);
     }
 
-    return ret;
+    return started_;
   }
 
   void BeginShutdown() override {
@@ -688,18 +687,16 @@ class Http3ApplicationImpl final : public Session::Application {
             offsetof(ngtcp2_vec, base) == offsetof(nghttp3_vec, base) &&
             offsetof(ngtcp2_vec, len) == offsetof(nghttp3_vec, len),
         "ngtcp2_vec and nghttp3_vec must have identical layout");
-    data->count = kMaxVectorCount;
-    ssize_t ret = 0;
     Debug(&session(), "HTTP/3 application getting stream data");
     if (conn_ && session().max_data_left()) {
       // nghttp3 reports fin through an int out-param; bridge it to the bool.
       int fin = 0;
-      ret =
+      ssize_t ret =
           nghttp3_conn_writev_stream(*this,
                                      &data->id,
                                      &fin,
                                      reinterpret_cast<nghttp3_vec*>(data->data),
-                                     data->count);
+                                     kMaxVectorCount);
       // A negative return value indicates an error.
       if (ret < 0) {
         return static_cast<int>(ret);
@@ -877,6 +874,10 @@ class Http3ApplicationImpl final : public Session::Application {
           "HTTP/3 application received end of headers for stream %" PRIi64,
           id);
     stream->EmitHeaders();
+    // EmitHeaders() calls into JavaScript, which can synchronously destroy the
+    // stream. Its arena-backed state is released by Destroy(), so do not touch
+    // the stream again if that happened.
+    if (stream->is_destroyed()) return;
     if (fin) {
       // The stream is done. There's no more data to receive!
       Debug(&session(), "Headers are final for stream %" PRIi64, id);
@@ -919,6 +920,10 @@ class Http3ApplicationImpl final : public Session::Application {
           "HTTP/3 application received end of trailers for stream %" PRIi64,
           id);
     stream->EmitHeaders();
+    // EmitHeaders() calls into JavaScript, which can synchronously destroy the
+    // stream. Its arena-backed state is released by Destroy(), so do not touch
+    // the stream again if that happened.
+    if (stream->is_destroyed()) return;
     if (fin) {
       Debug(&session(), "Trailers are final for stream %" PRIi64, id);
       Stream::ReceiveDataFlags flags{
@@ -1413,7 +1418,7 @@ class Http3ApplicationImpl final : public Session::Application {
 
   static constexpr nghttp3_callbacks kCallbacks = {
       on_acked_stream_data,
-      nullptr,  // nghttp3_stream_close (deprecated)
+      nullptr,  // stream_close (deprecated, use v2 below)
       on_receive_data,
       on_deferred_consume,
       on_begin_headers,
@@ -1426,7 +1431,7 @@ class Http3ApplicationImpl final : public Session::Application {
       on_end_stream,
       on_do_reset_stream,
       on_shutdown,
-      nullptr,  // recv_settings (deprecated)
+      nullptr,  // recv_settings (deprecated, use v2 below)
       on_receive_origin,
       on_end_origin,
       on_rand,
diff --git a/src/quic/session.cc b/src/quic/session.cc
index 2266f74a1277..112800f0c2ef 100644
--- a/src/quic/session.cc
+++ b/src/quic/session.cc
@@ -1654,7 +1654,7 @@ struct Session::Impl final : public MemoryRetainer {
 
   static constexpr ngtcp2_callbacks CLIENT = {
       ngtcp2_crypto_client_initial_cb,
-      nullptr,  // stream_stop_sending
+      nullptr,  // recv_client_initial
       ngtcp2_crypto_recv_crypto_data_cb,
       on_handshake_completed,
       on_receive_version_negotiation,
@@ -1688,7 +1688,7 @@ struct Session::Impl final : public MemoryRetainer {
       on_acknowledge_datagram,
       on_lost_datagram,
       nullptr,  // get_path_challenge_data (deprecated, use v2 below)
-      nullptr,  // stream_stop_sending
+      nullptr,  // stream_stop_sending (deprecated, use v2 below)
       ngtcp2_crypto_version_negotiation_cb,
       on_receive_rx_key,
       on_receive_tx_key,
@@ -1698,20 +1698,18 @@ struct Session::Impl final : public MemoryRetainer {
       on_get_new_cid,
       on_cid_status,
       ngtcp2_crypto_get_path_challenge_data2_cb,
-#ifdef NGTCP2_CALLBACKS_V4
       on_receive_stream_stop_sending,
 #ifdef NGTCP2_CALLBACKS_V5
-      nullptr,
-#endif  // NGTCP2_CALLBACKS_V5
-#endif  // NGTCP2_CALLBACKS_V4
+      nullptr,  // stream_close2
+#endif
   };
 
   static constexpr ngtcp2_callbacks SERVER = {
-      nullptr,  // stream_stop_sending
+      nullptr,  // client_initial
       ngtcp2_crypto_recv_client_initial_cb,
       ngtcp2_crypto_recv_crypto_data_cb,
       on_handshake_completed,
-      nullptr,
+      nullptr,  // recv_version_negotiation
       ngtcp2_crypto_encrypt_cb,
       ngtcp2_crypto_decrypt_cb,
       ngtcp2_crypto_hp_mask_cb,
@@ -1720,7 +1718,7 @@ struct Session::Impl final : public MemoryRetainer {
       on_stream_open,
       on_stream_close,
       nullptr,  // recv_stateless_reset (deprecated, use v2 below)
-      nullptr,
+      nullptr,  // recv_retry
       on_extend_max_streams_bidi,
       on_extend_max_streams_uni,
       on_rand,
@@ -1728,23 +1726,23 @@ struct Session::Impl final : public MemoryRetainer {
       on_remove_connection_id,
       ngtcp2_crypto_update_key_cb,
       on_path_validation,
-      nullptr,
+      nullptr,  // select_preferred_addr
       on_stream_reset,
       on_extend_max_remote_streams_bidi,
       on_extend_max_remote_streams_uni,
       on_extend_max_stream_data,
       nullptr,  // dcid_status (deprecated, use v2 below)
-      nullptr,
-      nullptr,
+      nullptr,  // handshake_confirmed
+      nullptr,  // recv_new_token
       ngtcp2_crypto_delete_crypto_aead_ctx_cb,
       ngtcp2_crypto_delete_crypto_cipher_ctx_cb,
       on_receive_datagram,
       on_acknowledge_datagram,
       on_lost_datagram,
       nullptr,  // get_path_challenge_data (deprecated, use v2 below)
-      nullptr,  // stream_stop_sending
+      nullptr,  // stream_stop_sending (deprecated, use v2 below)
       ngtcp2_crypto_version_negotiation_cb,
-      nullptr,
+      nullptr,  // recv_rx_key
       on_receive_tx_key,
       on_early_data_rejected,
       on_begin_path_validation,
@@ -1752,12 +1750,10 @@ struct Session::Impl final : public MemoryRetainer {
       on_get_new_cid,
       on_cid_status,
       ngtcp2_crypto_get_path_challenge_data2_cb,
-#ifdef NGTCP2_CALLBACKS_V4
       on_receive_stream_stop_sending,
 #ifdef NGTCP2_CALLBACKS_V5
-      nullptr,
-#endif  // NGTCP2_CALLBACKS_V5
-#endif  // NGTCP2_CALLBACKS_V4
+      nullptr,  // stream_close2
+#endif
   };
 };
 
@@ -2020,6 +2016,12 @@ void Session::SendPendingData() {
     }
 
     // The stream_data is the next block of data from the application stream.
+    // It is reused across iterations, so we reset before it's populated:
+    stream_data.count = 0;
+    stream_data.id = -1;
+    stream_data.fin = false;
+    stream_data.stream.reset();
+
     if (application().GetStreamData(&stream_data) < 0) {
       Debug(this, "Application failed to get stream data");
       SetLastError(QuicError::ForNgtcp2Error(NGTCP2_ERR_INTERNAL));
diff --git a/src/quic/streams.cc b/src/quic/streams.cc
index c2691362447a..43a6610fb431 100644
--- a/src/quic/streams.cc
+++ b/src/quic/streams.cc
@@ -1211,11 +1211,9 @@ Stream::Stream(BaseObjectWeakPtr<Session> session,
   STAT_SET(Stats, max_offset, params->initial_max_data);
 }
 
-Stream::~Stream() {
-  // Make sure that Destroy() was called before Stream is actually destructed.
-  DCHECK_NE(stats()->destroyed_at, 0);
+Stream::~Stream() = default;
 
-  // Release arena slots back to the freelist.
+void Stream::ReleaseArenaSlots() {
   auto& binding = BindingData::Get(env());
   if (stats_slot_) {
     GetStreamStatsArena(binding).ReleaseSlot(stats_slot_);
@@ -1306,6 +1304,7 @@ bool Stream::is_pending() const {
 }
 
 bool Stream::is_destroyed() const {
+  if (!stats_slot_) return true;
   return stats()->destroyed_at != 0;
 }
 
@@ -1614,14 +1613,13 @@ void Stream::EndReadable(std::optional<uint64_t> maybe_final_size) {
   FlushAccumulation();
   set_final_size(maybe_final_size.value_or(STAT_GET(Stats, bytes_received)));
   inbound_->cap(STAT_GET(Stats, final_size));
-  // Notify the JS reader so it can see EOS. Pass fin=true so the
-  // wakeup promise resolves with a value the iterator can check to
-  // avoid waiting for another wakeup that will never come.
-  if (reader_) reader_->NotifyPull(true);
+  // Notify the JS reader so it can see EOS. The subsequent pull observes
+  // the now-capped DataQueue and returns EOS.
+  if (reader_) reader_->NotifyPull();
 }
 
 void Stream::Destroy(QuicError error) {
-  if (stats()->destroyed_at != 0) return;
+  if (is_destroyed()) return;
 
   // Record the destroyed at timestamp before notifying the JavaScript side
   // that the stream is being destroyed.
@@ -1666,6 +1664,9 @@ void Stream::Destroy(QuicError error) {
   // handle.
   EmitClose(error);
 
+  stream_id id_to_remove = id();
+  ReleaseArenaSlots();
+
   auto session = session_;
   session_.reset();
   // EmitClose above triggers MakeCallback which can destroy the session
@@ -1673,7 +1674,7 @@ void Stream::Destroy(QuicError error) {
   // Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
   // e.g. OnTimeout's ref) even though impl_ has been reset. We must
   // check is_destroyed() to avoid dereferencing the null impl_.
-  if (session && !session->is_destroyed()) session->RemoveStream(id());
+  if (session && !session->is_destroyed()) session->RemoveStream(id_to_remove);
 
   // Critically, make sure that the RemoveStream call is the last thing
   // trying to use this stream object. Once that call is made, the stream
diff --git a/src/quic/streams.h b/src/quic/streams.h
index f18702ae75ab..366694605b4b 100644
--- a/src/quic/streams.h
+++ b/src/quic/streams.h
@@ -408,6 +408,7 @@ class Stream final : public AsyncWrap,
 
   bool is_local_unidirectional() const;
   bool is_remote_unidirectional() const;
+  void ReleaseArenaSlots();
 
   // JavaScript callouts
 
diff --git a/src/stream_base.cc b/src/stream_base.cc
index f57f75e5f275..ad9affc53873 100644
--- a/src/stream_base.cc
+++ b/src/stream_base.cc
@@ -175,6 +175,23 @@ int StreamBase::Shutdown(const FunctionCallbackInfo<Value>& args) {
 void StreamBase::SetWriteResult(const StreamWriteResult& res) {
   env_->stream_base_state()[kBytesWritten] = res.bytes;
   env_->stream_base_state()[kLastWriteWasAsync] = res.async;
+  env_->stream_base_state()[kLastWriteErr] = res.err;
+}
+
+// Finish a JS-initiated write. When the caller did not pass a request
+// object (`lazy_req`), the write wrap object exists only if the write did
+// not complete synchronously; hand it to JS so that it can attach its
+// completion callback. Otherwise the numeric error code (via JSMethod) is
+// all JS needs.
+int StreamBase::FinishWrite(const v8::FunctionCallbackInfo<v8::Value>& args,
+                            const StreamWriteResult& res,
+                            bool lazy_req) {
+  SetWriteResult(res);
+  if (lazy_req && res.wrap_obj) {
+    args.GetReturnValue().Set(res.wrap_obj->object());
+    return kReturnValueSet;
+  }
+  return res.err;
 }
 
 int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
@@ -182,10 +199,13 @@ int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = env->isolate();
   Local<Context> context = env->context();
 
-  CHECK(args[0]->IsObject());
   CHECK(args[1]->IsArray());
 
-  Local<Object> req_wrap_obj = args[0].As<Object>();
+  // When no request object is passed in, one is created by Write() only if
+  // the write does not complete synchronously; see FinishWrite().
+  const bool lazy_req = !args[0]->IsObject();
+  Local<Object> req_wrap_obj;
+  if (!lazy_req) req_wrap_obj = args[0].As<Object>();
   Local<Array> chunks = args[1].As<Array>();
   bool all_buffers = args[2]->IsTrue();
 
@@ -287,20 +307,19 @@ int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
   }
 
   StreamWriteResult res = Write(*bufs, count, nullptr, req_wrap_obj);
-  SetWriteResult(res);
   if (res.wrap != nullptr && storage_size > 0)
     res.wrap->SetBackingStore(std::move(bs));
-  return res.err;
+  return FinishWrite(args, res, lazy_req);
 }
 
-
 int StreamBase::WriteBuffer(const FunctionCallbackInfo<Value>& args) {
-  CHECK(args[0]->IsObject());
   CHECK(args[1]->IsUint8Array());
 
   Environment* env = Environment::GetCurrent(args);
 
-  Local<Object> req_wrap_obj = args[0].As<Object>();
+  bool lazy_req = !args[0]->IsObject();
+  Local<Object> req_wrap_obj;
+  if (!lazy_req) req_wrap_obj = args[0].As<Object>();
   uv_buf_t buf;
   buf.base = Buffer::Data(args[1]);
   buf.len = Buffer::Length(args[1]);
@@ -310,6 +329,16 @@ int StreamBase::WriteBuffer(const FunctionCallbackInfo<Value>& args) {
   if (args[2]->IsObject() && IsIPCPipe()) {
     Local<Object> send_handle_obj = args[2].As<Object>();
 
+    if (lazy_req) {
+      // Sending a handle requires a request object up front to reference it.
+      if (!env->write_wrap_template()
+               ->NewInstance(env->context())
+               .ToLocal(&req_wrap_obj)) {
+        return UV_EBUSY;
+      }
+      StreamReq::ResetObject(req_wrap_obj);
+    }
+
     HandleWrap* wrap;
     ASSIGN_OR_RETURN_UNWRAP(&wrap, send_handle_obj, UV_EINVAL);
     send_handle = reinterpret_cast<uv_stream_t*>(wrap->GetHandle());
@@ -323,20 +352,18 @@ int StreamBase::WriteBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   StreamWriteResult res = Write(&buf, 1, send_handle, req_wrap_obj);
-  SetWriteResult(res);
-
-  return res.err;
+  return FinishWrite(args, res, lazy_req);
 }
 
-
 template <enum encoding enc>
 int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = env->isolate();
-  CHECK(args[0]->IsObject());
   CHECK(args[1]->IsString());
 
-  Local<Object> req_wrap_obj = args[0].As<Object>();
+  const bool lazy_req = !args[0]->IsObject();
+  Local<Object> req_wrap_obj;
+  if (!lazy_req) req_wrap_obj = args[0].As<Object>();
   Local<String> string = args[1].As<String>();
   Local<Object> send_handle_obj;
   if (args[2]->IsObject())
@@ -417,6 +444,16 @@ int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
   uv_stream_t* send_handle = nullptr;
 
   if (IsIPCPipe() && !send_handle_obj.IsEmpty()) {
+    if (lazy_req && req_wrap_obj.IsEmpty()) {
+      // Sending a handle requires a request object up front to reference it.
+      if (!env->write_wrap_template()
+               ->NewInstance(env->context())
+               .ToLocal(&req_wrap_obj)) {
+        return UV_EBUSY;
+      }
+      StreamReq::ResetObject(req_wrap_obj);
+    }
+
     HandleWrap* wrap;
     ASSIGN_OR_RETURN_UNWRAP(&wrap, send_handle_obj, UV_EINVAL);
     send_handle = reinterpret_cast<uv_stream_t*>(wrap->GetHandle());
@@ -432,11 +469,10 @@ int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
   StreamWriteResult res = Write(&buf, 1, send_handle, req_wrap_obj, try_write);
   res.bytes += synchronously_written;
 
-  SetWriteResult(res);
   if (res.wrap != nullptr)
     res.wrap->SetBackingStore(std::move(bs));
 
-  return res.err;
+  return FinishWrite(args, res, lazy_req);
 }
 
 
@@ -661,7 +697,8 @@ void StreamBase::JSMethod(const FunctionCallbackInfo<Value>& args) {
   if (!wrap->IsAlive()) return args.GetReturnValue().Set(UV_EINVAL);
 
   AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(wrap->GetAsyncWrap());
-  args.GetReturnValue().Set((wrap->*Method)(args));
+  int ret = (wrap->*Method)(args);
+  if (ret != kReturnValueSet) args.GetReturnValue().Set(ret);
 }
 
 int StreamResource::DoTryWrite(uv_buf_t** bufs, size_t* count) {
@@ -683,7 +720,7 @@ void StreamResource::ClearError() {
 uv_buf_t EmitToJSStreamListener::OnStreamAlloc(size_t suggested_size) {
   CHECK_NOT_NULL(stream_);
   Environment* env = static_cast<StreamBase*>(stream_)->stream_env();
-  return env->allocate_managed_buffer(suggested_size);
+  return env->stream_read_slab().Allocate(env->isolate(), suggested_size);
 }
 
 void EmitToJSStreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
@@ -693,25 +730,34 @@ void EmitToJSStreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
   Isolate* isolate = env->isolate();
   HandleScope handle_scope(isolate);
   Context::Scope context_scope(env->context());
-  std::unique_ptr<BackingStore> bs = env->release_managed_buffer(buf_);
 
   if (nread <= 0)  {
-    env->recycle_managed_buffer(std::move(bs));
+    if (!env->stream_read_slab().Release(buf_))
+      env->recycle_managed_buffer(env->release_managed_buffer(buf_));
     if (nread < 0)
       stream->CallJSOnreadMethod(nread, Local<ArrayBuffer>());
     return;
   }
 
-  CHECK_LE(static_cast<size_t>(nread), bs->ByteLength());
-  if (static_cast<size_t>(nread) != bs->ByteLength()) {
-    std::unique_ptr<BackingStore> old_bs = std::move(bs);
-    bs = ArrayBuffer::NewBackingStore(
-        isolate, nread, BackingStoreInitializationMode::kUninitialized);
-    memcpy(bs->Data(), old_bs->Data(), nread);
-    env->recycle_managed_buffer(std::move(old_bs));
+  CHECK_LE(static_cast<size_t>(nread), buf_.len);
+  size_t offset = 0;
+  Local<ArrayBuffer> ab;
+  if (!env->stream_read_slab().Commit(isolate, buf_, nread, &ab, &offset)) {
+    // The buffer was allocated through allocate_managed_buffer() by another
+    // stream listener (e.g. StreamPipe's) whose read was rerouted here after
+    // that listener was removed.
+    std::unique_ptr<BackingStore> bs = env->release_managed_buffer(buf_);
+    CHECK_LE(static_cast<size_t>(nread), bs->ByteLength());
+    if (static_cast<size_t>(nread) != bs->ByteLength()) {
+      std::unique_ptr<BackingStore> old_bs = std::move(bs);
+      bs = ArrayBuffer::NewBackingStore(
+          isolate, nread, BackingStoreInitializationMode::kUninitialized);
+      memcpy(bs->Data(), old_bs->Data(), nread);
+      env->recycle_managed_buffer(std::move(old_bs));
+    }
+    ab = ArrayBuffer::New(isolate, std::move(bs));
   }
-
-  stream->CallJSOnreadMethod(nread, ArrayBuffer::New(isolate, std::move(bs)));
+  stream->CallJSOnreadMethod(nread, ab, offset);
 }
 
 
@@ -761,20 +807,50 @@ void ReportWritesToJSStreamListener::OnStreamAfterReqFinished(
   CHECK(!async_wrap->persistent().IsEmpty());
   Local<Object> req_wrap_obj = async_wrap->object();
 
+  Local<Value> oncomplete;
+  if (!req_wrap_obj->Get(env->context(), env->oncomplete_string())
+           .ToLocal(&oncomplete)) {
+    return;
+  }
+
+  const char* msg = stream->Error();
+
+  if (!oncomplete->IsFunction()) {
+    // The completion callback has not been attached yet: the write finished
+    // synchronously inside the JS write call, before the request object was
+    // returned to JS. Record the status so that JS can replay the callback.
+    if (req_wrap_obj
+            ->Set(env->context(),
+                  env->write_status_string(),
+                  Integer::New(env->isolate(), status))
+            .IsNothing()) {
+      return;
+    }
+    if (msg != nullptr) {
+      if (req_wrap_obj
+              ->Set(env->context(),
+                    env->error_string(),
+                    OneByteString(env->isolate(), msg))
+              .IsNothing()) {
+        return;
+      }
+      stream->ClearError();
+    }
+    return;
+  }
+
   Local<Value> argv[] = {
     Integer::New(env->isolate(), status),
     stream->GetObject(),
     Undefined(env->isolate())
   };
 
-  const char* msg = stream->Error();
   if (msg != nullptr) {
     argv[2] = OneByteString(env->isolate(), msg);
     stream->ClearError();
   }
 
-  if (req_wrap_obj->Has(env->context(), env->oncomplete_string()).FromJust())
-    async_wrap->MakeCallback(env->oncomplete_string(), arraysize(argv), argv);
+  async_wrap->MakeCallback(oncomplete.As<Function>(), arraysize(argv), argv);
 }
 
 void ReportWritesToJSStreamListener::OnStreamAfterWrite(
diff --git a/src/stream_base.h b/src/stream_base.h
index be00134eb1fc..b9c36a5bf6d8 100644
--- a/src/stream_base.h
+++ b/src/stream_base.h
@@ -10,6 +10,8 @@
 
 #include "v8.h"
 
+#include <climits>  // INT_MIN
+
 namespace node {
 
 // Forward declarations
@@ -405,14 +407,22 @@ class StreamBase : public StreamResource {
     kArrayBufferOffset,
     kBytesWritten,
     kLastWriteWasAsync,
+    kLastWriteErr,
     kNumStreamBaseStateFields
   };
 
  private:
+  // Sentinel return value for JS methods that have set their own (object)
+  // return value and must not have it overwritten by JSMethod().
+  static constexpr int kReturnValueSet = INT_MIN;
+
   Environment* env_;
   EmitToJSStreamListener default_listener_;
 
   void SetWriteResult(const StreamWriteResult& res);
+  int FinishWrite(const v8::FunctionCallbackInfo<v8::Value>& args,
+                  const StreamWriteResult& res,
+                  bool lazy_req);
   static void AddAccessor(v8::Isolate* isolate,
                           v8::Local<v8::Signature> sig,
                           enum v8::PropertyAttribute attributes,
diff --git a/src/stream_wrap.cc b/src/stream_wrap.cc
index b41f6ac74947..8c6cc0c0aae8 100644
--- a/src/stream_wrap.cc
+++ b/src/stream_wrap.cc
@@ -95,6 +95,20 @@ void LibuvStreamWrap::Initialize(Local<Object> target,
   Local<FunctionTemplate> ww =
       FunctionTemplate::New(isolate, IsConstructCallCallback);
   ww->InstanceTemplate()->SetInternalFieldCount(WriteWrap::kInternalFieldCount);
+  // Pre-create the fields that JS attaches to write requests, so that they
+  // are in-object properties and the object shape stays monomorphic.
+  ww->InstanceTemplate()->Set(env->oncomplete_string(), v8::Null(isolate));
+  ww->InstanceTemplate()->Set(FIXED_ONE_BYTE_STRING(isolate, "callback"),
+                              v8::Null(isolate));
+  ww->InstanceTemplate()->Set(env->handle_string(), v8::Null(isolate));
+  ww->InstanceTemplate()->Set(FIXED_ONE_BYTE_STRING(isolate, "async"),
+                              v8::False(isolate));
+  ww->InstanceTemplate()->Set(FIXED_ONE_BYTE_STRING(isolate, "bytes"),
+                              v8::Integer::New(isolate, 0));
+  ww->InstanceTemplate()->Set(env->buffer_string(), v8::Null(isolate));
+  // Slot for a completion that fires before JS attaches `oncomplete`; see
+  // ReportWritesToJSStreamListener::OnStreamAfterReqFinished().
+  ww->InstanceTemplate()->Set(env->write_status_string(), v8::Null(isolate));
   ww->Inherit(AsyncWrap::GetConstructorTemplate(env));
   SetConstructorFunction(context, target, "WriteWrap", ww);
   env->set_write_wrap_template(ww->InstanceTemplate());
@@ -103,6 +117,7 @@ void LibuvStreamWrap::Initialize(Local<Object> target,
   NODE_DEFINE_CONSTANT(target, kArrayBufferOffset);
   NODE_DEFINE_CONSTANT(target, kBytesWritten);
   NODE_DEFINE_CONSTANT(target, kLastWriteWasAsync);
+  NODE_DEFINE_CONSTANT(target, kLastWriteErr);
   target
       ->Set(context,
             FIXED_ONE_BYTE_STRING(isolate, "streamBaseState"),
diff --git a/src/string_bytes.cc b/src/string_bytes.cc
index b39d6fcc2ecb..656b82458007 100644
--- a/src/string_bytes.cc
+++ b/src/string_bytes.cc
@@ -722,8 +722,8 @@ MaybeLocal<Value> StringBytes::Encode(Isolate* isolate,
       }
       if (reinterpret_cast<uintptr_t>(buf) % 2 != 0) {
         return EncodeTwoByteString(
-            isolate, str_len, [buf, buflen](uint16_t* dst) {
-              memcpy(dst, buf, buflen);
+            isolate, str_len, [buf, str_len](uint16_t* dst) {
+              memcpy(dst, buf, str_len * sizeof(*dst));
             });
       }
       return ExternTwoByteString::NewFromCopy(
diff --git a/src/zlib_version.h b/src/zlib_version.h
index 861b339e2bfc..42c81bc0ae5d 100644
--- a/src/zlib_version.h
+++ b/src/zlib_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-zlib.sh
 #ifndef SRC_ZLIB_VERSION_H_
 #define SRC_ZLIB_VERSION_H_
-#define ZLIB_VERSION "1.3.2.1-motley-8002e91"
+#define ZLIB_VERSION "1.3.2.1-motley-285e94b"
 #endif  // SRC_ZLIB_VERSION_H_
diff --git a/test/addons/addons.status b/test/addons/addons.status
index 18b1c2b2157d..60a33ec9acc6 100644
--- a/test/addons/addons.status
+++ b/test/addons/addons.status
@@ -14,6 +14,7 @@ openssl-binding/test: PASS,FLAKY
 openssl-binding/test: SKIP
 openssl-get-ssl-ctx/test: SKIP
 openssl-providers/test-default-only-config: SKIP
+openssl-providers/test-default-properties-config: SKIP
 openssl-providers/test-legacy-provider-config: SKIP
 openssl-providers/test-legacy-provider-inactive-config: SKIP
 openssl-providers/test-legacy-provider-option: SKIP
diff --git a/test/addons/openssl-binding/binding.gyp b/test/addons/openssl-binding/binding.gyp
index e1dc611d78ed..9d2f9bfd34fb 100644
--- a/test/addons/openssl-binding/binding.gyp
+++ b/test/addons/openssl-binding/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-get-ssl-ctx/binding.gyp b/test/addons/openssl-get-ssl-ctx/binding.gyp
index 46a558e12030..a405ba25bbe7 100644
--- a/test/addons/openssl-get-ssl-ctx/binding.gyp
+++ b/test/addons/openssl-get-ssl-ctx/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-providers/binding.gyp b/test/addons/openssl-providers/binding.gyp
index e1dc611d78ed..9d2f9bfd34fb 100644
--- a/test/addons/openssl-providers/binding.gyp
+++ b/test/addons/openssl-providers/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs
index efa1019c62d9..7e7a958b9005 100644
--- a/test/addons/openssl-providers/providers.cjs
+++ b/test/addons/openssl-providers/providers.cjs
@@ -4,13 +4,19 @@ const common = require('../../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL3 } = require('../../common/crypto');
+const { hasOpenSSL } = require('../../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('this test requires OpenSSL 3.x');
 }
 const assert = require('node:assert');
-const { createHash, getCiphers, getHashes } = require('node:crypto');
+const {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  getCiphers,
+  getHashes,
+} = require('node:crypto');
 const { debuglog } = require('node:util');
 const { getProviders } = require(`./build/${common.buildType}/binding`);
 
@@ -20,11 +26,45 @@ const { getProviders } = require(`./build/${common.buildType}/binding`);
 // supported by the provider.
 const providers = {
   'default': {
-    ciphers: ['des3-wrap'],
-    hashes: ['sha512-256'],
+    ciphers: [
+      {
+        name: 'aes-128-cbc-cts',
+        keyLength: 16,
+        ivLength: 16,
+        plaintextLength: 32,
+        unavailableCode: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+      },
+      {
+        name: 'des3-wrap',
+        keyLength: 24,
+        ivLength: null,
+        plaintextLength: 16,
+        unavailableCode: 'ERR_OSSL_EVP_UNSUPPORTED',
+      },
+    ],
+    hashes: [
+      'sha512-256',
+      ...['keccak-kmac-128', 'keccak-kmac128']
+        .filter((name) => getHashes().includes(name)),
+    ],
   },
   'legacy': {
-    ciphers: ['blowfish', 'idea'],
+    ciphers: [
+      {
+        name: 'blowfish',
+        keyLength: 16,
+        ivLength: 8,
+        plaintextLength: 16,
+        unavailableCode: 'ERR_OSSL_EVP_UNSUPPORTED',
+      },
+      {
+        name: 'idea',
+        keyLength: 16,
+        ivLength: 8,
+        plaintextLength: 16,
+        unavailableCode: 'ERR_OSSL_EVP_UNSUPPORTED',
+      },
+    ],
     hashes: ['md4', 'whirlpool'],
   },
 };
@@ -47,17 +87,50 @@ function assertArrayIncludes(array, item, desc) {
          `${desc} [${array}] does not include "${item}"`);
 }
 
+function createSupportedHash(hash) {
+  try {
+    return createHash(hash);
+  } catch (err) {
+    if (err?.code !== 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH') throw err;
+    return createHash(hash, { outputLength: 32 });
+  }
+}
+
+function assertCipherRoundTrip({
+  name,
+  keyLength,
+  ivLength,
+  plaintextLength,
+}) {
+  const key = Buffer.alloc(keyLength, 0x42);
+  const iv = ivLength === null ? null : Buffer.alloc(ivLength, 0x24);
+  const plaintext = Buffer.alloc(plaintextLength, 0x61);
+
+  const cipher = createCipheriv(name, key, iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext),
+    cipher.final(),
+  ]);
+  const decipher = createDecipheriv(name, key, iv);
+  const received = Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final(),
+  ]);
+  assert.deepStrictEqual(received, plaintext);
+}
+
 function testProviderPresent(provider) {
   debug(`Checking '${provider}' is present`);
   assertArrayIncludes(getProviders(), provider, 'Loaded providers');
   for (const cipher of providers[provider].ciphers || []) {
-    debug(`Checking '${cipher}' cipher is available`);
-    assertArrayIncludes(getCiphers(), cipher, 'Available ciphers');
+    debug(`Checking '${cipher.name}' cipher is available`);
+    assertArrayIncludes(getCiphers(), cipher.name, 'Available ciphers');
+    assertCipherRoundTrip(cipher);
   }
   for (const hash of providers[provider].hashes || []) {
     debug(`Checking '${hash}' hash is available`);
     assertArrayIncludes(getHashes(), hash, 'Available hashes');
-    createHash(hash);
+    createSupportedHash(hash);
   }
 }
 
@@ -65,8 +138,14 @@ function testProviderAbsent(provider) {
   debug(`Checking '${provider}' is absent`);
   assertArrayDoesNotInclude(getProviders(), provider, 'Loaded providers');
   for (const cipher of providers[provider].ciphers || []) {
-    debug(`Checking '${cipher}' cipher is unavailable`);
-    assertArrayDoesNotInclude(getCiphers(), cipher, 'Available ciphers');
+    const { name, keyLength, ivLength, unavailableCode } = cipher;
+    debug(`Checking '${name}' cipher is unavailable`);
+    assertArrayDoesNotInclude(getCiphers(), name, 'Available ciphers');
+    const key = Buffer.alloc(keyLength, 0x42);
+    const iv = ivLength === null ? null : Buffer.alloc(ivLength, 0x24);
+    assert.throws(() => createCipheriv(name, key, iv), {
+      code: unavailableCode,
+    });
   }
   for (const hash of providers[provider].hashes || []) {
     debug(`Checking '${hash}' hash is unavailable`);
diff --git a/test/addons/openssl-providers/test-default-properties-config.js b/test/addons/openssl-providers/test-default-properties-config.js
new file mode 100644
index 000000000000..43f42864def4
--- /dev/null
+++ b/test/addons/openssl-providers/test-default-properties-config.js
@@ -0,0 +1,158 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../../common');
+const fixtures = require('../../common/fixtures');
+const providers = require('./providers.cjs');
+
+const assert = require('node:assert');
+const { fork } = require('node:child_process');
+const {
+  createHash,
+  getHashes,
+  hash: oneShotHash,
+  setFips,
+} = require('node:crypto');
+const { Worker } = require('node:worker_threads');
+const { getHashCache } = require('internal/crypto/util');
+const option = `--openssl-config=${fixtures.path(
+  'openssl3-conf',
+  'default_properties.cnf',
+)}`;
+
+if (!process.execArgv.includes(option)) {
+  const cp = fork(__filename, { execArgv: [...process.execArgv, option] });
+  cp.on('exit', common.mustCall((code, signal) => {
+    assert.strictEqual(code, 0);
+    assert.strictEqual(signal, null);
+  }));
+  return;
+}
+
+assert(providers.getCurrentProviders().includes('default'));
+assert(providers.getCurrentProviders().includes('legacy'));
+providers.testProviderPresent('default');
+
+const hashes = getHashes();
+const input = Buffer.alloc(0);
+const md5 = 'd41d8cd98f00b204e9800998ecf8427e';
+assert.strictEqual(createHash('md5').update(input).digest('hex'), md5);
+assert.strictEqual(oneShotHash('md5', input), md5);
+
+const hashName = 'SHA256';
+const hashCache = getHashCache();
+const descriptor = Object.getOwnPropertyDescriptor(hashCache, hashName);
+assert(descriptor);
+const cacheId = descriptor.value;
+const sentinel = new Error('hash cache setter');
+const throwsSentinel = (err) => err === sentinel;
+
+function installThrowingHashCacheEntry(id) {
+  Object.defineProperty(hashCache, hashName, {
+    __proto__: null,
+    configurable: true,
+    enumerable: descriptor.enumerable,
+    get() { return id; },
+    set() { throw sentinel; },
+  });
+}
+
+installThrowingHashCacheEntry(-1);
+assert.throws(() => createHash(hashName), throwsSentinel);
+assert.throws(() => oneShotHash(hashName, input), throwsSentinel);
+Object.defineProperty(hashCache, hashName, descriptor);
+
+installThrowingHashCacheEntry(cacheId);
+setFips(true);
+assert.throws(() => createHash(hashName), throwsSentinel);
+assert.throws(() => oneShotHash(hashName, input), throwsSentinel);
+Object.defineProperty(hashCache, hashName, descriptor);
+assert.deepStrictEqual(getHashes(), []);
+assert.throws(
+  () => createHash('md5'),
+  { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+);
+assert.throws(
+  () => oneShotHash('md5', input),
+  { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+);
+
+setFips(false);
+assert.deepStrictEqual(getHashes(), hashes);
+assert.strictEqual(createHash('md5').update(input).digest('hex'), md5);
+assert.strictEqual(oneShotHash('md5', input), md5);
+
+for (const hash of ['md4', 'whirlpool']) {
+  assert(!hashes.includes(hash));
+  assert.throws(() => createHash(hash), { code: 'ERR_OSSL_EVP_UNSUPPORTED' });
+}
+
+const worker = new Worker(`
+  'use strict';
+  const {
+    createHash,
+    getHashes,
+    hash,
+  } = require('node:crypto');
+  const { parentPort } = require('node:worker_threads');
+
+  const input = Buffer.alloc(0);
+  const hashes = getHashes();
+  const liveHash = createHash('md5').update(input);
+  hash('md5', input);
+  parentPort.postMessage({ phase: 'warm' });
+
+  function getErrorCode(fn) {
+    try {
+      fn();
+    } catch (err) {
+      return err.code;
+    }
+  }
+
+  parentPort.on('message', (phase) => {
+    if (phase === 'fips-on') {
+      parentPort.postMessage({
+        phase,
+        createHashError: getErrorCode(() => createHash('md5')),
+        oneShotHashError: getErrorCode(() => hash('md5', input)),
+        hashes: getHashes(),
+        liveDigest: liveHash.digest('hex'),
+      });
+    } else {
+      parentPort.postMessage({
+        phase,
+        createHashDigest: createHash('md5').update(input).digest('hex'),
+        oneShotHashDigest: hash('md5', input),
+        hashes: getHashes(),
+      });
+      parentPort.close();
+    }
+  });
+`, { eval: true });
+
+worker.once('message', common.mustCall((message) => {
+  assert.strictEqual(message.phase, 'warm');
+  setFips(true);
+
+  worker.once('message', common.mustCall((message) => {
+    assert.strictEqual(message.phase, 'fips-on');
+    assert.strictEqual(message.createHashError, 'ERR_OSSL_EVP_UNSUPPORTED');
+    assert.strictEqual(message.oneShotHashError, 'ERR_OSSL_EVP_UNSUPPORTED');
+    assert.deepStrictEqual(message.hashes, []);
+    assert.strictEqual(message.liveDigest, md5);
+
+    setFips(false);
+
+    worker.once('message', common.mustCall((message) => {
+      assert.strictEqual(message.phase, 'fips-off');
+      assert.strictEqual(message.createHashDigest, md5);
+      assert.strictEqual(message.oneShotHashDigest, md5);
+      assert.deepStrictEqual(message.hashes, hashes);
+    }));
+    worker.postMessage('fips-off');
+  }));
+  worker.postMessage('fips-on');
+}));
+worker.on('error', common.mustNotCall());
+worker.on('exit', common.mustCall((code) => assert.strictEqual(code, 0)));
diff --git a/test/addons/worker-addon/binding.cc b/test/addons/worker-addon/binding.cc
index a5f9d8b3f835..b98acea00e60 100644
--- a/test/addons/worker-addon/binding.cc
+++ b/test/addons/worker-addon/binding.cc
@@ -51,19 +51,33 @@ void Cleanup(void* str) {
 void Initialize(Local<Object> exports,
                 Local<Value> module,
                 Local<Context> context) {
+  Isolate* isolate = context->GetIsolate();
   node::AddEnvironmentCleanupHook(
-      context->GetIsolate(),
-      Cleanup,
-      const_cast<void*>(static_cast<const void*>("cleanup")));
-  node::AddEnvironmentCleanupHook(context->GetIsolate(), Dummy, nullptr);
-  node::RemoveEnvironmentCleanupHook(context->GetIsolate(), Dummy, nullptr);
+      isolate, Cleanup, const_cast<void*>(static_cast<const void*>("cleanup")));
+
+  // Test that adding and removing a cleanup hook works as expected
+  {
+    node::AddEnvironmentCleanupHook(isolate, Dummy, nullptr);
+    node::RemoveEnvironmentCleanupHook(isolate, Dummy, nullptr);
+  }
+
+  // Test that adding and removing a cleanup hook also works if there
+  // is no active context during removal
+  {
+    node::AddEnvironmentCleanupHook(isolate, Dummy, nullptr);
+    {
+      context->Exit();
+      node::RemoveEnvironmentCleanupHook(isolate, Dummy, nullptr);
+      context->Enter();
+    }
+  }
 
   if (getenv("addExtraItemToEventLoop") != nullptr) {
     // Add an item to the event loop that we do not clean up in order to make
     // sure that for the main thread, this addon's memory persists even after
     // the Environment instance has been destroyed.
     static uv_async_t extra_async;
-    uv_loop_t* loop = node::GetCurrentEventLoop(context->GetIsolate());
+    uv_loop_t* loop = node::GetCurrentEventLoop(isolate);
     int err = uv_async_init(loop, &extra_async, [](uv_async_t*) {});
     assert(err == 0);
     uv_unref(reinterpret_cast<uv_handle_t*>(&extra_async));
diff --git a/test/addons/zlib-binding/binding.gyp b/test/addons/zlib-binding/binding.gyp
index f6a822d47e9c..5bd4f999218b 100644
--- a/test/addons/zlib-binding/binding.gyp
+++ b/test/addons/zlib-binding/binding.gyp
@@ -9,6 +9,9 @@
             'aix_variant_name': '<!(uname -s)',
           },
           'conditions': [
+            [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+              'type': 'none',
+            }],
             [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
               'sources': ['binding.cc'],
               'include_dirs': ['../../../deps/zlib'],
diff --git a/test/cctest/test_cppgc.cc b/test/cctest/test_cppgc.cc
index 21f981f9ab22..030f369ab45e 100644
--- a/test/cctest/test_cppgc.cc
+++ b/test/cctest/test_cppgc.cc
@@ -3,8 +3,11 @@
 #include <cppgc/heap.h>
 #include <node.h>
 #include <v8-cppgc.h>
+#include <v8-external-memory-accounter.h>
 #include <v8-sandbox.h>
 #include <v8.h>
+#include "cppgc_helpers-inl.h"
+#include "node_realm-inl.h"
 #include "node_test_fixture.h"
 
 // This tests that Node.js can work with an existing CppHeap.
@@ -106,3 +109,114 @@ TEST_F(NodeZeroIsolateTestFixture, ExistingCppHeapTest) {
   // heap can be reclaimed. So just check at least some of them are traced.
   EXPECT_GT(CppGCed::kTraceCount, 0);
 }
+
+class CppgcTest : public EnvironmentTestFixture {
+ protected:
+  // Above the external memory hard limit, so V8 runs a full GC synchronously
+  // and leaves sweeping (and cppgc destructors) for later.
+  static constexpr size_t kExternalMemoryPressure = size_t{8} << 30;
+
+  void CollectGarbageLeavingSweepingPending() {
+    v8::ExternalMemoryAccounter pressure;
+    pressure.Increase(isolate_, kExternalMemoryPressure);
+    pressure.Decrease(isolate_, kExternalMemoryPressure);
+  }
+
+  void FinishSweeping() {
+    isolate_->LowMemoryNotification();
+    platform->DrainTasks(isolate_);
+  }
+};
+
+using node::CppgcMixin;
+
+class RealmBoundWrap final : CPPGC_MIXIN(RealmBoundWrap) {
+ public:
+  SET_CPPGC_NAME(RealmBoundWrap)
+  DEFAULT_CPPGC_TRACE()
+  SET_NO_MEMORY_INFO()
+
+  static node::Realm* live_realm;
+  static int clean_count;
+  static int clean_with_dead_realm_count;
+  static int destructor_count;
+
+  RealmBoundWrap(node::Environment* env, v8::Local<v8::Object> object) {
+    CppgcMixin::Wrap(this, env, object);
+  }
+  ~RealmBoundWrap() {
+    Finalize();
+    destructor_count++;
+  }
+  void Clean(node::Realm* realm) override {
+    clean_count++;
+    if (realm != live_realm) clean_with_dead_realm_count++;
+  }
+};
+
+node::Realm* RealmBoundWrap::live_realm = nullptr;
+int RealmBoundWrap::clean_count = 0;
+int RealmBoundWrap::clean_with_dead_realm_count = 0;
+int RealmBoundWrap::destructor_count = 0;
+
+TEST_F(CppgcTest, CleanIsNotCalledWithFreedRealm) {
+  constexpr int kCount = 32;
+  {
+    const v8::HandleScope handle_scope(isolate_);
+    Env env{handle_scope, Argv()};
+    RealmBoundWrap::live_realm = (*env)->principal_realm();
+
+    v8::Local<v8::FunctionTemplate> ctor = v8::FunctionTemplate::New(isolate_);
+    ctor->InstanceTemplate()->SetInternalFieldCount(
+        node::CppgcMixin::kInternalFieldCount);
+    v8::Local<v8::Function> fn =
+        ctor->GetFunction(env.context()).ToLocalChecked();
+    {
+      v8::HandleScope inner_scope(isolate_);
+      for (int i = 0; i <= kCount; i++) {
+        v8::Local<v8::Object> obj =
+            fn->NewInstance(env.context()).ToLocalChecked();
+        cppgc::MakeGarbageCollected<RealmBoundWrap>(
+            (*env)->cppgc_allocation_handle(), *env, obj);
+        if (i < kCount) continue;
+        env.context()
+            ->Global()
+            ->Set(env.context(),
+                  v8::String::NewFromUtf8Literal(isolate_, "kept"),
+                  obj)
+            .Check();
+      }
+    }
+
+    CollectGarbageLeavingSweepingPending();
+    EXPECT_LT(RealmBoundWrap::destructor_count, kCount);
+  }
+  RealmBoundWrap::live_realm = nullptr;
+  FinishSweeping();
+
+  EXPECT_GE(RealmBoundWrap::clean_count, 1);
+  EXPECT_EQ(RealmBoundWrap::clean_with_dead_realm_count, 0);
+}
+
+TEST_F(CppgcTest, WrappersAliveAtFreeEnvironmentDoNotLeak) {
+  const v8::HandleScope handle_scope(isolate_);
+  Env env{handle_scope, Argv()};
+  node::LoadEnvironment(*env,
+                        "globalThis.script = new (require('vm').Script)('1');"
+                        "globalThis.context = require('vm').createContext();")
+      .ToLocalChecked();
+}
+
+TEST_F(CppgcTest, VmScriptCollectedBeforeFreeEnvironmentSweptAfter) {
+  {
+    const v8::HandleScope handle_scope(isolate_);
+    Env env{handle_scope, Argv()};
+    node::LoadEnvironment(*env,
+                          "const { Script } = require('vm');"
+                          "for (let i = 0; i < 64; i++) new Script('1');"
+                          "undefined;")
+        .ToLocalChecked();
+    CollectGarbageLeavingSweepingPending();
+  }
+  FinishSweeping();
+}
diff --git a/test/cctest/test_crypto_clienthello.cc b/test/cctest/test_crypto_clienthello.cc
deleted file mode 100644
index 870857cf9061..000000000000
--- a/test/cctest/test_crypto_clienthello.cc
+++ /dev/null
@@ -1,133 +0,0 @@
-#include "crypto/crypto_clienthello-inl.h"
-#include "gtest/gtest.h"
-
-// If the test is being compiled with an address sanitizer enabled, it should
-// catch the memory violation, so do not use a guard page.
-#ifdef __SANITIZE_ADDRESS__
-#define NO_GUARD_PAGE
-#elif defined(__has_feature)
-#if __has_feature(address_sanitizer)
-#define NO_GUARD_PAGE
-#endif
-#endif
-
-// If the test is running without an address sanitizer, see if we can use
-// mprotect() or VirtualProtect() to cause a segmentation fault when spatial
-// safety is violated.
-#if !defined(NO_GUARD_PAGE)
-#ifdef __linux__
-#include <sys/mman.h>
-#include <unistd.h>
-#if defined(_SC_PAGE_SIZE) && defined(PROT_NONE) && defined(PROT_READ) &&      \
-    defined(PROT_WRITE)
-#define USE_MPROTECT
-#endif
-#elif defined(_WIN32) && defined(_MSC_VER)
-#include <Windows.h>
-#include <memoryapi.h>
-#define USE_VIRTUALPROTECT
-#endif
-#endif
-
-#if defined(USE_MPROTECT)
-size_t GetPageSize() {
-  int page_size = sysconf(_SC_PAGE_SIZE);
-  CHECK_GE(page_size, 1);
-  return page_size;
-}
-#elif defined(USE_VIRTUALPROTECT)
-size_t GetPageSize() {
-  SYSTEM_INFO system_info;
-  GetSystemInfo(&system_info);
-  return system_info.dwPageSize;
-}
-#endif
-
-template <size_t N>
-class OverrunGuardedBuffer {
- public:
-  OverrunGuardedBuffer() {
-#if defined(USE_MPROTECT) || defined(USE_VIRTUALPROTECT)
-    size_t page = GetPageSize();
-    CHECK_GE(page, N);
-#endif
-#ifdef USE_MPROTECT
-    // Place the packet right before a guard page, which, when accessed, causes
-    // a segmentation fault.
-    alloc_base = static_cast<uint8_t*>(aligned_alloc(page, 2 * page));
-    CHECK_NOT_NULL(alloc_base);
-    uint8_t* second_page = alloc_base + page;
-    CHECK_EQ(mprotect(second_page, page, PROT_NONE), 0);
-    data_base = second_page - N;
-#elif defined(USE_VIRTUALPROTECT)
-    // On Windows, it works almost the same way.
-    alloc_base = static_cast<uint8_t*>(
-        VirtualAlloc(nullptr, 2 * page, MEM_COMMIT, PAGE_READWRITE));
-    CHECK_NOT_NULL(alloc_base);
-    uint8_t* second_page = alloc_base + page;
-    DWORD old_prot;
-    CHECK_NE(VirtualProtect(second_page, page, PAGE_NOACCESS, &old_prot), 0);
-    CHECK_EQ(old_prot, PAGE_READWRITE);
-    data_base = second_page - N;
-#else
-    // Place the packet in a regular allocated buffer. The bug causes undefined
-    // behavior, which might crash the process, and when it does not, address
-    // sanitizers and valgrind will catch it.
-    alloc_base = static_cast<uint8_t*>(malloc(N));
-    CHECK_NOT_NULL(alloc_base);
-    data_base = alloc_base;
-#endif
-  }
-
-  OverrunGuardedBuffer(const OverrunGuardedBuffer& other) = delete;
-  OverrunGuardedBuffer& operator=(const OverrunGuardedBuffer& other) = delete;
-
-  ~OverrunGuardedBuffer() {
-#if defined(USE_MPROTECT) || defined(USE_VIRTUALPROTECT)
-    size_t page = GetPageSize();
-#endif
-#ifdef USE_VIRTUALPROTECT
-    VirtualFree(alloc_base, 2 * page, MEM_RELEASE);
-#else
-#ifdef USE_MPROTECT
-    // Revert page protection such that the memory can be free()'d.
-    uint8_t* second_page = alloc_base + page;
-    CHECK_EQ(mprotect(second_page, page, PROT_READ | PROT_WRITE), 0);
-#endif
-    free(alloc_base);
-#endif
-  }
-
-  uint8_t* data() {
-    return data_base;
-  }
-
- private:
-  uint8_t* alloc_base;
-  uint8_t* data_base;
-};
-
-// Test that ClientHelloParser::ParseHeader() does not blindly trust the client
-// to send a valid frame length and subsequently does not read out-of-bounds.
-TEST(NodeCrypto, ClientHelloParserParseHeaderOutOfBoundsRead) {
-  using node::crypto::ClientHelloParser;
-
-  // This is the simplest packet triggering the bug.
-  const uint8_t packet[] = {0x16, 0x03, 0x01, 0x00, 0x00};
-  OverrunGuardedBuffer<sizeof(packet)> buffer;
-  memcpy(buffer.data(), packet, sizeof(packet));
-
-  // Let the ClientHelloParser parse the packet. This should not lead to a
-  // segmentation fault or to undefined behavior.
-  node::crypto::ClientHelloParser parser;
-  bool end_cb_called = false;
-  parser.Start([](void* arg, auto hello) { GTEST_FAIL(); },
-               [](void* arg) {
-                 bool* end_cb_called = static_cast<bool*>(arg);
-                 EXPECT_FALSE(*end_cb_called);
-                 *end_cb_called = true;
-               },
-               &end_cb_called);
-  parser.Parse(buffer.data(), sizeof(packet));
-  EXPECT_TRUE(end_cb_called);
-}
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index a219d5125701..6a48db67baad 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -27,6 +27,12 @@ static void at_exit_callback_ordered2(void* arg);
 static void at_exit_js(void* arg);
 static std::string cb_1_arg;  // NOLINT(runtime/string)
 
+struct SelfRemovingCleanupHookState {
+  v8::Isolate* isolate;
+  bool ran = false;
+};
+static void self_removing_cleanup_hook(void* arg);
+
 class EnvironmentTest : public EnvironmentTestFixture {
  private:
   void TearDown() override {
@@ -309,12 +315,32 @@ TEST_F(EnvironmentTest, AtExitRunsJS) {
   EXPECT_TRUE(called_at_exit_js);
 }
 
+// A cleanup hook that removes itself while the environment cleanup queue is
+// being drained must not cause a use-after-free. This registers such a hook
+// directly rather than through node::ObjectWrap, whose destructor removes
+// its own hook and is what makes this reachable for addons since #63642.
+// The use-after-free is silent in ordinary builds; it is caught by the
+// ASan/Valgrind CI, which is also how the original assertion (#63923)
+// surfaced. Regression test for https://github.com/nodejs/node/issues/65195.
+TEST_F(EnvironmentTest, RemoveEnvironmentCleanupHookDuringCleanup) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  SelfRemovingCleanupHookState state{isolate_};
+  {
+    Env env{handle_scope, argv};
+    node::AddEnvironmentCleanupHook(
+        isolate_, self_removing_cleanup_hook, &state);
+    // Destroying `env` runs FreeEnvironment() -> RunCleanup(), which drains
+    // the cleanup queue and invokes CleanupHookThunkRun() for the hook above.
+  }
+  EXPECT_TRUE(state.ran);
+}
+
 TEST_F(EnvironmentTest, MultipleEnvironmentsPerIsolate) {
   const v8::HandleScope handle_scope(isolate_);
   const Argv argv;
-  // Only one of the Environments can have default flags and own the inspector.
   Env env1 {handle_scope, argv};
-  Env env2 {handle_scope, argv, node::EnvironmentFlags::kNoFlags};
+  Env env2{handle_scope, argv};
 
   AtExit(*env1, at_exit_callback1, nullptr);
   AtExit(*env2, at_exit_callback2, nullptr);
@@ -326,6 +352,39 @@ TEST_F(EnvironmentTest, MultipleEnvironmentsPerIsolate) {
   EXPECT_TRUE(called_cb_2);
 }
 
+TEST_F(EnvironmentTest, WorkerInEnvironmentWithoutSnapshot) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  Env env{handle_scope, argv};
+  CHECK_NULL(isolate_data_->snapshot_data());
+  node::LoadEnvironment(*env,
+                        "const { Worker } = require('worker_threads');"
+                        "new Worker('process.exit(0)', { eval: true });")
+      .ToLocalChecked();
+  EXPECT_EQ(node::SpinEventLoop(*env).FromJust(), 0);
+}
+
+TEST_F(EnvironmentTest, StopFromExitHandlerDoesNotLeakIntoNextEnvironment) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  {
+    Env env{handle_scope, argv};
+    node::SetProcessExitHandler(
+        *env, [](node::Environment* env_, int) { node::Stop(env_); });
+    // The uncaught exception runs the exit handler from C++ and does not
+    // re-enter JS afterwards, so nothing consumes the termination request.
+    EXPECT_TRUE(
+        node::LoadEnvironment(*env, "throw new Error('uncaught')").IsEmpty());
+    EXPECT_TRUE(node::SpinEventLoop(*env).IsNothing());
+  }
+  {
+    Env env{handle_scope, argv, node::EnvironmentFlags::kNoCreateInspector};
+    v8::Local<v8::Value> result =
+        node::LoadEnvironment(*env, "return 42;").ToLocalChecked();
+    EXPECT_EQ(result->Int32Value(env.context()).FromJust(), 42);
+  }
+}
+
 TEST_F(EnvironmentTest, NoEnvironmentSanity) {
   const v8::HandleScope handle_scope(isolate_);
   v8::Local<v8::Context> context = v8::Context::New(isolate_);
@@ -392,6 +451,19 @@ static void at_exit_js(void* arg) {
   called_at_exit_js = true;
 }
 
+// Reproduces the sequence node::ObjectWrap performs since
+// https://github.com/nodejs/node/pull/63642, without using ObjectWrap
+// itself: the hook removes its own environment cleanup hook. When that runs
+// while the cleanup queue is being drained, CleanupHookThunkRun() must not
+// read the CleanupHookThunk after invoking the hook -- the hook has already
+// erased and freed it. See https://github.com/nodejs/node/issues/65195.
+static void self_removing_cleanup_hook(void* arg) {
+  auto* state = static_cast<SelfRemovingCleanupHookState*>(arg);
+  state->ran = true;
+  node::RemoveEnvironmentCleanupHook(
+      state->isolate, self_removing_cleanup_hook, state);
+}
+
 TEST_F(EnvironmentTest, SetImmediateCleanup) {
   int called = 0;
   int called_unref = 0;
@@ -593,6 +665,34 @@ TEST_F(EnvironmentTest, InspectorMultipleEmbeddedEnvironments) {
   CHECK_EQ(data.extracted_value, 42);
   CHECK_EQ(from_inspector->IntegerValue(context).FromJust(), 42);
 }
+
+TEST_F(EnvironmentTest, InspectorWithoutPlatform) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  node::IsolateData* isolate_data = node::CreateIsolateData(
+      isolate_, &NodeTestFixture::current_loop, nullptr);
+  v8::Local<v8::Context> context = node::NewContext(isolate_);
+  v8::Context::Scope context_scope(context);
+  std::vector<std::string> args(*argv, *argv + 1);
+  node::Environment* env =
+      node::CreateEnvironment(isolate_data, context, args, args);
+  CHECK_NOT_NULL(env);
+
+  v8::Local<v8::Value> result =
+      node::LoadEnvironment(env,
+                            "const { Session } = require('inspector');\n"
+                            "const session = new Session();\n"
+                            "session.connect();\n"
+                            "console.time('t'); console.timeEnd('t');\n"
+                            "session.disconnect();\n"
+                            "return 42;")
+          .ToLocalChecked();
+  EXPECT_EQ(result->Int32Value(context).FromJust(), 42);
+
+  node::FreeEnvironment(env);
+  node::FreeIsolateData(isolate_data);
+}
+
 #endif  // HAVE_INSPECTOR
 
 TEST_F(EnvironmentTest, ExitHandlerTest) {
diff --git a/test/cctest/test_node_crypto.cc b/test/cctest/test_node_crypto.cc
index 94940e3c55f9..7e6cf5f6315d 100644
--- a/test/cctest/test_node_crypto.cc
+++ b/test/cctest/test_node_crypto.cc
@@ -7,8 +7,25 @@
 #include "gtest/gtest.h"
 #include "node_options.h"
 #include "openssl/err.h"
+#include "util.h"
 
 #include <climits>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#include <openssl/core_dispatch.h>
+#include <openssl/core_names.h>
+#include <openssl/params.h>
+#include <openssl/provider.h>
+#endif
+
+using ncrypto::Ec;
+using ncrypto::EVPKeyCtxPointer;
+using ncrypto::EVPKeyPointer;
+using ncrypto::KeyAlgorithm;
 
 /*
  * This test verifies that a call to NewRootCertDir with the build time
@@ -65,3 +82,837 @@ TEST(NodeCrypto, TryGetIntCipherOutputLength) {
   EXPECT_FALSE(node::crypto::TryGetIntCipherOutputLength(
       0, static_cast<size_t>(INT_MAX) + 1, &output_len));
 }
+
+TEST(NodeCrypto, KeyAlgorithmNames) {
+  EXPECT_EQ(KeyAlgorithm::FromName("rsa-pss"), &KeyAlgorithm::RSA_PSS);
+  EXPECT_EQ(KeyAlgorithm::FromName("ML-DSA-44"), &KeyAlgorithm::ML_DSA_44);
+  EXPECT_EQ(KeyAlgorithm::FromName("unknown-key-algorithm"), nullptr);
+  EXPECT_EQ(KeyAlgorithm::FromName(nullptr), nullptr);
+  EXPECT_FALSE(EVPKeyPointer().isA(KeyAlgorithm::RSA));
+  EXPECT_FALSE(EVPKeyPointer::isA(nullptr, KeyAlgorithm::RSA));
+  auto empty = EVPKeyPointer::New();
+  ASSERT_TRUE(empty);
+  EXPECT_FALSE(empty.isA(KeyAlgorithm::RSA));
+  EXPECT_FALSE(empty.supportsContextString());
+  EXPECT_FALSE(EVPKeyPointer().supportsContextString());
+  EXPECT_FALSE(empty.rawSeed());
+  EXPECT_FALSE(EVPKeyPointer().rawSeed());
+  EXPECT_FALSE(empty.isA("unknown-key-algorithm"));
+  EXPECT_FALSE(empty.isA(static_cast<const char*>(nullptr)));
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+TEST(NodeCrypto, ProviderPkcs1PublicKeyImport) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::RSA);
+  ASSERT_TRUE(ctx);
+  ASSERT_TRUE(ctx.initForKeygen());
+  ASSERT_TRUE(ctx.setRsaKeygenBits(2048));
+  EVP_PKEY* raw = nullptr;
+  ASSERT_EQ(EVP_PKEY_keygen(ctx.get(), &raw), 1);
+  EVPKeyPointer key(raw);
+
+  for (const auto format :
+       {EVPKeyPointer::PKFormatType::PEM, EVPKeyPointer::PKFormatType::DER}) {
+    const EVPKeyPointer::PublicKeyEncodingConfig config(
+        false, format, EVPKeyPointer::PKEncodingType::PKCS1);
+    auto encoded = key.writePublicKey(config);
+    ASSERT_TRUE(encoded);
+    const BUF_MEM* mem = encoded.value;
+    ASSERT_NE(mem, nullptr);
+    const ncrypto::Buffer<const unsigned char> input{
+        reinterpret_cast<const unsigned char*>(mem->data), mem->length};
+    auto imported = EVPKeyPointer::TryParsePublicKey(config, input);
+    ASSERT_TRUE(imported);
+    EXPECT_NE(EVP_PKEY_get0_provider(imported.value.get()), nullptr);
+    EXPECT_TRUE(imported.value.isA(KeyAlgorithm::RSA));
+    EXPECT_EQ(EVP_PKEY_eq(key.get(), imported.value.get()), 1);
+  }
+}
+
+namespace {
+struct RsaLoadTestContext {
+  OSSL_FUNC_BIO_read_ex_fn* read = nullptr;
+  int selection = 0;
+  int loads = 0;
+  int frees = 0;
+};
+
+void* RsaLoadTestDecoderNew(void* context) {
+  return context;
+}
+
+void RsaLoadTestDecoderFree(void*) {}
+
+int RsaLoadTestDecode(void* context,
+                      OSSL_CORE_BIO* input,
+                      int selection,
+                      OSSL_CALLBACK* callback,
+                      void* arg,
+                      OSSL_PASSPHRASE_CALLBACK*,
+                      void*) {
+  auto* state = static_cast<RsaLoadTestContext*>(context);
+  unsigned char sentinel = 0;
+  size_t size = 0;
+  // Only exercise construction and reference ownership, not ASN.1 parsing.
+  if (!state->read(input, &sentinel, 1, &size) || size != 1 ||
+      sentinel != 0x42) {
+    return 0;
+  }
+  state->selection = selection;
+  char type[] = "RSA";
+  const OSSL_PARAM params[] = {
+      OSSL_PARAM_utf8_string(
+          OSSL_OBJECT_PARAM_DATA_TYPE, type, sizeof(type) - 1),
+      OSSL_PARAM_octet_string(
+          OSSL_OBJECT_PARAM_REFERENCE, &state, sizeof(state)),
+      OSSL_PARAM_END,
+  };
+  return callback(params, arg);
+}
+
+void* RsaLoadTestLoad(const void* reference, size_t size) {
+  if (size != sizeof(RsaLoadTestContext*)) return nullptr;
+  auto* state = *static_cast<RsaLoadTestContext* const*>(reference);
+  state->loads++;
+  return state;
+}
+
+void RsaLoadTestFree(void* context) {
+  static_cast<RsaLoadTestContext*>(context)->frees++;
+}
+
+int RsaLoadTestHas(const void*, int selection) {
+  return (selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) == 0;
+}
+
+const OSSL_ALGORITHM* RsaLoadTestQuery(void*, int operation, int* no_cache) {
+  *no_cache = 0;
+  static const OSSL_DISPATCH decoder[] = {
+      {OSSL_FUNC_DECODER_NEWCTX,
+       reinterpret_cast<void (*)(void)>(RsaLoadTestDecoderNew)},
+      {OSSL_FUNC_DECODER_FREECTX,
+       reinterpret_cast<void (*)(void)>(RsaLoadTestDecoderFree)},
+      {OSSL_FUNC_DECODER_DECODE,
+       reinterpret_cast<void (*)(void)>(RsaLoadTestDecode)},
+      {0, nullptr},
+  };
+  static const OSSL_DISPATCH keymgmt[] = {
+      {OSSL_FUNC_KEYMGMT_LOAD,
+       reinterpret_cast<void (*)(void)>(RsaLoadTestLoad)},
+      {OSSL_FUNC_KEYMGMT_FREE,
+       reinterpret_cast<void (*)(void)>(RsaLoadTestFree)},
+      {OSSL_FUNC_KEYMGMT_HAS, reinterpret_cast<void (*)(void)>(RsaLoadTestHas)},
+      {0, nullptr},
+  };
+  static const OSSL_ALGORITHM decoders[] = {
+      {"RSA",
+       "provider=node-test-rsa-load,input=der,structure=type-specific",
+       decoder,
+       "Test RSA decoder without export"},
+      {nullptr, nullptr, nullptr, nullptr},
+  };
+  static const OSSL_ALGORITHM keymgmts[] = {
+      {"RSA",
+       "provider=node-test-rsa-load",
+       keymgmt,
+       "Test RSA reference load"},
+      {nullptr, nullptr, nullptr, nullptr},
+  };
+  if (operation == OSSL_OP_DECODER) return decoders;
+  return operation == OSSL_OP_KEYMGMT ? keymgmts : nullptr;
+}
+
+void RsaLoadTestTeardown(void* context) {
+  delete static_cast<RsaLoadTestContext*>(context);
+}
+
+int RsaLoadTestProviderInit(const OSSL_CORE_HANDLE*,
+                            const OSSL_DISPATCH* in,
+                            const OSSL_DISPATCH** out,
+                            void** context) {
+  auto state = std::make_unique<RsaLoadTestContext>();
+  for (; in->function_id != 0; in++) {
+    if (in->function_id == OSSL_FUNC_BIO_READ_EX) {
+      state->read = OSSL_FUNC_BIO_read_ex(in);
+    }
+  }
+  if (state->read == nullptr) return 0;
+  static const OSSL_DISPATCH dispatch[] = {
+      {OSSL_FUNC_PROVIDER_QUERY_OPERATION,
+       reinterpret_cast<void (*)(void)>(RsaLoadTestQuery)},
+      {OSSL_FUNC_PROVIDER_TEARDOWN,
+       reinterpret_cast<void (*)(void)>(RsaLoadTestTeardown)},
+      {0, nullptr},
+  };
+  *context = state.release();
+  *out = dispatch;
+  return 1;
+}
+}  // namespace
+
+TEST(NodeCrypto, ProviderPkcs1PublicKeyLoadWithoutExport) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  ncrypto::DeleteFnPtr<OSSL_LIB_CTX, OSSL_LIB_CTX_free> libctx(
+      OSSL_LIB_CTX_new());
+  ASSERT_TRUE(libctx);
+  ASSERT_EQ(OSSL_PROVIDER_add_builtin(
+                libctx.get(), "node-test-rsa-load", RsaLoadTestProviderInit),
+            1);
+  auto* provider = OSSL_PROVIDER_load(libctx.get(), "node-test-rsa-load");
+  auto unload_provider =
+      node::OnScopeLeave([provider] { OSSL_PROVIDER_unload(provider); });
+  ASSERT_NE(provider, nullptr);
+  auto* state = static_cast<RsaLoadTestContext*>(
+      OSSL_PROVIDER_get0_provider_ctx(provider));
+  OSSL_LIB_CTX* previous_libctx = OSSL_LIB_CTX_set0_default(libctx.get());
+  auto restore_libctx = node::OnScopeLeave(
+      [previous_libctx] { OSSL_LIB_CTX_set0_default(previous_libctx); });
+
+  // Neither decoder export nor keymgmt import is available in this provider.
+  const unsigned char sentinel[] = {0x42};
+  const EVPKeyPointer::PublicKeyEncodingConfig config(
+      false,
+      EVPKeyPointer::PKFormatType::DER,
+      EVPKeyPointer::PKEncodingType::PKCS1);
+  {
+    auto imported = EVPKeyPointer::TryParsePublicKey(config, {sentinel, 1});
+    ASSERT_TRUE(imported);
+    EXPECT_EQ(EVP_PKEY_get0_provider(imported.value.get()), provider);
+    EXPECT_TRUE(imported.value.isA(KeyAlgorithm::RSA));
+    EXPECT_EQ(state->selection, EVP_PKEY_PUBLIC_KEY);
+    EXPECT_EQ(state->loads, 1);
+    EXPECT_EQ(state->frees, 0);
+  }
+  EXPECT_EQ(state->frees, 1);
+}
+#endif
+
+TEST(NodeCrypto, UnsupportedRawExports) {
+  using Error = EVPKeyPointer::RawExportError;
+  EVPKeyPointer key;
+  for (int i = 0; i < 2; i++) {
+    const auto seed = key.rawSeed();
+    EXPECT_FALSE(seed);
+    EXPECT_EQ(seed.error, Error::UNSUPPORTED_KEY_TYPE);
+    const auto jwk = key.exportRawJwk(/* include_private */ false);
+    EXPECT_FALSE(jwk);
+    EXPECT_EQ(jwk.error, Error::UNSUPPORTED_KEY_TYPE);
+    key = EVPKeyPointer::New();
+    ASSERT_TRUE(key);
+  }
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::RSA);
+  ASSERT_TRUE(ctx);
+  ASSERT_EQ(EVP_PKEY_keygen_init(ctx.get()), 1);
+  EVP_PKEY* raw = nullptr;
+  ASSERT_EQ(EVP_PKEY_keygen(ctx.get(), &raw), 1);
+  key.reset(raw);
+  EXPECT_EQ(key.rawSeed().error, Error::UNSUPPORTED_KEY_TYPE);
+  EXPECT_EQ(key.exportRawJwk(/* include_private */ false).error,
+            Error::UNSUPPORTED_KEY_TYPE);
+}
+
+namespace {
+void CheckRawJwkImport(const EVPKeyPointer& key) {
+  auto jwk = key.exportRawJwk(/* include_private */ true);
+  ASSERT_TRUE(jwk);
+  const auto& data = jwk.value;
+  const ncrypto::Buffer<const unsigned char> pub = data.public_key;
+  const ncrypto::Buffer<const unsigned char> priv = data.private_key;
+  auto private_key = EVPKeyPointer::NewRawJwk(*data.algorithm, pub, priv);
+  ASSERT_TRUE(private_key);
+  auto exported = private_key.exportRawJwk(/* include_private */ true);
+  ASSERT_TRUE(exported);
+  EXPECT_EQ(exported.value.algorithm, data.algorithm);
+  ASSERT_EQ(exported.value.private_key.size(), priv.len);
+  EXPECT_EQ(memcmp(exported.value.private_key.get(), priv.data, priv.len), 0);
+  auto public_key = EVPKeyPointer::NewRawJwk(*data.algorithm, pub);
+  ASSERT_TRUE(public_key);
+  auto exported_public = public_key.exportRawJwk(/* include_private */ false);
+  ASSERT_TRUE(exported_public);
+  EXPECT_FALSE(exported_public.value.private_key);
+  ASSERT_EQ(exported_public.value.public_key.size(), pub.len);
+  EXPECT_EQ(memcmp(exported_public.value.public_key.get(), pub.data, pub.len),
+            0);
+
+  auto different_pub = ncrypto::DataPointer::Copy({pub.data, pub.len});
+  ASSERT_TRUE(different_pub);
+  ASSERT_GT(different_pub.size(), 0u);
+  different_pub.get<unsigned char>()[0] ^= 1;
+  const ncrypto::Buffer<const unsigned char> mismatch = different_pub;
+  EXPECT_FALSE(EVPKeyPointer::NewRawJwk(*data.algorithm, mismatch, priv));
+  EXPECT_FALSE(EVPKeyPointer::NewRawJwk(
+      *data.algorithm, pub, ncrypto::Buffer<const unsigned char>{nullptr, 0}));
+  EXPECT_FALSE(EVPKeyPointer::NewRawJwk(KeyAlgorithm::RSA, pub, priv));
+}
+}  // namespace
+
+TEST(NodeCrypto, RsaPrimeProduct) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  EXPECT_FALSE(ncrypto::Rsa().checkPrimeProduct());
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::RSA);
+  ASSERT_TRUE(ctx);
+  ASSERT_TRUE(ctx.initForKeygen());
+  EVP_PKEY* raw = nullptr;
+  ASSERT_EQ(EVP_PKEY_keygen(ctx.get(), &raw), 1);
+  EVPKeyPointer key(raw);
+  ncrypto::Rsa rsa = key;
+  ASSERT_TRUE(rsa);
+  EXPECT_TRUE(rsa.checkPrimeProduct());
+  auto pub = rsa.getPublicKey();
+  ncrypto::BignumPointer n(BN_dup(pub.n));
+  ncrypto::BignumPointer e(BN_dup(pub.e));
+  ASSERT_TRUE(n);
+  ASSERT_TRUE(e);
+  ASSERT_EQ(BN_add_word(n.get(), 1), 1);
+  ASSERT_TRUE(rsa.setPublicKey(std::move(n), std::move(e)));
+  EXPECT_FALSE(rsa.checkPrimeProduct());
+}
+
+TEST(NodeCrypto, EcKeyComponents) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  ncrypto::BignumPointer x;
+  ncrypto::BignumPointer y;
+  ncrypto::BignumPointer priv;
+  int degree = 0;
+  EXPECT_FALSE(
+      ncrypto::Ec::GetKeyComponents(EVPKeyPointer(), &x, &y, &priv, &degree));
+  EXPECT_EQ(ncrypto::Ec::GetCurveId(EVPKeyPointer()), NID_undef);
+  EXPECT_FALSE(ncrypto::Ec::TryExportPublic(EVPKeyPointer(),
+                                            POINT_CONVERSION_UNCOMPRESSED));
+  EXPECT_FALSE(ncrypto::Ec::ExportPrivate(EVPKeyPointer()));
+  auto empty = EVPKeyPointer::New();
+  ASSERT_TRUE(empty);
+  EXPECT_FALSE(ncrypto::Ec::GetKeyComponents(empty, &x, &y, &priv, &degree));
+  for (int nid : {NID_X9_62_prime256v1, NID_secp384r1, NID_secp521r1}) {
+    auto ec = ncrypto::ECKeyPointer::NewByCurveName(nid);
+    ASSERT_TRUE(ec);
+    EXPECT_FALSE(ec.checkPrivateKey());
+    auto parameters = EVPKeyPointer::New();
+    ASSERT_TRUE(parameters);
+    ASSERT_TRUE(parameters.set(ec));
+    EXPECT_EQ(ncrypto::Ec::GetCurveId(parameters), nid);
+    EXPECT_FALSE(
+        ncrypto::Ec::GetKeyComponents(parameters, &x, &y, nullptr, &degree));
+    ASSERT_TRUE(ec.generate());
+    EXPECT_TRUE(ec.checkPrivateKey());
+    auto key = EVPKeyPointer::New();
+    ASSERT_TRUE(key);
+    ASSERT_TRUE(key.set(ec));
+    EXPECT_TRUE(key.isA(KeyAlgorithm::EC));
+    EXPECT_EQ(ncrypto::Ec::GetCurveId(key), nid);
+    ASSERT_TRUE(ncrypto::Ec::GetKeyComponents(key, &x, &y, &priv, &degree));
+    EXPECT_EQ(degree, EC_GROUP_get_degree(ec.getGroup()));
+    EXPECT_EQ(BN_cmp(priv.get(), ec.getPrivateKey()), 0);
+    const size_t width = (degree + 7) / 8;
+    auto point = ncrypto::DataPointer::Alloc(1 + 2 * width);
+    ASSERT_TRUE(point);
+    ASSERT_EQ(EC_POINT_point2oct(ec.getGroup(),
+                                 ec.getPublicKey(),
+                                 POINT_CONVERSION_UNCOMPRESSED,
+                                 point.get<unsigned char>(),
+                                 point.size(),
+                                 nullptr),
+              point.size());
+    auto x_bytes = x.encodePadded(width);
+    auto y_bytes = y.encodePadded(width);
+    ASSERT_TRUE(x_bytes);
+    ASSERT_TRUE(y_bytes);
+    EXPECT_EQ(memcmp(x_bytes.get(), point.get<unsigned char>() + 1, width), 0);
+    EXPECT_EQ(
+        memcmp(y_bytes.get(), point.get<unsigned char>() + 1 + width, width),
+        0);
+    auto raw_private = ncrypto::Ec::ExportPrivate(key);
+    auto expected_private = priv.encodePadded(width);
+    ASSERT_TRUE(raw_private);
+    ASSERT_EQ(raw_private.size(), expected_private.size());
+    EXPECT_EQ(
+        memcmp(raw_private.get(), expected_private.get(), raw_private.size()),
+        0);
+    auto raw_public =
+        ncrypto::Ec::TryExportPublic(key, POINT_CONVERSION_UNCOMPRESSED);
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    ASSERT_TRUE(raw_public);
+    ASSERT_EQ(raw_public.size(), point.size());
+    EXPECT_EQ(memcmp(raw_public.get(), point.get(), point.size()), 0);
+#else
+    EXPECT_FALSE(raw_public);
+#endif
+    EXPECT_FALSE(
+        ncrypto::Ec::TryExportPublic(key, POINT_CONVERSION_COMPRESSED));
+    auto public_ec = ncrypto::ECKeyPointer::NewByCurveName(nid);
+    ASSERT_TRUE(public_ec);
+    ASSERT_TRUE(public_ec.setPublicKeyRaw(x, y));
+    auto public_key = EVPKeyPointer::New();
+    ASSERT_TRUE(public_key);
+    ASSERT_TRUE(public_key.set(public_ec));
+    EXPECT_TRUE(
+        ncrypto::Ec::GetKeyComponents(public_key, &x, &y, nullptr, &degree));
+    EXPECT_FALSE(
+        ncrypto::Ec::GetKeyComponents(public_key, &x, &y, &priv, &degree));
+    EXPECT_FALSE(ncrypto::Ec::ExportPrivate(public_key));
+  }
+}
+
+TEST(NodeCrypto, ResolveKeyAlgorithm) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  EXPECT_EQ(EVPKeyPointer().getAlgorithm(), nullptr);
+  auto key = EVPKeyPointer::New();
+  ASSERT_TRUE(key);
+  EXPECT_EQ(key.getAlgorithm(), nullptr);
+
+  const unsigned char seed[64] = {};
+  for (const auto* algorithm : {&KeyAlgorithm::ED25519,
+                                &KeyAlgorithm::X25519,
+                                &KeyAlgorithm::ML_DSA_44,
+                                &KeyAlgorithm::ML_KEM_768}) {
+    if (!algorithm->isAvailable()) continue;
+    const ncrypto::Buffer<const unsigned char> input{
+        seed, algorithm->seedSize() == 0 ? 32 : algorithm->seedSize()};
+    key = algorithm->seedSize() == 0
+              ? EVPKeyPointer::NewRawPrivate(*algorithm, input)
+              : EVPKeyPointer::NewRawSeed(*algorithm, input);
+    ASSERT_TRUE(key);
+    EXPECT_EQ(key.getAlgorithm(), algorithm);
+    CheckRawJwkImport(key);
+    if (algorithm->seedSize() != 0) {
+      auto exported = key.rawSeed();
+      ASSERT_TRUE(exported);
+      ASSERT_EQ(exported.value.size(), input.len);
+      EXPECT_EQ(memcmp(exported.value.get(), input.data, input.len), 0);
+    }
+    EVPKeyPointer moved(std::move(key));
+    EXPECT_EQ(key.getAlgorithm(), nullptr);
+    EXPECT_EQ(moved.getAlgorithm(), algorithm);
+    key.reset(moved.release());
+    EXPECT_EQ(moved.getAlgorithm(), nullptr);
+    EXPECT_EQ(key.getAlgorithm(), algorithm);
+    key.reset();
+    EXPECT_EQ(key.getAlgorithm(), nullptr);
+  }
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // Legacy keys must resolve even without provider-backed key material.
+  key = EVPKeyPointer::New();
+  ASSERT_EQ(EVP_PKEY_set_type(key.get(), NID_rsaEncryption), 1);
+  EXPECT_EQ(key.getAlgorithm(), &KeyAlgorithm::RSA);
+#endif
+}
+
+TEST(NodeCrypto, PublicKeyTypeNames) {
+  EXPECT_EQ(EVPKeyPointer().getKeyTypeName(), nullptr);
+  EXPECT_EQ(EVPKeyPointer::New().getKeyTypeName(), nullptr);
+  EXPECT_STREQ(KeyAlgorithm::RSA.keyTypeName(), "rsa");
+  EXPECT_STREQ(KeyAlgorithm::RSA_PSS.keyTypeName(), "rsa-pss");
+  EXPECT_STREQ(KeyAlgorithm::ML_DSA_44.keyTypeName(), "ml-dsa-44");
+  EXPECT_STREQ(KeyAlgorithm::SLH_DSA_SHAKE_256S.keyTypeName(),
+               "slh-dsa-shake-256s");
+  EXPECT_EQ(KeyAlgorithm::SM2.keyTypeName(), nullptr);
+  const unsigned char seed[32] = {};
+  auto key =
+      EVPKeyPointer::NewRawPrivate(KeyAlgorithm::ED25519, {seed, sizeof(seed)});
+  ASSERT_TRUE(key);
+  EXPECT_STREQ(key.getKeyTypeName(), "ed25519");
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+TEST(NodeCrypto, LegacyKeyAlgorithmResolution) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  auto key = EVPKeyPointer::New();
+  ASSERT_TRUE(key);
+  ASSERT_EQ(EVP_PKEY_set_type(key.get(), NID_rsassaPss), 1);
+  EXPECT_EQ(key.getAlgorithm(), &KeyAlgorithm::RSA_PSS);
+  EXPECT_STREQ(key.getKeyTypeName(), "rsa-pss");
+#ifndef OPENSSL_NO_SM2
+  ASSERT_EQ(EVP_PKEY_set_type(key.get(), NID_sm2), 1);
+  EXPECT_TRUE(key.isA(KeyAlgorithm::SM2));
+  EXPECT_FALSE(key.isA(KeyAlgorithm::EC));
+  EXPECT_EQ(key.getAlgorithm(), &KeyAlgorithm::SM2);
+  EXPECT_EQ(key.getKeyTypeName(), nullptr);
+#endif
+}
+#endif
+
+TEST(NodeCrypto, NamedKeysAndEcCurves) {
+  EXPECT_EQ(Ec::GetNamedKeyAlgorithm("ED25519"), &KeyAlgorithm::ED25519);
+  EXPECT_EQ(Ec::GetNamedKeyAlgorithm("X25519"), &KeyAlgorithm::X25519);
+  EXPECT_EQ(Ec::GetNamedKeyAlgorithm("P-256"), nullptr);
+  EXPECT_EQ(Ec::GetNamedKeyAlgorithm("prime256v1"), nullptr);
+  EXPECT_EQ(Ec::GetNamedKeyAlgorithm("unknown-curve"), nullptr);
+  EXPECT_EQ(Ec::GetCurveIdFromName("P-256"),
+            Ec::GetCurveIdFromName("prime256v1"));
+}
+
+TEST(NodeCrypto, EcGroupNames) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  EXPECT_FALSE(Ec::GetCurveName(EVPKeyPointer()));
+  EXPECT_FALSE(Ec::CheckCurveName(nullptr));
+  EXPECT_FALSE(Ec::CheckCurveName("node-test-unknown-curve"));
+  for (const char* name : {"P-256", "prime256v1"}) {
+    EXPECT_TRUE(Ec::CheckCurveName(name));
+    auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::EC);
+    ASSERT_TRUE(ctx.initForParamgen());
+    ASSERT_TRUE(ctx.setEcParameters(name, OPENSSL_EC_NAMED_CURVE));
+    auto key = ctx.paramgen();
+    ASSERT_TRUE(key);
+    const auto group = Ec::GetCurveName(key);
+    ASSERT_TRUE(group);
+    EXPECT_EQ(group.value(), "prime256v1");
+  }
+}
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+namespace {
+// Deliberately longer than the fixed-size group buffer formerly used by
+// ncrypto.
+constexpr char kProviderEcGroup[] =
+    "node-test-provider-ec-group-without-an-object-identifier-"
+    "and-with-a-name-longer-than-eighty-bytes";
+
+int EcGroupTestSetParams(void* data, const OSSL_PARAM params[]) {
+  const OSSL_PARAM* group =
+      OSSL_PARAM_locate_const(params, OSSL_PKEY_PARAM_GROUP_NAME);
+  if (group == nullptr) return 1;
+  const char* name = nullptr;
+  if (OSSL_PARAM_get_utf8_string_ptr(group, &name) != 1 || name == nullptr) {
+    return 0;
+  }
+  *static_cast<std::string*>(data) = name;
+  return 1;
+}
+
+void* EcGroupTestGenInit(void*, int, const OSSL_PARAM params[]) {
+  auto data = std::make_unique<std::string>();
+  if (params != nullptr && !EcGroupTestSetParams(data.get(), params)) {
+    return nullptr;
+  }
+  return data.release();
+}
+
+void* EcGroupTestGen(void* data, OSSL_CALLBACK*, void*) {
+  const auto& group = *static_cast<std::string*>(data);
+  // Defer rejecting unknown names until generation, as a provider may do.
+  if (group != kProviderEcGroup && group != "prime256v1") {
+    ERR_raise(ERR_LIB_USER, ERR_R_PASSED_INVALID_ARGUMENT);
+    return nullptr;
+  }
+  return new std::string(group);
+}
+
+void EcGroupTestFree(void* data) {
+  delete static_cast<std::string*>(data);
+}
+
+int EcGroupTestHas(const void* data, int selection) {
+  return (selection & OSSL_KEYMGMT_SELECT_KEYPAIR) == 0 &&
+         !static_cast<const std::string*>(data)->empty();
+}
+
+int EcGroupTestGetParams(void* data, OSSL_PARAM params[]) {
+  OSSL_PARAM* group = OSSL_PARAM_locate(params, OSSL_PKEY_PARAM_GROUP_NAME);
+  return group == nullptr ||
+         OSSL_PARAM_set_utf8_string(group,
+                                    static_cast<std::string*>(data)->c_str());
+}
+
+const OSSL_PARAM* EcGroupTestParams(void*, void*) {
+  static const OSSL_PARAM params[] = {
+      OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_GROUP_NAME, nullptr, 0),
+      OSSL_PARAM_utf8_string(OSSL_PKEY_PARAM_EC_ENCODING, nullptr, 0),
+      OSSL_PARAM_END,
+  };
+  return params;
+}
+
+const OSSL_PARAM* EcGroupTestGettableParams(void*) {
+  return EcGroupTestParams(nullptr, nullptr);
+}
+
+const OSSL_ALGORITHM* EcGroupTestQuery(void*, int operation, int* no_cache) {
+  *no_cache = 0;
+  static const OSSL_DISPATCH keymgmt[] = {
+      {OSSL_FUNC_KEYMGMT_GEN_INIT,
+       reinterpret_cast<void (*)(void)>(EcGroupTestGenInit)},
+      {OSSL_FUNC_KEYMGMT_GEN_SET_PARAMS,
+       reinterpret_cast<void (*)(void)>(EcGroupTestSetParams)},
+      {OSSL_FUNC_KEYMGMT_GEN_SETTABLE_PARAMS,
+       reinterpret_cast<void (*)(void)>(EcGroupTestParams)},
+      {OSSL_FUNC_KEYMGMT_GEN, reinterpret_cast<void (*)(void)>(EcGroupTestGen)},
+      {OSSL_FUNC_KEYMGMT_GEN_CLEANUP,
+       reinterpret_cast<void (*)(void)>(EcGroupTestFree)},
+      {OSSL_FUNC_KEYMGMT_FREE,
+       reinterpret_cast<void (*)(void)>(EcGroupTestFree)},
+      {OSSL_FUNC_KEYMGMT_HAS, reinterpret_cast<void (*)(void)>(EcGroupTestHas)},
+      {OSSL_FUNC_KEYMGMT_GET_PARAMS,
+       reinterpret_cast<void (*)(void)>(EcGroupTestGetParams)},
+      {OSSL_FUNC_KEYMGMT_GETTABLE_PARAMS,
+       reinterpret_cast<void (*)(void)>(EcGroupTestGettableParams)},
+      {0, nullptr},
+  };
+  static const OSSL_ALGORITHM algorithms[] = {
+      {"EC", "provider=node-test-ec", keymgmt, "Test provider EC group names"},
+      {nullptr, nullptr, nullptr, nullptr},
+  };
+  return operation == OSSL_OP_KEYMGMT ? algorithms : nullptr;
+}
+
+int EcGroupTestProviderInit(const OSSL_CORE_HANDLE*,
+                            const OSSL_DISPATCH*,
+                            const OSSL_DISPATCH** out,
+                            void**) {
+  static const OSSL_DISPATCH dispatch[] = {
+      {OSSL_FUNC_PROVIDER_QUERY_OPERATION,
+       reinterpret_cast<void (*)(void)>(EcGroupTestQuery)},
+      {0, nullptr},
+  };
+  *out = dispatch;
+  return 1;
+}
+
+void EcGroupTestUnloadProvider(OSSL_PROVIDER* provider) {
+  OSSL_PROVIDER_unload(provider);
+}
+}  // namespace
+
+TEST(NodeCrypto, ProviderEcGroupName) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  ncrypto::DeleteFnPtr<OSSL_LIB_CTX, OSSL_LIB_CTX_free> libctx(
+      OSSL_LIB_CTX_new());
+  ASSERT_TRUE(libctx);
+  ASSERT_EQ(OSSL_PROVIDER_add_builtin(
+                libctx.get(), "node-test-ec", EcGroupTestProviderInit),
+            1);
+  ncrypto::DeleteFnPtr<OSSL_PROVIDER, EcGroupTestUnloadProvider> provider(
+      OSSL_PROVIDER_load(libctx.get(), "node-test-ec"));
+  ASSERT_TRUE(provider);
+  {
+    OSSL_LIB_CTX* previous_libctx = OSSL_LIB_CTX_set0_default(libctx.get());
+    auto restore_libctx = node::OnScopeLeave(
+        [previous_libctx] { OSSL_LIB_CTX_set0_default(previous_libctx); });
+    // The provider supports generation, but intentionally has no import API.
+    EXPECT_TRUE(Ec::CheckCurveName(kProviderEcGroup));
+    EXPECT_FALSE(Ec::CheckCurveName("node-test-unknown-curve"));
+    EXPECT_TRUE(Ec::CheckCurveName("P-256"));
+
+    auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::EC);
+    ASSERT_TRUE(ctx);
+    ASSERT_TRUE(ctx.initForParamgen());
+    ASSERT_TRUE(ctx.setEcParameters(kProviderEcGroup, OPENSSL_EC_NAMED_CURVE));
+    auto key = ctx.paramgen();
+    ASSERT_TRUE(key);
+    EXPECT_EQ(Ec::GetCurveId(key), NID_undef);
+    const auto name = Ec::GetCurveName(key);
+    ASSERT_TRUE(name);
+    EXPECT_EQ(name.value(), kProviderEcGroup);
+
+    // Only usable built-in curves are enumerated. The provider-only group
+    // remains usable by name without appearing in this list.
+    ERR_clear_error();
+    ERR_raise(ERR_LIB_USER, ERR_R_INTERNAL_ERROR);
+    const auto saved_error = ERR_peek_error();
+    std::vector<std::string> curves;
+    EXPECT_TRUE(Ec::GetCurves([&curves](const char* curve) {
+      curves.emplace_back(curve);
+      return true;
+    }));
+    EXPECT_EQ(curves, std::vector<std::string>{"prime256v1"});
+    EXPECT_EQ(ERR_peek_error(), saved_error);
+    EXPECT_EQ(ERR_peek_last_error(), saved_error);
+
+    unsigned int calls = 0;
+    EXPECT_FALSE(Ec::GetCurves([&calls](const char*) {
+      calls++;
+      ERR_raise(ERR_LIB_USER, ERR_R_PASSED_INVALID_ARGUMENT);
+      return false;
+    }));
+    EXPECT_EQ(calls, 1U);
+    EXPECT_EQ(ERR_get_error(), saved_error);
+    EXPECT_EQ(ERR_GET_REASON(ERR_get_error()), ERR_R_PASSED_INVALID_ARGUMENT);
+    EXPECT_EQ(ERR_get_error(), 0UL);
+
+    ASSERT_EQ(EVP_set_default_properties(nullptr, "provider=default"), 1);
+    EXPECT_TRUE(Ec::GetCurves([](const char*) {
+      ADD_FAILURE() << "No EC groups should match the default properties";
+      return true;
+    }));
+  }
+}
+#endif
+
+TEST(NodeCrypto, NamedRawKey) {
+  const unsigned char seed[32] = {};
+  const ncrypto::Buffer<const unsigned char> input{seed, sizeof(seed)};
+  auto key = EVPKeyPointer::NewRawPrivate(KeyAlgorithm::ED25519, input);
+  ASSERT_TRUE(key);
+  EXPECT_TRUE(key.isA(KeyAlgorithm::ED25519));
+  EXPECT_FALSE(key.isA(KeyAlgorithm::X25519));
+  ASSERT_EQ(key.getAlgorithm(), &KeyAlgorithm::ED25519);
+  EXPECT_TRUE(key.getAlgorithm()->isOneShot());
+  EXPECT_TRUE(key.supportsRawPublic());
+  EXPECT_TRUE(key.supportsRawPrivate());
+  EXPECT_EQ(key.getAlgorithm()->seedSize(), 0);
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  // Provider aliases are recognized without comparing the primary type name.
+  EXPECT_TRUE(key.isA("1.3.101.112"));
+  auto ctx = ncrypto::EVPKeyCtxPointer::NewFromName("1.3.101.112");
+  ASSERT_TRUE(ctx);
+  ASSERT_TRUE(ctx.initForKeygen());
+  EVP_PKEY* generated = nullptr;
+  ASSERT_EQ(EVP_PKEY_keygen(ctx.get(), &generated), 1);
+  EXPECT_TRUE(EVPKeyPointer(generated).isA(KeyAlgorithm::ED25519));
+#endif
+  auto pub = key.rawPublicKey();
+  ASSERT_TRUE(pub);
+  auto imported = EVPKeyPointer::NewRawPublic(KeyAlgorithm::ED25519, pub);
+  ASSERT_TRUE(imported);
+  EXPECT_TRUE(imported.isA(KeyAlgorithm::ED25519));
+  auto exported = imported.rawPublicKey();
+  ASSERT_EQ(pub.size(), exported.size());
+  EXPECT_EQ(memcmp(pub.get(), exported.get(), pub.size()), 0);
+}
+
+TEST(NodeCrypto, NamedRsaPssKey) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  EXPECT_FALSE(EVPKeyCtxPointer::NewFromName("unknown-key-algorithm"));
+  EXPECT_FALSE(EVPKeyCtxPointer::NewFromName(nullptr));
+#ifndef OPENSSL_IS_BORINGSSL
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::RSA_PSS);
+  ASSERT_TRUE(ctx);
+  ASSERT_TRUE(ctx.initForKeygen());
+  ASSERT_TRUE(ctx.setRsaKeygenBits(2048));
+  EVP_PKEY* raw = nullptr;
+  ASSERT_EQ(EVP_PKEY_keygen(ctx.get(), &raw), 1);
+  EVPKeyPointer key(raw);
+  EXPECT_TRUE(key.isA(KeyAlgorithm::RSA_PSS));
+  EXPECT_FALSE(key.isA(KeyAlgorithm::RSA));
+  EXPECT_FALSE(key.supportsContextString());
+  EXPECT_TRUE(key.isRsaVariant());
+  EXPECT_EQ(key.getDefaultSignPadding(), RSA_PKCS1_PSS_PADDING);
+  EXPECT_FALSE(key.supportsRawPublic());
+  ASSERT_EQ(key.getAlgorithm(), &KeyAlgorithm::RSA_PSS);
+  EXPECT_FALSE(key.getAlgorithm()->isOneShot());
+#endif
+}
+
+TEST(NodeCrypto, ProviderPqcKeyWithoutLegacyId) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  if (!KeyAlgorithm::ML_DSA_44.isAvailable() ||
+      !KeyAlgorithm::ML_KEM_768.isAvailable())
+    GTEST_SKIP();
+  const unsigned char seed[64] = {};
+  for (const auto* algorithm :
+       {&KeyAlgorithm::ML_DSA_44, &KeyAlgorithm::ML_KEM_768}) {
+    const ncrypto::Buffer<const unsigned char> input{seed,
+                                                     algorithm->seedSize()};
+    auto key = EVPKeyPointer::NewRawSeed(*algorithm, input);
+    ASSERT_TRUE(key);
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+    EXPECT_EQ(EVP_PKEY_id(key.get()), -1);
+#endif
+    EXPECT_TRUE(key.isA(*algorithm));
+    ASSERT_EQ(key.getAlgorithm(), algorithm);
+    EXPECT_EQ(key.getAlgorithm()->seedSize(), input.len);
+    EXPECT_TRUE(key.supportsRawPublic());
+    EXPECT_FALSE(key.supportsRawPrivate());
+    auto exported_seed = key.rawSeed();
+    ASSERT_TRUE(exported_seed);
+    ASSERT_EQ(exported_seed.value.size(), input.len);
+    EXPECT_EQ(memcmp(exported_seed.value.get(), seed, input.len), 0);
+    auto pub = key.rawPublicKey();
+    ASSERT_TRUE(pub);
+    auto imported = EVPKeyPointer::NewRawPublic(*algorithm, pub);
+    ASSERT_TRUE(imported);
+    EXPECT_EQ(imported.getAlgorithm(), algorithm);
+
+    auto private_jwk = key.exportRawJwk(/* include_private */ true);
+    ASSERT_TRUE(private_jwk);
+    EXPECT_EQ(private_jwk.value.algorithm, algorithm);
+    ASSERT_EQ(private_jwk.value.private_key.size(), input.len);
+    EXPECT_EQ(memcmp(private_jwk.value.private_key.get(), seed, input.len), 0);
+    ASSERT_EQ(private_jwk.value.public_key.size(), pub.size());
+    EXPECT_EQ(memcmp(private_jwk.value.public_key.get(), pub.get(), pub.size()),
+              0);
+    auto public_jwk = imported.exportRawJwk(/* include_private */ false);
+    ASSERT_TRUE(public_jwk);
+    EXPECT_EQ(public_jwk.value.algorithm, algorithm);
+    EXPECT_FALSE(public_jwk.value.private_key);
+    ASSERT_EQ(public_jwk.value.public_key.size(), pub.size());
+    EXPECT_EQ(memcmp(public_jwk.value.public_key.get(), pub.get(), pub.size()),
+              0);
+    EXPECT_EQ(imported.rawSeed().error,
+              EVPKeyPointer::RawExportError::MISSING_SEED);
+    EXPECT_EQ(imported.exportRawJwk(/* include_private */ true).error,
+              EVPKeyPointer::RawExportError::MISSING_SEED);
+  }
+}
+
+TEST(NodeCrypto, PqcJwkRawPrivateExport) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  const auto& algorithm = KeyAlgorithm::SLH_DSA_SHA2_128S;
+  if (!algorithm.isAvailable()) GTEST_SKIP();
+  auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(algorithm);
+  ASSERT_TRUE(ctx);
+  ASSERT_EQ(EVP_PKEY_keygen_init(ctx.get()), 1);
+  EVP_PKEY* raw = nullptr;
+  ASSERT_EQ(EVP_PKEY_keygen(ctx.get(), &raw), 1);
+  EVPKeyPointer key(raw);
+  CheckRawJwkImport(key);
+  auto priv = key.rawPrivateKey();
+  auto pub = key.rawPublicKey();
+  ASSERT_TRUE(priv);
+  ASSERT_TRUE(pub);
+  auto jwk = key.exportRawJwk(/* include_private */ true);
+  ASSERT_TRUE(jwk);
+  EXPECT_EQ(jwk.value.algorithm, &algorithm);
+  ASSERT_EQ(jwk.value.private_key.size(), priv.size());
+  EXPECT_EQ(memcmp(jwk.value.private_key.get(), priv.get(), priv.size()), 0);
+  ASSERT_EQ(jwk.value.public_key.size(), pub.size());
+  EXPECT_EQ(memcmp(jwk.value.public_key.get(), pub.get(), pub.size()), 0);
+  EXPECT_EQ(key.rawSeed().error,
+            EVPKeyPointer::RawExportError::UNSUPPORTED_KEY_TYPE);
+}
+
+#ifdef OPENSSL_IS_BORINGSSL
+TEST(NodeCrypto, UnavailableBoringSSLKeyAlgorithms) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  for (const auto* algorithm :
+       {&KeyAlgorithm::SM2, &KeyAlgorithm::X448, &KeyAlgorithm::ED448}) {
+    EXPECT_FALSE(algorithm->isAvailable());
+    EXPECT_FALSE(EVPKeyCtxPointer::NewFromAlgorithm(*algorithm));
+  }
+}
+#endif
+
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+TEST(NodeCrypto, PrivateKeyEncodingOwnsFetchedCipher) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  EVPKeyPointer::PrivateKeyEncodingConfig assigned;
+  {
+    EVPKeyPointer::PrivateKeyEncodingConfig original;
+    original.cipher =
+        ncrypto::Cipher::FromNameForKeyEncoding("2.16.840.1.101.3.4.1.42");
+    ASSERT_TRUE(original.cipher);
+    ASSERT_NE(EVP_CIPHER_get0_provider(original.cipher.get()), nullptr);
+    const auto copied = original;
+    assigned = copied;
+  }
+
+  ASSERT_TRUE(assigned.cipher);
+  EXPECT_NE(EVP_CIPHER_get0_provider(assigned.cipher.get()), nullptr);
+  EXPECT_EQ(EVP_CIPHER_is_a(assigned.cipher.get(), "AES-256-CBC"), 1);
+  auto ctx = ncrypto::CipherCtxPointer::New();
+  const unsigned char key[32] = {};
+  const unsigned char iv[16] = {};
+  EXPECT_TRUE(ctx.init(assigned.cipher, true, key, iv));
+}
+
+TEST(NodeCrypto, PrivateKeyEncodingProviderOnlyCipher) {
+  ncrypto::ClearErrorOnReturn clear_errors;
+  const auto available = ncrypto::Cipher::FromName("AES-128-CBC-CTS");
+  if (!available) GTEST_SKIP();
+  const auto cipher =
+      ncrypto::Cipher::FromNameForKeyEncoding("AES-128-CBC-CTS");
+  ASSERT_TRUE(cipher);
+  EXPECT_NE(EVP_CIPHER_get0_provider(cipher.get()), nullptr);
+  EXPECT_EQ(EVP_CIPHER_is_a(cipher.get(), "AES-128-CBC-CTS"), 1);
+}
+#endif
diff --git a/test/client-proxy/test-https-proxy-request-header-overflow.mjs b/test/client-proxy/test-https-proxy-request-header-overflow.mjs
new file mode 100644
index 000000000000..2ffc215bafa9
--- /dev/null
+++ b/test/client-proxy/test-https-proxy-request-header-overflow.mjs
@@ -0,0 +1,45 @@
+// This tests that the proxy server cannot send unbounded incomplete headers
+// while establishing a CONNECT tunnel.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { once } from 'events';
+import http from 'node:http';
+import { runProxiedRequest } from '../common/proxy-server.js';
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const proxy = http.createServer();
+proxy.on('connect', common.mustCall((req, socket) => {
+  socket.write('HTTP/1.1 200 Connection Established\r\n');
+
+  const interval = setInterval(() => {
+    if (socket.destroyed) {
+      clearInterval(interval);
+      return;
+    }
+    socket.write('x'.repeat(100));
+  }, 10);
+  socket.on('close', () => clearInterval(interval));
+  socket.on('error', () => clearInterval(interval));
+}, 1));
+proxy.listen(0);
+await once(proxy, 'listening');
+
+const { code, signal, stderr, stdout } = await runProxiedRequest({
+  NODE_USE_ENV_PROXY: 1,
+  REQUEST_URL: 'https://localhost:1/test',
+  HTTPS_PROXY: `http://localhost:${proxy.address().port}`,
+}, ['--max-http-header-size=1024']);
+
+assert.match(
+  stderr,
+  /ERR_PROXY_TUNNEL.*Proxy response headers exceeded 1024 bytes/,
+);
+assert.doesNotMatch(stderr, /MaxListenersExceededWarning/);
+assert.strictEqual(stdout.trim(), '');
+assert.strictEqual(code, 0);
+assert.strictEqual(signal, null);
+
+proxy.close();
diff --git a/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs b/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
index 888137b9a5a6..6f27f0775aee 100644
--- a/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
+++ b/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
@@ -83,7 +83,9 @@ for (const testCase of testCases) {
           server.close();
           assert.deepStrictEqual(requests, expectedUrls);
           const requestLogs = logs.filter((log) => !('error' in log));
-          const errors = logs.filter((log) => 'error' in log);
+          // The client may reset a tunnel while the proxy is still relaying
+          // the upstream's TLS shutdown; that says nothing about the URLs.
+          const errors = logs.filter((log) => 'error' in log && log.error.code !== 'ECONNRESET');
           assert.deepStrictEqual(new Set(requestLogs), expectedProxyLogs);
           assert.deepStrictEqual(errors, []);
         }));
diff --git a/test/common/child_process.js b/test/common/child_process.js
index c74154bb084f..59505e5824dd 100644
--- a/test/common/child_process.js
+++ b/test/common/child_process.js
@@ -15,12 +15,12 @@ function cleanupStaleProcess(filename) {
   process.once('beforeExit', () => {
     const basename = filename.replace(/.*[/\\]/g, '');
     try {
-      execFileSync(`${process.env.SystemRoot}\\System32\\wbem\\WMIC.exe`, [
-        'process',
-        'where',
-        `commandline like '%${basename}%child'`,
-        'delete',
-        '/nointeractive',
+      execFileSync(`${process.env.SystemRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, [
+        '-NoProfile',
+        '-NonInteractive',
+        '-Command',
+        `Get-CimInstance Win32_Process -Filter "CommandLine LIKE '%${basename}%child'" | ` +
+        'ForEach-Object { Stop-Process -Id $_.ProcessId -Force }',
       ]);
     } catch {
       // Ignore failures, there might not be any stale process to clean up.
diff --git a/test/common/crypto.js b/test/common/crypto.js
index f50d3895a178..49678e0de43a 100644
--- a/test/common/crypto.js
+++ b/test/common/crypto.js
@@ -50,9 +50,14 @@ function assertApproximateSize(key, expectedSize) {
 function testEncryptDecrypt(publicKey, privateKey) {
   const message = 'Hello Node.js world!';
   const plaintext = Buffer.from(message, 'utf8');
+  const withOaepHash = (key) => {
+    if (!hasFIPS(3)) return key;
+    if (key?.key !== undefined) return { ...key, oaepHash: 'sha256' };
+    return { key, oaepHash: 'sha256' };
+  };
   for (const key of [publicKey, privateKey]) {
-    const ciphertext = publicEncrypt(key, plaintext);
-    const received = privateDecrypt(privateKey, ciphertext);
+    const ciphertext = publicEncrypt(withOaepHash(key), plaintext);
+    const received = privateDecrypt(withOaepHash(privateKey), ciphertext);
     assert.strictEqual(received.toString('utf8'), message);
   }
 }
@@ -118,6 +123,12 @@ const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
   return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch);
 };
 
+const isBoringSSL = process.features.openssl_is_boringssl;
+
+const hasFIPS = (major = 0, minor = 0, patch = 0) => {
+  return crypto.getFips() === 1 && hasOpenSSL(major, minor, patch);
+};
+
 let opensslCli = null;
 
 module.exports = {
@@ -134,6 +145,8 @@ module.exports = {
   sec1Exp,
   sec1EncExp,
   hasOpenSSL,
+  hasFIPS,
+  isBoringSSL,
   get hasOpenSSL3() {
     return hasOpenSSL(3);
   },
diff --git a/test/common/index.js b/test/common/index.js
index 9d15b57bf6b8..0f2d695bbc5a 100755
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -807,8 +807,9 @@ function invalidArgTypeHelper(input) {
     return ` Received function ${input.name}`;
   }
   if (typeof input === 'object') {
-    if (input.constructor?.name) {
-      return ` Received an instance of ${input.constructor.name}`;
+    const name = input.constructor?.name;
+    if (typeof name === 'string' && name !== '') {
+      return ` Received an instance of ${name}`;
     }
     return ` Received ${inspect(input, { depth: -1 })}`;
   }
diff --git a/test/common/watch.js b/test/common/watch.js
index c3d22c30f78e..477a4a74946d 100644
--- a/test/common/watch.js
+++ b/test/common/watch.js
@@ -59,14 +59,20 @@ async function performFileOperation(operation, useRunApi, timeout = 1000) {
   }
 }
 
-function assertTestOutput(run, shouldCheckRecursion = false) {
+function assertTestOutput(run, shouldCheckRecursion = false, expectations) {
   if (shouldCheckRecursion) {
     assert.doesNotMatch(run, /run\(\) is being called recursively/);
   }
-  assert.match(run, /tests 1/);
-  assert.match(run, /pass 1/);
-  assert.match(run, /fail 0/);
-  assert.match(run, /cancelled 0/);
+  assert.match(run, new RegExp(`\n${Object.entries({
+    tests: 1,
+    suites: 0,
+    pass: 1,
+    fail: 0,
+    cancelled: 0,
+    skipped: 0,
+    todo: 0,
+    ...expectations,
+  }).map((t) => `. ${t.join(' ')}`).join('\n')}\n`));
 }
 
 async function testRunnerWatch({
@@ -215,9 +221,11 @@ async function testRunnerWatch({
     child.kill();
     await once(child, 'exit');
 
-    for (const run of runs) {
-      assertTestOutput(run, false);
-    }
+    assertTestOutput(runs[0], false);
+    assertTestOutput(runs[1], false, isolation === 'none' && {
+      tests: 2,
+      pass: 2,
+    });
   };
 
   action === 'update' && await testUpdate();
diff --git a/test/embedding/embedtest.cc b/test/embedding/embedtest.cc
index 982eed74f954..6a5207330f83 100644
--- a/test/embedding/embedtest.cc
+++ b/test/embedding/embedtest.cc
@@ -19,6 +19,7 @@ using node::MultiIsolatePlatform;
 using v8::Context;
 using v8::HandleScope;
 using v8::Isolate;
+using v8::Local;
 using v8::Locker;
 using v8::MaybeLocal;
 using v8::V8;
@@ -27,6 +28,11 @@ using v8::Value;
 static int RunNodeInstance(MultiIsolatePlatform* platform,
                            const std::vector<std::string>& args,
                            const std::vector<std::string>& exec_args);
+static int RunSnapshotWithIsolateSettings(
+    MultiIsolatePlatform* platform,
+    const node::EmbedderSnapshotData* snapshot,
+    const std::vector<std::string>& args,
+    const std::vector<std::string>& exec_args);
 
 NODE_MAIN(int argc, node::argv_type raw_argv[]) {
   char** argv = nullptr;
@@ -59,8 +65,20 @@ NODE_MAIN(int argc, node::argv_type raw_argv[]) {
   cppgc::InitializeProcess(platform->GetPageAllocator());
   V8::Initialize();
 
-  int ret =
-      RunNodeInstance(platform.get(), result->args(), result->exec_args());
+  // --embedder-run-twice: two sequential instances in one process, each
+  // loading (and freeing) its own copy of the snapshot.
+  std::vector<std::string> instance_args = result->args();
+  auto twice = std::find(
+      instance_args.begin(), instance_args.end(), "--embedder-run-twice");
+  int runs = 1;
+  if (twice != instance_args.end()) {
+    instance_args.erase(twice);
+    runs = 2;
+  }
+  int ret = 0;
+  for (int i = 0; i < runs && ret == 0; i++) {
+    ret = RunNodeInstance(platform.get(), instance_args, result->exec_args());
+  }
 
   V8::Dispose();
   V8::DisposePlatform();
@@ -84,6 +102,7 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
   // Running snapshot:
   // embedtest --embedder-snapshot-blob blob-path
   //           [--embedder-snapshot-as-file]
+  //           [--embedder-isolate-settings]
   //           arg1 arg2...
   // No snapshot:
   // embedtest arg1 arg2...
@@ -93,6 +112,7 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
   std::vector<std::string> filtered_args;
   bool is_building_snapshot = false;
   bool snapshot_as_file = false;
+  bool with_isolate_settings = false;
   std::optional<node::SnapshotConfig> snapshot_config;
   std::string snapshot_blob_path;
   for (size_t i = 0; i < args.size(); ++i) {
@@ -101,6 +121,8 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
       is_building_snapshot = true;
     } else if (arg == "--embedder-snapshot-as-file") {
       snapshot_as_file = true;
+    } else if (arg == "--embedder-isolate-settings") {
+      with_isolate_settings = true;
     } else if (arg == "--without-code-cache") {
       if (!snapshot_config.has_value()) {
         snapshot_config = node::SnapshotConfig{};
@@ -150,6 +172,11 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
                          node::GetAnonymousMainPath());
   }
 
+  if (snapshot && with_isolate_settings) {
+    return RunSnapshotWithIsolateSettings(
+        platform, snapshot.get(), filtered_args, exec_args);
+  }
+
   std::vector<std::string> errors;
   std::unique_ptr<CommonEnvironmentSetup> setup;
 
@@ -233,3 +260,67 @@ int RunNodeInstance(MultiIsolatePlatform* platform,
 
   return exit_code;
 }
+
+// CommonEnvironmentSetup does not take IsolateSettings, so this goes through
+// NewIsolate()/CreateIsolateData()/CreateEnvironment() directly.
+static int RunSnapshotWithIsolateSettings(
+    MultiIsolatePlatform* platform,
+    const node::EmbedderSnapshotData* snapshot,
+    const std::vector<std::string>& args,
+    const std::vector<std::string>& exec_args) {
+  uv_loop_t loop;
+  int ret = uv_loop_init(&loop);
+  assert(ret == 0);
+
+  std::shared_ptr<node::ArrayBufferAllocator> allocator =
+      node::ArrayBufferAllocator::Create();
+  node::IsolateSettings settings;
+  settings.prepare_stack_trace_callback = [](Local<Context> context,
+                                             Local<Value> exception,
+                                             Local<v8::Array> trace) {
+    return MaybeLocal<Value>(v8::String::NewFromUtf8Literal(
+        v8::Isolate::GetCurrent(), "stack trace prepared by the embedder"));
+  };
+  Isolate* isolate =
+      node::NewIsolate(allocator, &loop, platform, snapshot, settings);
+  assert(isolate != nullptr);
+
+  int exit_code = 1;
+  {
+    Locker locker(isolate);
+    Isolate::Scope isolate_scope(isolate);
+    HandleScope handle_scope(isolate);
+
+    std::unique_ptr<node::IsolateData, decltype(&node::FreeIsolateData)>
+        isolate_data(node::CreateIsolateData(
+                         isolate, &loop, platform, allocator.get(), snapshot),
+                     node::FreeIsolateData);
+    std::unique_ptr<Environment, decltype(&node::FreeEnvironment)> env(
+        node::CreateEnvironment(
+            isolate_data.get(), Local<Context>(), args, exec_args),
+        node::FreeEnvironment);
+    assert(env);
+
+    Context::Scope context_scope(node::GetMainContext(env.get()));
+    if (!node::LoadEnvironment(env.get(), node::StartExecutionCallback{})
+             .IsEmpty()) {
+      exit_code = node::SpinEventLoop(env.get()).FromMaybe(1);
+    }
+    node::Stop(env.get());
+  }
+
+  bool platform_finished = false;
+  platform->AddIsolateFinishedCallback(
+      isolate,
+      [](void* data) {
+        bool* finished = static_cast<bool*>(data);
+        *finished = true;
+      },
+      &platform_finished);
+  platform->DisposeIsolate(isolate);
+  while (!platform_finished) uv_run(&loop, UV_RUN_ONCE);
+  ret = uv_loop_close(&loop);
+  assert(ret == 0);
+
+  return exit_code;
+}
diff --git a/test/embedding/test-embedding-snapshot-isolate-settings.js b/test/embedding/test-embedding-snapshot-isolate-settings.js
new file mode 100644
index 000000000000..67444da1e4cf
--- /dev/null
+++ b/test/embedding/test-embedding-snapshot-isolate-settings.js
@@ -0,0 +1,38 @@
+'use strict';
+
+// IsolateSettings passed to NewIsolate() with a snapshot must survive
+// CreateEnvironment(); see RunSnapshotWithIsolateSettings() in embedtest.cc.
+
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+
+const {
+  spawnSyncAndAssert,
+  spawnSyncAndExitWithoutError,
+} = require('../common/child_process');
+
+const embedtest = common.resolveBuiltBinary('embedtest');
+const snapshotBlobArgs = [
+  '--embedder-snapshot-blob', tmpdir.resolve('embedder-snapshot.blob'),
+];
+const buildSnapshotScript = `
+  require('v8').startupSnapshot.setDeserializeMainFunction(() => {
+    console.log(new Error('from the snapshot main function').stack);
+  });
+`;
+
+tmpdir.refresh();
+
+spawnSyncAndExitWithoutError(
+  embedtest,
+  ['--', buildSnapshotScript, ...snapshotBlobArgs, '--embedder-snapshot-create'],
+  { cwd: tmpdir.path });
+
+spawnSyncAndAssert(
+  embedtest,
+  ['--', ...snapshotBlobArgs, '--embedder-isolate-settings'],
+  { cwd: tmpdir.path },
+  {
+    trim: true,
+    stdout: 'stack trace prepared by the embedder',
+  });
diff --git a/test/embedding/test-embedding-snapshot-twice.js b/test/embedding/test-embedding-snapshot-twice.js
new file mode 100644
index 000000000000..7d09aab78e10
--- /dev/null
+++ b/test/embedding/test-embedding-snapshot-twice.js
@@ -0,0 +1,39 @@
+'use strict';
+
+// Tests that an embedder can free the EmbedderSnapshotData it created an
+// instance from and create a second instance from a fresh copy afterwards.
+
+const common = require('../common');
+const assert = require('assert');
+const tmpdir = require('../common/tmpdir');
+const fixtures = require('../common/fixtures');
+const {
+  spawnSyncAndAssert,
+  spawnSyncAndExitWithoutError,
+} = require('../common/child_process');
+
+const embedtest = common.resolveBuiltBinary('embedtest');
+const snapshotFixture = fixtures.path('snapshot', 'echo-args.js');
+const blob = tmpdir.resolve('embedder-snapshot.blob');
+
+tmpdir.refresh();
+
+spawnSyncAndExitWithoutError(
+  embedtest,
+  [
+    '--',
+    `eval(require("fs").readFileSync(${JSON.stringify(snapshotFixture)}, "utf8"))`,
+    'arg1', 'arg2', '--embedder-snapshot-blob', blob, '--embedder-snapshot-create',
+  ],
+  { cwd: tmpdir.path });
+
+spawnSyncAndAssert(
+  embedtest,
+  ['--', 'arg3', '--embedder-snapshot-blob', blob, '--embedder-run-twice'],
+  { cwd: tmpdir.path },
+  {
+    stdout(output) {
+      assert.strictEqual(output.split('arg3').length, 3);
+      return true;
+    },
+  });
diff --git a/test/embedding/test-embedding-snapshot-vm.js b/test/embedding/test-embedding-snapshot-vm.js
index 0d60059056ad..fdf09cf6be37 100644
--- a/test/embedding/test-embedding-snapshot-vm.js
+++ b/test/embedding/test-embedding-snapshot-vm.js
@@ -27,7 +27,7 @@ const runSnapshotExecArgs = ['arg3', 'arg4'];
 
 tmpdir.refresh();
 
-// Build the snapshot with the vm-creating code in serialized main funciton.
+// Build the snapshot with the vm-creating code in serialized main function.
 spawnSyncAndExitWithoutError(
   embedtest,
   ['--', ...buildSnapshotExecArgs, ...snapshotBlobArgs, '--embedder-snapshot-create'],
diff --git a/test/embedding/test-embedding-snapshot-worker.js b/test/embedding/test-embedding-snapshot-worker.js
index c6f665eed4d1..9349030fd505 100644
--- a/test/embedding/test-embedding-snapshot-worker.js
+++ b/test/embedding/test-embedding-snapshot-worker.js
@@ -27,7 +27,7 @@ const runSnapshotExecArgs = ['arg3', 'arg4'];
 
 tmpdir.refresh();
 
-// Build the snapshot with the worker-creating code in serialized main funciton.
+// Build the snapshot with the worker-creating code in serialized main function.
 spawnSyncAndExitWithoutError(
   embedtest,
   ['--', ...buildSnapshotExecArgs, ...snapshotBlobArgs, '--embedder-snapshot-create'],
diff --git a/test/embedding/test-embedding-trace-events-unavailable.js b/test/embedding/test-embedding-trace-events-unavailable.js
new file mode 100644
index 000000000000..974702374832
--- /dev/null
+++ b/test/embedding/test-embedding-trace-events-unavailable.js
@@ -0,0 +1,18 @@
+'use strict';
+
+// The embedtest binary runs on its own MultiIsolatePlatform without Node's
+// tracing agent, so node:trace_events must report itself as unavailable.
+
+const common = require('../common');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+spawnSyncAndAssert(
+  common.resolveBuiltBinary('embedtest'),
+  [
+    'try { require("node:trace_events").createTracing({ categories: ["v8"] }); }' +
+    'catch (e) { console.log(e.code); }',
+  ],
+  {
+    trim: true,
+    stdout: 'ERR_TRACE_EVENTS_UNAVAILABLE',
+  });
diff --git a/test/es-module/test-wasm-web-api.js b/test/es-module/test-wasm-web-api.js
index ee1971133be5..6177c909e56c 100644
--- a/test/es-module/test-wasm-web-api.js
+++ b/test/es-module/test-wasm-web-api.js
@@ -16,7 +16,13 @@ const simpleWasmBytes = fixtures.readSync('simple.wasm');
 // Sets up an HTTP server with the given response handler and calls fetch() to
 // obtain a Response from the newly created server.
 async function testRequest(handler) {
-  const server = createServer((_, res) => handler(res)).unref().listen(0);
+  const server = createServer(common.mustCall((_, res) => {
+    res.setHeader('Connection', 'close');
+    res.once('close', common.mustCall(() => {
+      server.close(common.mustCall());
+    }));
+    handler(res);
+  })).listen(0);
   await events.once(server, 'listening');
   const { port } = server.address();
   return fetch(`http://127.0.0.1:${port}/foo.wasm`);
diff --git a/test/fixtures/aead-vectors.js b/test/fixtures/aead-vectors.js
index 6b1d169b2a7a..4784b8165ffa 100644
--- a/test/fixtures/aead-vectors.js
+++ b/test/fixtures/aead-vectors.js
@@ -1,4 +1,89 @@
 module.exports = [
+  // RFC 5297, Appendix A.1
+  { algo: 'aes-128-siv',
+    key: 'fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0' +
+         'f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff',
+    iv: '',
+    plain: '112233445566778899aabbccddee',
+    plainIsHex: true,
+    aad: '101112131415161718191a1b1c1d1e1f2021222324252627',
+    ct: '40c02b9690c4dc04daef7f6afe5c',
+    tag: '85632d07c6e8f37f950acd320a2ecc93', tampered: false },
+
+  // RFC 5297, Appendix A.2
+  { algo: 'aes-128-siv',
+    key: '7f7e7d7c7b7a79787776757473727170' +
+         '404142434445464748494a4b4c4d4e4f',
+    iv: '',
+    plain: '7468697320697320736f6d6520706c61' +
+           '696e7465787420746f20656e63727970' +
+           '74207573696e67205349562d414553',
+    plainIsHex: true,
+    aads: [
+      '00112233445566778899aabbccddeeff' +
+      'deaddadadeaddadaffeeddccbbaa9988' +
+      '7766554433221100',
+      '102030405060708090a0',
+      '09f911029d74e35bd84156c5635688c0',
+    ],
+    ct: 'cb900f2fddbe404326601965c889bf17' +
+        'dba77ceb094fa663b7a3f748ba8af829' +
+        'ea64ad544a272e9c485b62a3fd5c0d',
+    tag: '7bdb6e3b432667eb06f4d14bff2fbd0f', tampered: false },
+
+  // RFC 8452, Appendix C.1
+  { algo: 'aes-128-gcm-siv',
+    key: '36864200e0eaf5284d884a0e77d31646',
+    iv: 'bae8e37fc83441b16034566b',
+    plain: '7a806c',
+    plainIsHex: true,
+    aad: '46bb91c3c5',
+    ct: 'af60eb',
+    tag: '711bd85bc1e4d3e0a462e074eea428a8', tampered: false },
+
+  // RFC 8452, Appendix C.2
+  { algo: 'aes-256-gcm-siv',
+    key: 'bae8e37fc83441b16034566b7a806c46' +
+         'bb91c3c5aedb64a6c590bc84d1a5e269',
+    iv: 'e4b47801afc0577e34699b9e',
+    plain: '671fdd',
+    plainIsHex: true,
+    aad: '4fbdc66f14',
+    ct: '0eaccb',
+    tag: '93da9bb81333aee0c785b240d319719d', tampered: false },
+
+  // RFC 8998, Appendix A.1
+  { algo: 'sm4-gcm',
+    key: '0123456789abcdeffedcba9876543210',
+    iv: '00001234567800000000abcd',
+    plain: 'aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb' +
+           'ccccccccccccccccdddddddddddddddd' +
+           'eeeeeeeeeeeeeeeeffffffffffffffff' +
+           'eeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaa',
+    plainIsHex: true,
+    aad: 'feedfacedeadbeeffeedfacedeadbeefabaddad2',
+    ct: '17f399f08c67d5ee19d0dc9969c4bb7d' +
+        '5fd46fd3756489069157b282bb200735' +
+        'd82710ca5c22f0ccfa7cbf93d496ac15' +
+        'a56834cbcf98c397b4024a2691233b8d',
+    tag: '83de3541e4c2b58177e065a9bf7b62ec', tampered: false },
+
+  // RFC 8998, Appendix A.2
+  { algo: 'sm4-ccm',
+    key: '0123456789abcdeffedcba9876543210',
+    iv: '00001234567800000000abcd',
+    plain: 'aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb' +
+           'ccccccccccccccccdddddddddddddddd' +
+           'eeeeeeeeeeeeeeeeffffffffffffffff' +
+           'eeeeeeeeeeeeeeeeaaaaaaaaaaaaaaaa',
+    plainIsHex: true,
+    aad: 'feedfacedeadbeeffeedfacedeadbeefabaddad2',
+    ct: '48af93501fa62adbcd414cce6034d895' +
+        'dda1bf8f132f042098661572e7483094' +
+        'fd12e518ce062c98acee28d95df4416b' +
+        'ed31a2f04476c18bb40c84a74b97dc5b',
+    tag: '16842d4fa186f56ab33256971fa110f4', tampered: false },
+
   { algo: 'aes-128-gcm',
     key: '6970787039613669314d623455536234',
     iv: '583673497131313748307652', plain: 'Hello World!',
diff --git a/test/fixtures/child-process-kill-spawn-error.js b/test/fixtures/child-process-kill-spawn-error.js
new file mode 100644
index 000000000000..6dffe5b27efc
--- /dev/null
+++ b/test/fixtures/child-process-kill-spawn-error.js
@@ -0,0 +1,4 @@
+const { spawn } = require('child_process');
+const child = spawn('foo123');
+child.on('error', () => {});
+if (child.kill() !== false || child.killed !== false) process.exit(1);
diff --git a/test/fixtures/crypto/ecdsa.js b/test/fixtures/crypto/ecdsa.js
index c3545fb20ec7..6da56a0601ff 100644
--- a/test/fixtures/crypto/ecdsa.js
+++ b/test/fixtures/crypto/ecdsa.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function() {
   const pkcs8 = {
     'P-256': Buffer.from(
@@ -72,7 +74,7 @@ module.exports = function() {
         'b6a0a14d7e4bc6dd2eda82c9234f174b670b60c8f7d101f68fdf5889e02373b025' +
         'dcbc4c82f2929b8e06c68535da98e38fe399c53a814b097935581ef21535eb',
         'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           'f6a48eb5557f484ed0c3e4b5c78a3cf497cbd346db06a4165d429248aa2cc51a69' +
           '747d09f57af145469a8b607a9b8b9709629d74e8f5ca337c6ddc581b6f6103',
@@ -104,7 +106,7 @@ module.exports = function() {
         '72fbdb369fd34c1c54264d07f4facd69b02e4206f8a8bb259b882a305c56fde2d3' +
         '5107e493c53cd6b4af0b31306f4d03fd43cfc762a1030e17a3d775453a1212b142' +
         '9f7b3d93066a5f42a10b138cd177dc09616e827d598822d78d4627b754e6', 'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           '0b07c078be30fa5925a307d6fc559c5f398e63fb5d007d6b24a834847f2d3d18d5' +
           'b5e840711c52a7bc6626c3ced93301e873c013a706f6b297c12cc6d47a71e0529e' +
@@ -144,7 +146,7 @@ module.exports = function() {
         '01f0071e6a32867fa70f695cd39c4e87e142b9e4134d38740bd6fee354a575167e' +
         '13524e94832637910fe11e53a85fb21b91adb81bb1779c4e2b8bc87c717dc35084',
         'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           '00463679f47a4c705e03447360dcf34d1743e0d4b2591cc66832a6bc80d92e538c' +
           '169a1fd330f98e7235ca7fec7e16ac44fb13095b8edf2c76b75c4845177d59e425' +
@@ -170,7 +172,7 @@ module.exports = function() {
   const curves = ['P-256', 'P-384', 'P-521'];
   const hashes = ['SHA-1', 'SHA-256', 'SHA-384', 'SHA-512'];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     hashes.push('SHA3-256', 'SHA3-384', 'SHA3-512');
   }
 
diff --git a/test/fixtures/crypto/eddsa.js b/test/fixtures/crypto/eddsa.js
index a5382219f4f3..4c91b044d72f 100644
--- a/test/fixtures/crypto/eddsa.js
+++ b/test/fixtures/crypto/eddsa.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 const common = require('../../common');
 
 module.exports = function() {
@@ -46,7 +48,7 @@ module.exports = function() {
   const algorithms = ['Ed25519'];
   const contexts = [new Uint8Array(0), new Uint8Array(32), new Uint8Array(255)];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     algorithms.push('Ed448')
   } else {
     common.printSkipMessage(`Skipping unsupported Ed448 test cases`);
diff --git a/test/fixtures/crypto/hmac.js b/test/fixtures/crypto/hmac.js
index acdf3229a4bc..55376a1299d8 100644
--- a/test/fixtures/crypto/hmac.js
+++ b/test/fixtures/crypto/hmac.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function () {
   const plaintext = Buffer.from(
     '5f4dba4f320c0ce876725afce5fbd25bf83e5a7125a08cafe73c3ebac421779df9d55d' +
@@ -22,7 +24,7 @@ module.exports = function () {
       '5dcc359443aaf652fa1375d6b3e61fdcf29bb4a28bd5d3dcfa40f82f906bb280' +
       '0455db03b5d31fb972a15a6d0103a24e56d156a119c0e5a1e92a44c3c5657cf9',
       'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'SHA3-256': Buffer.from(
         'e588ec0811463d767241df1074b47ae4071b51f2ce36537ba69ccdc3fdc2b7a8',
         'hex'),
@@ -48,7 +50,7 @@ module.exports = function () {
       '61fb278c3ffb0cce2bf1cf723ddfd8ef1f931c0c618c25907324605939e3f9a2' +
       'c6f4af690bda3407dc2f5770f6a0a44b954d64a332e3ee0821abf82b7f3e99c1',
       'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'SHA3-256': Buffer.from(
         'c1ac5e11fcd50c48bf567f6e296632f5801c4eb07a8a47579b41dee971a3099b',
         'hex'),
diff --git a/test/fixtures/crypto/rsa_pkcs.js b/test/fixtures/crypto/rsa_pkcs.js
index d54c44b6d820..74a8c0512ef4 100644
--- a/test/fixtures/crypto/rsa_pkcs.js
+++ b/test/fixtures/crypto/rsa_pkcs.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function () {
   const pkcs8 = Buffer.from(
     '308204bf020100300d06092a864886f70d0101010500048204a9308204a50201000282' +
@@ -97,7 +99,7 @@ module.exports = function () {
       '7a6335c70e193235dcda48add6858626bd96311e60f7e5ea4491b6c1e6248afe12b' +
       'bbd54f8869b043a5b0444562813f0a98b300356f306e6b783a29f3bec97ca40ea20' +
       '062cab8926ec5d96aa387cc84821a6d72b8ea126e7d', 'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'sha3-256': Buffer.from(
         'be1b476c1911a01d71710fd8a2f3158d6f7839e91443b01bed30dfdd04336d80c6b' +
         'f692c06fad254877901c10a73853e8fb202a29cddefdf16c3adcda1fc123625897d' +
@@ -161,7 +163,7 @@ module.exports = function () {
       plaintext,
       signature: signatures['sha-512']
     },
-    ...(!process.features.openssl_is_boringssl ? [
+    ...(!isBoringSSL ? [
       {
         publicKeyBuffer: spki,
         privateKeyBuffer: pkcs8,
diff --git a/test/fixtures/crypto/rsa_pss.js b/test/fixtures/crypto/rsa_pss.js
index 423f2c4d77bf..4aeaf3330e78 100644
--- a/test/fixtures/crypto/rsa_pss.js
+++ b/test/fixtures/crypto/rsa_pss.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function() {
   const pkcs8 = Buffer.from(
     '308204bf020100300d06092a864886f70d0101010500048204a9308204a5020100028' +
@@ -150,7 +152,7 @@ module.exports = function() {
       'b68c04bfe452c3adc6c10066a915231b7b404727eb6201b4921eb96d9407de2b963' +
       '3879ceb71d759d9828d7b4d062f6ef100757d8328187caf57dfb859d1555345207c' +
       '1cce7905c3564c08fec78867a53d5a2cf84810e1ffa', 'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'sha3-512, no salt': Buffer.from(
         'd2430dc87abeaa7d13f7cec8510f1a296e1c608f44b1696829c59a99e8eefe9b2ee' +
         '6ee8ad6fdc93c24fcba2f04d1da195924b6209717e1992c10ed9f4783478765fe34' +
@@ -255,7 +257,7 @@ module.exports = function() {
       plaintext,
       signature: signatures['sha-512, salted']
     },
-    ...(!process.features.openssl_is_boringssl ? [
+    ...(!isBoringSSL ? [
       {
         publicKeyBuffer: spki,
         privateKeyBuffer: pkcs8,
diff --git a/test/fixtures/keys/Makefile b/test/fixtures/keys/Makefile
index 128e928a5916..ac3a01780c7f 100644
--- a/test/fixtures/keys/Makefile
+++ b/test/fixtures/keys/Makefile
@@ -7,7 +7,9 @@ all: \
   ca4-cert.pem \
   ca5-cert.pem \
   ca6-cert.pem \
+  cert-without-key-fips.pfx \
   agent1-cert.pem \
+  agent1-fips.pfx \
   agent1.pfx \
   agent2-cert.pem \
   agent3-cert.pem \
@@ -39,6 +41,7 @@ all: \
   dsa_private_encrypted_1025.pem \
   dsa_public_1025.pem \
   ec-cert.pem \
+  ec-fips.pfx \
   ec.pfx \
   fake-cnnic-root-cert.pem \
   intermediate-ca-cert.pem \
@@ -68,6 +71,7 @@ all: \
   rsa_spkac.spkac \
   rsa_spkac_invalid.spkac \
   rsa_private_2048.pem \
+  rsa_private_2048_3_primes.pem \
   rsa_private_4096.pem \
   rsa_public_2048.pem \
   rsa_public_4096.pem \
@@ -444,6 +448,20 @@ agent1.pfx: agent1-cert.pem agent1-key.pem ca1-cert.pem
 		-out agent1.pfx \
 		-password pass:sample
 
+# PKCS12KDF is unavailable under FIPS properties. Use PBMAC1 with PBKDF2
+# instead, alongside AES-256/PBKDF2 key protection.
+agent1-fips.pfx: agent1-cert.pem agent1-key.pem ca1-cert.pem
+	openssl pkcs12 -export \
+		-keypbe AES-256-CBC \
+		-certpbe AES-256-CBC \
+		-iter 2048 \
+		-pbmac1_pbkdf2 \
+		-in agent1-cert.pem \
+		-inkey agent1-key.pem \
+		-certfile ca1-cert.pem \
+		-out agent1-fips.pfx \
+		-password pass:password
+
 agent1-verify: agent1-cert.pem ca1-cert.pem
 	openssl verify -CAfile ca1-cert.pem agent1-cert.pem
 
@@ -787,6 +805,30 @@ ec.pfx: ec-cert.pem ec-key.pem
 		-out ec.pfx \
 		-password pass:
 
+# See agent1-fips.pfx for why the FIPS fixture uses PBMAC1.
+ec-fips.pfx: ec-cert.pem ec-key.pem
+	openssl pkcs12 -export \
+		-keypbe AES-256-CBC \
+		-certpbe AES-256-CBC \
+		-iter 2048 \
+		-pbmac1_pbkdf2 \
+		-in ec-cert.pem \
+		-inkey ec-key.pem \
+		-out ec-fips.pfx \
+		-password pass:password
+
+# A bundle of certificates with no private key. See agent1-fips.pfx for why the
+# FIPS fixture uses PBMAC1.
+cert-without-key-fips.pfx: ca1-cert.pem
+	openssl pkcs12 -export \
+		-nokeys \
+		-certpbe AES-256-CBC \
+		-iter 2048 \
+		-pbmac1_pbkdf2 \
+		-in ca1-cert.pem \
+		-out cert-without-key-fips.pfx \
+		-password pass:password
+
 dh512.pem:
 	openssl dhparam -out dh512.pem 512
 
@@ -815,7 +857,8 @@ dsa_private.pem: dsa_params.pem
 	openssl gendsa -out dsa_private.pem dsa_params.pem
 
 dsa_private_encrypted.pem: dsa_private.pem
-	openssl dsa -aes256 -in dsa_private.pem -passout 'pass:password' -out dsa_private_encrypted.pem
+	openssl pkcs8 -topk8 -v2 aes-256-cbc -v2prf hmacWithSHA256 -iter 2048 -saltlen 16 \
+	  -in $< -passout 'pass:password' -out $@
 
 dsa_private_pkcs8.pem: dsa_private.pem
 	openssl pkcs8 -topk8 -inform PEM -outform PEM -in dsa_private.pem -out dsa_private_pkcs8.pem -nocrypt
@@ -839,7 +882,8 @@ rsa_private.pem:
 	openssl genrsa -out rsa_private.pem 2048
 
 rsa_private_encrypted.pem: rsa_private.pem
-	openssl rsa -aes256 -in rsa_private.pem -passout 'pass:password' -out rsa_private_encrypted.pem
+	openssl pkcs8 -topk8 -v2 aes-256-cbc -v2prf hmacWithSHA256 -iter 2048 -saltlen 16 \
+	  -in $< -passout 'pass:password' -out $@
 
 rsa_private_pkcs8.pem: rsa_private.pem
 	openssl pkcs8 -topk8 -inform PEM -outform PEM -in rsa_private.pem -out rsa_private_pkcs8.pem -nocrypt
@@ -899,6 +943,13 @@ rsa_spkac_invalid.spkac: rsa_spkac.spkac
 rsa_private_2048.pem:
 	openssl genrsa -out rsa_private_2048.pem 2048
 
+rsa_private_2048_3_primes.pem:
+	openssl genpkey \
+		-algorithm RSA \
+		-pkeyopt rsa_keygen_bits:2048 \
+		-pkeyopt rsa_keygen_primes:3 \
+		-out rsa_private_2048_3_primes.pem
+
 rsa_private_4096.pem:
 	openssl genrsa -out rsa_private_4096.pem 4096
 
diff --git a/test/fixtures/keys/agent1-fips.pfx b/test/fixtures/keys/agent1-fips.pfx
new file mode 100644
index 000000000000..5613cfae430b
Binary files /dev/null and b/test/fixtures/keys/agent1-fips.pfx differ
diff --git a/test/fixtures/keys/cert-without-key-fips.pfx b/test/fixtures/keys/cert-without-key-fips.pfx
new file mode 100644
index 000000000000..613dbf1a6798
Binary files /dev/null and b/test/fixtures/keys/cert-without-key-fips.pfx differ
diff --git a/test/fixtures/keys/dsa_private_encrypted.pem b/test/fixtures/keys/dsa_private_encrypted.pem
index 49b3375baf71..88da77e0a3b7 100644
--- a/test/fixtures/keys/dsa_private_encrypted.pem
+++ b/test/fixtures/keys/dsa_private_encrypted.pem
@@ -1,23 +1,18 @@
------BEGIN DSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: AES-256-CBC,FABA263DD471F214EF3E02699B837C20
-
-Tj2+4x9MEIaQGFQ4o7hk12MriVYyvLO5aCbqq7LG5uhVk546/+bJc6hewdSwb6oT
-MYPbuV+QTdtqshqFESA0McyGlj4w1tOg5TomP84NTKvwTO1EirVLMukfF3dqaguw
-C117AZJkGbqgbi6lZ2bG0Hta6HRbhI5+ODFtOp3rKQ2KwVmtL7zw6vt3PCISeMHN
-fLqikDc2+YoI9V1FJis9/FATyqV8yrJYYQQpP1RQN+gDY4SSs/eUr+Me7RNy6Lz7
-oH0tDaPGbiafwrZe1okksjxT2JQz1Q3hciBPikgdQIoE2NWTUlOeRYX0T0N2n37S
-6Odbcr522e+2XjcLj34Ozthp+Q5mIDcLuakazxkXhq0RyhJ7vo+xA2YiP7Q3vH7g
-oAnsJPFNVY6wJhprZi2VofKIUJUiajAXGDVX2yEIG/DOA9rnx0ZP+zopXMi4ptu0
-RzWyAL+P4jn0b8vgPf9CYJmn4VNfOcVmomZ1Bw6hzqTE2FnThJCXU3l2eaC/wcSR
-uMRp8c6IM8AR5DUzUBKIckkvXj1m5iSZoKuR8dB7s9BhrRtBAI7K3G254G06sByv
-0pnft8r+BkMqgdfG4rJQoQJw7tVYln+pL/gYPDuYsqyJ9kFuHDqtBvlozqXY5AL1
-XQaXoD6xMACEoJSIv5y+TzFzXwFQrDW+G1724YOSbiioUfGD0tRfjj2ei63PThQr
-Z50SryfKQQf4UgcJeokMhmRWT2vPXEFWEP1b2FMEQxBy6fyKcqwZBAbhqF6usGEB
-nwr/S1HXQAGEsWoc/Z4yynB7uhOwWu/Vpj+V6B98NmC7EUX15Why8zCsT9gzaIgC
-M6sZafHhcmjfwc+lL9xFlU/wnAOz0LeKZWry3D0sXZn1r2FRlOJdtLLx01Sve/MU
-ZRsgEDTkzv8E9dDltMeq8HQDCgLT1USTMWcY1kMELBj7y7ZdCWjH1QhTq2KlId+o
-1X28zJOsOL/XRseUSlpjmSSLRw1QQEypNCY2+tcvViAvn3AifipBbdzUNhvygLhc
-a2+5rYsd8BBEFnMJx7lDiyqXGnZkBbhbCSIudppNcjC+akFlFp6fBzkp4mKBuKpc
-hwBBdfqdEyzqu6SVHM8nGV/aDoRuu9shV6MX0y/KnIgLedudn8aN2eLgjR5k1+99
------END DSA PRIVATE KEY-----
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIC1TBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQUHwLuG5KIFDnU6OC
+5ADEzQICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEOrzdylfA3E36eSA
+aLsD6C0EggJwrFQCTATMWun5ffHFf42epvxuRH3Dv96gOejJxmItv3fqF7cfn+oB
+82gsGwdcjme6eGu7rg4lKi5e85WEImcg+xQdHnEmx62yP73CBfpzCs5KObbBd8ft
+EjlqQ+EWQ68+acdHOZ/xDqBiJnkisEVEnsTo9ZE7ZLVBKRP6Hr31eQ/7EKWBb6Ax
+oF+6+WgvyH8AuOO17CLjMOGO9pFl2TvJ1wsQtAIb2ZEAmPp0Z/lT9qXaoJfAz4pO
+o3+2woDPDm9PA6WXF8zD+zPBwnSBSPjvkwtsMp1CdhrAxaeEo+gbDqJjCI9/2m8j
+gAqkP+l7civZ7P7ydOPmlkiSdl4TXfhvfhk4RCSQbg6+YozggJO0ZiroCK7G5ro6
+4T+t2ck206kylOZV1xPrbW+Kt88vIVSxNs8dwHplEtb1VdoAV4EKfh3PEcsuSc4W
+NEGvaAEmzckAMG3GJgjZYS8EWfpLsuNRcvRJsbMeQCC4Iex9m4+KJVUmMmIBlBxV
+aoFEfYNGpkOdMV7l1Ne77c4HGI7NS6Yy+JcxYoc5kByTxaWOSvPSoQ3YQ+bY3GoT
+tAQRvoieBnzkkyjKaS0Qgnfkdfe4Ry7hSjToo3mOnA8wj6sjRtZdIQihTa1jZ3vP
+ELJ8lPTVBiPUC/AZ0C12s/JExY3y598Rlt7RQRA6ZN6PP9gnuuqR58sq/XoLnwBQ
+tHK8kz5BU4EZ2neMi7noHDmArgh083WGFX6WUAfDu9R8+hydnee86Wm4xThXk5NS
+TIGqwBal/5EgrSCbkcwxRw9xB0afMD4+muatKv6NEcRKT/VjhxdWP4gHONrh3tJF
+/pn2+4MtHeK8
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/fixtures/keys/ec-fips.pfx b/test/fixtures/keys/ec-fips.pfx
new file mode 100644
index 000000000000..1c26d641b9fc
Binary files /dev/null and b/test/fixtures/keys/ec-fips.pfx differ
diff --git a/test/fixtures/keys/rsa_private_2048_3_primes.pem b/test/fixtures/keys/rsa_private_2048_3_primes.pem
new file mode 100644
index 000000000000..49535f2cd7f7
--- /dev/null
+++ b/test/fixtures/keys/rsa_private_2048_3_primes.pem
@@ -0,0 +1,29 @@
+-----BEGIN PRIVATE KEY-----
+MIIE8wIBADANBgkqhkiG9w0BAQEFAASCBN0wggTZAgEBAoIBAQC1Lu9a9Hlj8/OA
+J3I2h/1aFYV59SxWb1KzbuRb2nAoOVWCqG8ettkT7kGN6qva3C/oCw2pYPIlRxpX
+0Vve0fNRqpSCCXcnN9vlKpU0BrHfpIHuXSleT7vwSq70UV5YwjFhL+g5wcCUVCuz
+Fkd8dYb0keqVApSKkcydepk5/BwBwQdkfibs3RuIjROkgIbDKSXrm1lFinqyCBTG
+umLcaL9XMhaJRxsVIVqkCM6hs+kEXhIBvlFIqcycECKEV3l71nV0VM3RwlbORIjx
+iHpSvNEUixGR0Rwx4WdJNU4GiUJGZACKj+RrLX+mh0odOl5r8Up9TkTgWp4UEdUx
+GHbQ6lIrAgMBAAECggEAA8mZY1Nc/kPpQTKR5qXtG+b7RVNku+HT3sBgsbLdSVn5
+eaO/vuqfmxUN9cOEGC0mKzmf7XyDU1grKs7LltrYtUpVlGpSPVWjmSTMvauuKDiu
+Jqd35+irM+pQerj/AYOs9Lv2lLzzA1ivcSmB0uR2gNyiVvVxBAxydNXiBwCn+v8M
++qosREPVN9eEQ+1j+ZWvZ2j/AkT6EDdOl0qbhkLDkaLgDkO4uhAZfNKjwmuVkBoW
+BI9bUiQv9vzsSp7AIVXwd8D+NaX0VuDpbcIq/tIfrl2OxwUDuTkYYsvwlIwvAkZ4
+yMl57x2YjRJu2u4f4t+fuagqCisbbbE+LywM5r+YEQJWB/Z/lOoAXXCRSBSGhI29
+zI+pXWiK4UneitEKTJpdR7i38Var03aciK+q64z4gWDNSBRzYq5eyVWosv0f9WkO
+lQFRfOy0HM68dg2KYDCIVnquCwwgaDcCVgZ7lxyKqwirCDYL9VFxRNiBIOXuMLdl
+6c4YNpdPTrp/AILBeINJYKBYjpro6fPe0YHcxJpMNf5Izaow17VVAqJKDmXbca7y
+SclsgBR6mAnFf6WfFM5rAlYBe2nHp74lphwEVH2tEkyvVFXrotemkv8uyzWliF2w
+SbtC2iTlGQCNmFSxvu1J92B9+AB574aI5r6dget+2+zw4uvt2oizi+8b8e09dgsK
+PY9DUyB9BQJWBTsT4uPAvW3DYlijyOMsOcV3Vg+rH1AMJ09CPTSwwapYLykMpGJA
+pSDPcA8fNrdDNRV9TULRDiyQRhLC+n1tcqVumKFISXEWOIBjmCKTKs9A/9IsZ6EC
+VgQG607Arq/ztxJFVKHY4RW0v8Ofx9Q0h+GDcKqqxDlymZfrDsdKJjC1QTofRUR+
+JJiwshahF2jBtlsPwEjX8/InboaF2f2VlIxzxe2+GpzWeRgzIN9yMIIBDDCCAQgC
+VgOChKyWwWrVMfjdfwtFnMA/OjwK4KBtR8VWwAapaiJPFhZRM0jh8EMsC03X7xm9
+AbL3hfE3eLU2mRLxw1pPh0RfK2xtKTCZWjgnQDhPznMUUvF+FYxHAlYCZbRvGa1U
+Zffy7n7m2Q4+tTD2b8uLZ/jcjess4awvcOs6JQ4tWr07dCroaXPTlahCcBRZdLUK
+uRcGvIDc/3L5vTMwpMK8ghIARrbzf3cYXSpl7eOT4wJWAuPXcrk1PE1YuMidPa2v
+3OshgH2no6BeVW2vChBDnK9IBstWII/AhjQzDHjbj9S8xjLZA6bqHH89uXc+0Z/2
+hF8lLDsruEceLVckmk7wb1eFAvns/XA=
+-----END PRIVATE KEY-----
diff --git a/test/fixtures/keys/rsa_private_encrypted.pem b/test/fixtures/keys/rsa_private_encrypted.pem
index f1914289ec4f..6a605a055551 100644
--- a/test/fixtures/keys/rsa_private_encrypted.pem
+++ b/test/fixtures/keys/rsa_private_encrypted.pem
@@ -1,30 +1,30 @@
------BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: AES-256-CBC,DB3D20E60E8FDC3356BD79712FF8EF7E
-
-K+vu0U3IFTJBBi6zW5Zng80O1jXq/ZmlOFs/j/SQpPwfW1Do9i/Dwa7ntBlTwrCm
-sd3IIPgu2ikfLwxvbxsZN540oCaCqaZ/bmmyzH3MyVDA9MllUu+X8+Q3ATzcYa9R
-U5XfF5DAXsSRnstCbmKagWVQpO0oX8k3ratfny6Ixq86Y82tK8+o5YiBFq1kqa+9
-4yat7IWQbqV5ifUtUPCHZwEqBt+WKazX05BqERjkckHdpfaDrBvSSPXTwoLm6uRR
-ktkUVpO4tHMZ4VlcTfFtpz8gdYYod0nM6vz26hvbESHSwztSgMhmKdsE5eqmYfgu
-F4WkEN4bqAiPjKK3jnUKPt/vg2oKYFQlVYFl9QnBjiRqcQTi3e9lwn1hI7uoMb6g
-HuaCc57JJHPN/ZLP3ts4ZxFbwUjTGioh5Zh6WozG3L3+Ujwq/sDrAskRyzdcuP7I
-Rs3oLbHY03OHyg8IbxR5Iu89l6FLqnR45yvbxXtZ7ImGOPM5Z9pB1CzDhGDx2F6g
-J/Kf/7ZF2DmYUVbVKDfESEDhRfuMAVzhasDPTRqipSA5QvJVQY+J/6QDPrNNmHVB
-4e4ouHIDWERUf0t1Be7THvP3X8OJozj2HApzqa5ZCaJDo8eaL8TCD5uH75ID5URJ
-VscGHaUXT8/sxfHi1x8BibW5W5J/akFsnrnJU/1BZgGznIxjf5tKfHGppSIVdlKP
-3ghYNmEIFPNJ6cxuUA0D2IOV4uO3FTCU6seIzvJhYkmXnticcZYGtmGxXKrodtzS
-J1YuaNkkO/YRZah285lQ6QCIhCFo4Oa4ILjgoTQISuw7nQj5ESyncauzLUBXKX0c
-XDUej64KNTvVF9UXdG48fYvNmSZWCnTye4UmPu17FmwpVra38U+EdoLyWyMIAI5t
-rP6Hhgc9BxOo41Im9QpTcAPfKAknP8Rbm3ACJG5T9FKq/c29d1E//eFR6SL51e/a
-yWdCgJN/FJOAX60+erPwoVoRFEttAeDPkklgFGdc8F4LIYAig9gEZ92ykFFz3fWz
-jIcUVLrL+IokFbPVUBoMihqVyMQsWH+5Qq9wjxf6EDIf0BVtm9U4BJoOkPStFIfF
-Kof7OVv7izyL8R/GIil9VQs9ftwkIUPeXx2Hw0bE3HJ3C8K4+mbLg3tKhGnBDU5Z
-Xm5mLHoCRBa3ZRFWZtigX7POszdLAzftYo8o65Be4OtPS+tQAORk9gHsXATv7dDB
-OGw61x5KA55LHVHhWaRvu3J8E7nhxw0q/HskyZhDC+Y+Xs6vmQSb4nO4ET4NYX1P
-m3PMdgGoqRDJ2jZw4eoQdRKCM0EHSepSAYpO1tcAXhPZS4ITogoRgPpVgOebEQUL
-nKNeNu/BxMSH/IH15jjDLF3TiEoguF9xdTaCxIBzE1SFpVO0u9m9vXpWdPThVgsb
-VcEI487p7v9iImP3BYPT8ZYvytC26EH0hyOrwhahTvTb4vXghkLIyvPUg1lZHc6e
-aPHb2AzYAHLnp/ehDQGKWrCOJ1JE2vBv8ZkLa+XZo7YASXBRZitPOMlvykEyzxmR
-QAmNhKGvFmeM2mmHAp0aC03rgF3lxNsXQ1CyfEdq3UV9ReSnttq8gtrJfCwxV+wY
------END RSA PRIVATE KEY-----
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQ2cq1Ok3DMP2A/RoK
+n3/9ZgICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEGRKDlxB0C8WgbEc
+enhkuocEggTQQK9exbwIpgV5QRoHDMACpXuWtsZgdpCanhtA53pP8tELYc4MzbIp
+90dLQWxqi/mSlqr1ifoMnCFEAKVUV8mDoh0i5uvQhxOC6TB0HBGgb7dEgITIC7NT
+PTeHNepQyW97SkTMKoTnOogxgWeAHKYsSALHJw+45q4qARE7vo1O8CHE6v6Liv4F
+ZaW/8p2O4qUTRWGshUG6tC4/YN6r/iYtoSXUzOTiTeLckhV/9QsP5pGF3LQXIU9I
+5xh+I1BdcSZ/7sGiHED0BB4yF2lOUKKUwCNFUTddhApewYm/yCW8wTYB7vvOI8mz
+47V8rfPj40Qzislrc5Sm96XpQp8DrLV4KKkA8F1MPEchHgOcdq+1UKCRW2kfUOWS
+T9wSXPHlmuKxHsrXk3pBGdnshbp2d5d4uwVhi9bPA7J2DN25ayIe9H8LbYfPo58C
+CiCnjLG02nKYSLjFZR8K/z2j+xmGyXVcHuGZzR02O3G4G89VlxxfazxYbZZvSNbM
+w6/TjbSDmvOYLRxRRdbZRWixgyn4QRmg5QmWBbqsS1YmVOG3HafHdAtS2B++DRF3
+S5Waaa/mrqzMesl+TLYJ759gHOqODoppm1iwmVzcBuoDLYNUI0AZZ/pEGs3oGk4M
+faNiVMcsFkMWPSzgTv/viWJgJeQdWIos75nyTUgDJiFmxMT6HcWZxEFBM5IMqoZJ
+JXfFGIwPo5pjw8kFHh/4Mj3qCuQ1jxrnRFdC3EhSy+JCQf0S4XTYws4GBZ4psRTX
+KOb+VqizDL+0A9d88QIQX3BWfCZ6QhFHd4JdLhZt1myjsLu50NaraHBb/9pEcBUb
+/hIKTxQCgXZMw1XaJeXRtbObYeB1JjPZYfuaxwvYIQ1CrPVHcCEZYH/GlQ2ppqCf
+RIZY6Tp522nQ7l7uOhhJozkXZsbI5/MzaYQguz+dRAWBckQTAgStRJ2UeCP215CN
+cSY/nSeIssjov+Rs2twi/AFglET7f0Osg2YXjEl6zRde80D7/74a/YASw/qGP/+q
+nxwVmMpcLCfvfvb7JN0YofU5TLbOYt3lneydIe8aZhR15HlamnnZS8cs+2FeiFu2
+I4tH+7FAiB/HuYSTJSKWvTbZX100aCDqsyYW0UF4mrNgcIdjjrmWAJL2thcX5JmW
++PTTbDKGtsnGm5QUqtYHQTWelHNeWXwxveAWReG3d7v5vx+ioY1xWKkEzrRjGtNJ
+nmNvFBSjlz28fxhlJ6XV3DO2N3VvPwiXLYKE99idl2mtX0WWSCcnsYEKWRSccxe7
+quwxYxWa1l4t07OUCbMCsTz4weBMc/7DK/xUSKETp/C8IR6o/F8iK49KjpIQFnjQ
+abJy1RSNxRRawqDdLqZiLjAZydBq7lJ4R3LTqEdw4zQGpFdGa/YAshkCPsIGCj3q
+8ONcd4TQC4qd+tBhvJiyuuwvt+an5n9Axlo93NJweTTVDgR3FLsJL2FGV0FWa9o0
+aiUYdlL1fkAPOvVT97OLjmM/9RBirSUGR+Dwr6O3tRaB1bDmpKUqTz190Lhd3Ee/
+zWOJa6ubhUjls1KY4Rm/f28VheNRp6PQn+QdIdht/1oEqlssv/yPeVe1U6tW2oDW
+ksbE0O1JvbUhKKhTD3cFY6x5A7iRflJpSEEoPqbHu8X237gEtgqJcKI=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/test/fixtures/openssl3-conf/default_properties.cnf b/test/fixtures/openssl3-conf/default_properties.cnf
new file mode 100644
index 000000000000..bb26de636b2c
--- /dev/null
+++ b/test/fixtures/openssl3-conf/default_properties.cnf
@@ -0,0 +1,19 @@
+nodejs_conf = nodejs_init
+
+[nodejs_init]
+providers = provider_sect
+alg_section = algorithm_sect
+
+# Load both providers but select only implementations from the default provider.
+[provider_sect]
+default = default_sect
+legacy = legacy_sect
+
+[default_sect]
+activate = 1
+
+[legacy_sect]
+activate = 1
+
+[algorithm_sect]
+default_properties = provider=default
diff --git a/test/fixtures/qrde-r-oracle.R b/test/fixtures/qrde-r-oracle.R
new file mode 100644
index 000000000000..2e563546cbcc
--- /dev/null
+++ b/test/fixtures/qrde-r-oracle.R
@@ -0,0 +1,133 @@
+# Regenerate qrde-r-oracle.json with:
+# Rscript test/fixtures/qrde-r-oracle.R > test/fixtures/qrde-r-oracle.json
+
+beta_front <- function(x, a, b) {
+  result <- numeric(length(x))
+  interior <- x > 0 & x < 1
+  result[interior] <- x[interior] * (1 - x[interior]) *
+    dbeta(x[interior], a, b)
+  result
+}
+
+bucket_ranges <- function(values, resolutions, counts, mode) {
+  lower <- upper <- values
+  spread <- counts > 1 &
+    (mode == "all" | (mode == "hdr" & resolutions > 1))
+  half <- resolutions / 2
+  lower[spread] <- values[spread] - half[spread]
+  upper[spread] <- values[spread] + half[spread]
+  if (length(values) > 1) {
+    if (spread[1]) lower[1] <- values[1]
+    if (spread[length(values)]) upper[length(values)] <- values[length(values)]
+  }
+  list(lower = lower, upper = upper, spread = spread)
+}
+
+hd_quantile <- function(values, resolutions, counts, p, mode) {
+  n <- sum(counts)
+  a <- (n + 1) * p
+  b <- (n + 1) * (1 - p)
+  u1 <- cumsum(counts) / n
+  u0 <- c(0, head(u1, -1))
+  threshold <- (a + 1) / (a + b + 2)
+  lower <- u1 <= threshold
+  upper <- u0 >= threshold
+  crossing <- !(lower | upper)
+  mass <- numeric(length(values))
+  mass[lower] <- pbeta(u1[lower], a, b) - pbeta(u0[lower], a, b)
+  mass[upper] <- pbeta(1 - u0[upper], b, a) -
+    pbeta(1 - u1[upper], b, a)
+  mass[crossing] <- 1 - pbeta(u0[crossing], a, b) -
+    pbeta(1 - u1[crossing], b, a)
+
+  ranges <- bucket_ranges(values, resolutions, counts, mode)
+  if (!any(ranges$spread)) return(sum(values * mass))
+
+  front0 <- beta_front(u0, a, b)
+  front1 <- beta_front(u1, a, b)
+  local <- (p - u0) * mass - (front1 - front0) / (a + b)
+  rank_width <- counts / n
+  local <- pmax(0, pmin(rank_width * mass, local))
+  sum(ifelse(ranges$spread,
+             ranges$lower * mass +
+               (ranges$upper - ranges$lower) * local / rank_width,
+             values * mass))
+}
+
+make_case <- function(name, values, resolutions, counts, bins, mode, indices) {
+  ranges <- bucket_ranges(values, resolutions, counts, mode)
+  expected <- vapply(indices, function(index) {
+    if (index == 0) return(ranges$lower[1])
+    if (index == bins) return(tail(ranges$upper, 1))
+    hd_quantile(values, resolutions, counts, index / bins, mode)
+  }, numeric(1))
+  list(name = name, indices = indices, expected = expected)
+}
+
+make_probability_case <- function(name, values, resolutions, counts,
+                                  probabilities, mode) {
+  ranges <- bucket_ranges(values, resolutions, counts, mode)
+  expected <- vapply(probabilities, function(probability) {
+    if (probability == 0) return(ranges$lower[1])
+    if (probability == 1) return(tail(ranges$upper, 1))
+    hd_quantile(values, resolutions, counts, probability, mode)
+  }, numeric(1))
+  list(name = name, probabilities = probabilities, expected = expected)
+}
+
+cases <- list(
+  make_case("small-none", c(1, 2, 4, 16, 100), rep(1, 5),
+            c(1, 2, 5, 3, 1), 10, "none", 0:10),
+  make_case("small-all", c(1, 2, 4, 16, 100), rep(1, 5),
+            c(1, 2, 5, 3, 1), 10, "all", 0:10),
+  make_case("exact-support", 1:1024, rep(1, 1024), rep(1, 1024),
+            100, "none", c(1, 2, 10, 25, 50, 75, 90, 98, 99)),
+  make_probability_case("tail-focused", 1:1024, rep(1, 1024), rep(1, 1024),
+                        c(0, 0.5, 0.9, 0.99, 0.999, 0.9999, 1), "none"),
+  make_case("approximation-threshold", c(1, 131071), c(1, 1),
+            c(26239, 973761), 1000, "none",
+            c(1, 10, 24, 25, 26, 27, 50, 500, 950, 973, 974, 975, 976,
+              990, 999)),
+  make_case("multimodal-none", c(1, 10, 100, 1000), rep(1, 4),
+            c(900000, 90000, 9000, 1000), 100, "none",
+            c(1, 10, 25, 50, 75, 89, 90, 91, 98, 99)),
+  make_case("multimodal-all", c(1, 10, 100, 1000), rep(1, 4),
+            c(900000, 90000, 9000, 1000), 100, "all",
+            c(1, 10, 25, 50, 75, 89, 90, 91, 98, 99)),
+  make_case("wide-none",
+            c(1049088, 1100048498688, 4505798650626048, 9005000231485440),
+            c(1024, 1073741824, 4398046511104, 4398046511104),
+            c(700000, 200000, 99999, 1), 1000, "none",
+            c(1, 100, 500, 699, 700, 701, 899, 900, 901, 990, 999)),
+  make_case("wide-hdr",
+            c(1049088, 1100048498688, 4505798650626048, 9005000231485440),
+            c(1024, 1073741824, 4398046511104, 4398046511104),
+            c(700000, 200000, 99999, 1), 1000, "hdr",
+            c(1, 100, 500, 699, 700, 701, 899, 900, 901, 990, 999)),
+  make_case("huge-count", c(1, 1000), c(1, 1),
+            c(2^50, 2 * 2^50), 3, "none", c(1, 2))
+)
+
+number_array <- function(values) {
+  paste0("[", paste(sprintf("%.17g", values), collapse = ", "), "]")
+}
+
+cat("{\n")
+cat(sprintf("  \"rVersion\": \"%s\",\n", getRversion()))
+cat("  \"implementation\": \"stats::pbeta/stats::dbeta\",\n")
+cat("  \"generator\": \"test/fixtures/qrde-r-oracle.R\",\n")
+cat("  \"cases\": {\n")
+for (i in seq_along(cases)) {
+  case <- cases[[i]]
+  cat(sprintf("    \"%s\": {\n", case$name))
+  if (is.null(case$indices)) {
+    cat(sprintf("      \"probabilities\": %s,\n",
+                number_array(case$probabilities)))
+  } else {
+    cat(sprintf("      \"indices\": %s,\n", number_array(case$indices)))
+  }
+  cat(sprintf("      \"quantiles\": %s\n", number_array(case$expected)))
+  cat(sprintf("    }%s\n", if (i == length(cases)) "" else ","))
+}
+cat("  }\n")
+cat("}\n")
diff --git a/test/fixtures/qrde-r-oracle.json b/test/fixtures/qrde-r-oracle.json
new file mode 100644
index 000000000000..699470815bf2
--- /dev/null
+++ b/test/fixtures/qrde-r-oracle.json
@@ -0,0 +1,47 @@
+{
+  "rVersion": "4.3.3",
+  "implementation": "stats::pbeta/stats::dbeta",
+  "generator": "test/fixtures/qrde-r-oracle.R",
+  "cases": {
+    "small-none": {
+      "indices": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10],
+      "quantiles": [1, 1.5965008927561191, 2.4535177038411491, 3.2717431130126258, 4.0354421521907682, 5.2952901873257829, 7.993414878390019, 12.95756351062192, 25.2075453528239, 59.34721654185303, 100]
+    },
+    "small-all": {
+      "indices": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10],
+      "quantiles": [1, 1.5164508130154255, 2.3591698112327482, 3.1776385959166684, 3.9790848992171997, 5.3180579814394306, 8.051827450668231, 13.007946863612533, 25.296537882899184, 59.450958793096312, 100]
+    },
+    "exact-support": {
+      "indices": [1, 2, 10, 25, 50, 75, 90, 98, 99],
+      "quantiles": [10.740000001653616, 20.979999999999997, 102.90000000000001, 256.5, 512.5, 768.5, 922.09999999999991, 1004.02, 1014.2599999983464]
+    },
+    "tail-focused": {
+      "probabilities": [0, 0.5, 0.90000000000000002, 0.98999999999999999, 0.999, 0.99990000000000001, 1],
+      "quantiles": [1, 512.5, 922.09999999999991, 1014.2599999983464, 1023.3985498813823, 1023.9671500705408, 1024]
+    },
+    "approximation-threshold": {
+      "indices": [1, 10, 24, 25, 26, 27, 50, 500, 950, 973, 974, 975, 976, 990, 999],
+      "quantiles": [1, 1, 1, 1.0000000003635539, 8767.6505315696159, 131070.85769690933, 131071, 131071, 131071, 131071, 131071, 131071, 131071, 131071, 131071]
+    },
+    "multimodal-none": {
+      "indices": [1, 10, 25, 50, 75, 89, 90, 91, 98, 99],
+      "quantiles": [1, 1, 1, 1, 1, 1, 5.5031915372522544, 10, 10, 55.117879933163145]
+    },
+    "multimodal-all": {
+      "indices": [1, 10, 25, 50, 75, 89, 90, 91, 98, 99],
+      "quantiles": [1.0055555555555555, 1.0555555555555556, 1.1388888888888888, 1.2777777777777777, 1.4166666666666665, 1.4944444444444445, 5.5041002375271573, 9.6111111111111107, 10.388888888888889, 55.120539546632884]
+    },
+    "wide-none": {
+      "indices": [1, 100, 500, 699, 700, 701, 899, 900, 901, 990, 999],
+      "quantiles": [1049088, 1049088, 1049088, 16044533331.731945, 550152461987.60876, 1084084847693.1234, 3073520372530.2637, 2255046784384464.5, 4503906146402988, 4505798650626048, 4505798650626048]
+    },
+    "wide-hdr": {
+      "indices": [1, 100, 500, 699, 700, 701, 899, 900, 901, 990, 999],
+      "quantiles": [1049088.7314285715, 1049161.142857143, 1049453.7142857143, 16036716594.329391, 549884945967.66187, 1083561149070.3787, 3073089774188.3379, 2253952024297723, 4501752029575391.5, 4507557908813304, 4507953736957585]
+    },
+    "huge-count": {
+      "indices": [1, 2],
+      "quantiles": [500.49999838367461, 1000]
+    }
+  }
+}
diff --git a/test/fixtures/snapshot/crypto-provider-cache.js b/test/fixtures/snapshot/crypto-provider-cache.js
new file mode 100644
index 000000000000..8596693f40a5
--- /dev/null
+++ b/test/fixtures/snapshot/crypto-provider-cache.js
@@ -0,0 +1,125 @@
+'use strict';
+
+const assert = require('node:assert');
+const {
+  createHash,
+  createCipheriv,
+  createMac,
+  getCipherInfo,
+  getCiphers,
+  getCurves,
+  getHashes,
+  getMacs,
+  setFips,
+} = require('node:crypto');
+const { setDeserializeMainFunction } = require('node:v8').startupSnapshot;
+
+const cipher = 'aes-128-cbc-cts';
+const key = Buffer.alloc(16);
+const iv = Buffer.alloc(16);
+const legacyCipher = 'blowfish';
+const legacyHash = 'md4';
+const mac = 'poly1305';
+const macKey = Buffer.from(
+  '85d6be7857556d337f4452fe42d506a8' +
+  '0103808afb0db2fd4abff6af4149f51b',
+  'hex',
+);
+const macData = Buffer.from('Cryptographic Forum Research Group');
+const macExpected = 'a8061dc1305136c6c22b8baf0c0127a9';
+
+setFips(0);
+const hasMac = getMacs().includes(mac);
+const cases = [
+  { name: 'getCiphers', get: getCiphers, algorithm: cipher, legacy: legacyCipher },
+  { name: 'getHashes', get: getHashes, algorithm: 'md5', legacy: legacyHash },
+  { name: 'getMacs', get: getMacs, algorithm: hasMac ? mac : undefined },
+  { name: 'getCurves', get: getCurves, algorithm: 'secp256k1' },
+];
+
+function assertMac() {
+  if (!hasMac) return;
+  assert.strictEqual(
+    createMac(mac, macKey).update(macData).final('hex'),
+    macExpected,
+  );
+}
+
+function assertHash() {
+  assert.strictEqual(
+    createHash('md5').digest('hex'),
+    'd41d8cd98f00b204e9800998ecf8427e',
+  );
+}
+
+for (const { name, get, algorithm, legacy } of cases) {
+  const list = get();
+  if (algorithm !== undefined)
+    assert(list.includes(algorithm), `${name}: ${algorithm}`);
+  if (legacy !== undefined)
+    assert(list.includes(legacy), `${name}: ${legacy}`);
+}
+assert(getCipherInfo(cipher));
+createCipheriv(cipher, key, iv);
+createHash(legacyHash).digest();
+assertHash();
+assertMac();
+
+setDeserializeMainFunction(() => {
+  // Resolve native handles and JavaScript alias IDs before refreshing any
+  // algorithm list. Build-time caches must not survive snapshot serialization.
+  assertMac();
+  assertHash();
+  assert(getCipherInfo(cipher));
+  createCipheriv(cipher, key, iv);
+
+  const restoredLists = cases.map(({ name, get, algorithm, legacy }) => {
+    const list = get();
+    if (algorithm !== undefined)
+      assert(list.includes(algorithm), `${name}: ${algorithm}`);
+    if (legacy !== undefined)
+      assert(!list.includes(legacy), `${name}: ${legacy}`);
+
+    const disposable = get();
+    assert.notStrictEqual(disposable, list, name);
+    disposable.length = 0;
+    disposable.push('not-a-real-algorithm');
+    assert.deepStrictEqual(get(), list, name);
+    return list;
+  });
+  assertMac();
+  assert.throws(
+    () => createCipheriv(legacyCipher, key, Buffer.alloc(8)),
+    { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+  );
+  assert.throws(
+    () => createHash(legacyHash),
+    { code: 'ERR_OSSL_EVP_UNSUPPORTED' },
+  );
+
+  setFips(1);
+  for (const { name, get, algorithm } of cases) {
+    const list = get();
+    if (algorithm !== undefined)
+      assert(!list.includes(algorithm), `${name}: ${algorithm}`);
+  }
+  assert.strictEqual(getCipherInfo(cipher), undefined);
+  assert.throws(() => createCipheriv(cipher, key, iv), {
+    code: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+  });
+  if (hasMac) {
+    assert.throws(() => createMac(mac, macKey), {
+      code: 'ERR_CRYPTO_INVALID_MAC',
+    });
+  }
+
+  setFips(0);
+  for (const [index, { name, get }] of cases.entries()) {
+    assert.deepStrictEqual(get(), restoredLists[index], name);
+  }
+  assert(getCipherInfo(cipher));
+  createCipheriv(cipher, key, iv);
+  assertHash();
+  assertMac();
+  console.log('provider crypto caches snapshot: ok');
+});
diff --git a/test/fixtures/sqlite/backup-last-request.mjs b/test/fixtures/sqlite/backup-last-request.mjs
new file mode 100644
index 000000000000..91ad84e77ed5
--- /dev/null
+++ b/test/fixtures/sqlite/backup-last-request.mjs
@@ -0,0 +1,34 @@
+import { backup, DatabaseSync } from 'node:sqlite';
+
+const source = new DatabaseSync(':memory:');
+source.exec(`
+  CREATE TABLE data(value);
+  INSERT INTO data VALUES (zeroblob(1048576));
+`);
+
+let keepAlive = setInterval(() => {}, 1_000);
+let settled = false;
+
+process.once('beforeExit', () => {
+  if (!settled) {
+    process.stderr.write('backup promise did not settle before the event loop became idle\n');
+    process.exit(1);
+  }
+});
+
+backup(source, process.argv[2], {
+  rate: 1,
+  progress() {
+    if (keepAlive !== undefined) {
+      clearInterval(keepAlive);
+      keepAlive = undefined;
+    }
+  },
+}).then(() => {
+  settled = true;
+  source.close();
+}, (error) => {
+  settled = true;
+  process.stderr.write(`${error.stack ?? error}\n`);
+  process.exitCode = 1;
+});
diff --git a/test/fixtures/test-nodetiming-uvmetricsinfo.js b/test/fixtures/test-nodetiming-uvmetricsinfo.js
index 59b1cc8ebf11..038ca8b79904 100644
--- a/test/fixtures/test-nodetiming-uvmetricsinfo.js
+++ b/test/fixtures/test-nodetiming-uvmetricsinfo.js
@@ -40,7 +40,15 @@ function safeMetricsInfo(cb) {
     fs.open(__filename, 'r', (err) => {
       assert.ifError(err);
     });
+
+    const saved = { ...info };
+    safeMetricsInfo((nextInfo) => {
+      assert.notStrictEqual(nextInfo, info);
+      assert.ok(nextInfo.loopCount > saved.loopCount);
+      // Updating the shared buffer must not change earlier results.
+      assert.deepStrictEqual(info, saved);
+    });
   }
 
   safeMetricsInfo(openFile);
-}
\ No newline at end of file
+}
diff --git a/test/fixtures/test-runner/execution-ordered-bypass/slow.mjs b/test/fixtures/test-runner/execution-ordered-bypass/slow.mjs
index 4ee60ffe8537..21f6f2b68676 100644
--- a/test/fixtures/test-runner/execution-ordered-bypass/slow.mjs
+++ b/test/fixtures/test-runner/execution-ordered-bypass/slow.mjs
@@ -1,9 +1,11 @@
 import { test } from 'node:test';
-import { setTimeout as sleep } from 'node:timers/promises';
+import { once } from 'node:events';
+import { connect } from 'node:net';
 
 test('slow', async () => {
-  // Long enough that fast-fail's process can spawn, run, and round-trip its
-  // bypassed test:complete to the host on slow CI, but short enough that the
-  // test does not waste much time when the bypass is working.
-  await sleep(30_000);
+  // The host closes this connection after receiving fast-fail's bypassed
+  // test:complete event, so this test cannot finish before that event arrives.
+  const socket = connect(Number(process.argv[2]), '127.0.0.1');
+  socket.resume();
+  await once(socket, 'end');
 });
diff --git a/test/fixtures/test-runner/output/junit_quote.js b/test/fixtures/test-runner/output/junit_quote.js
new file mode 100644
index 000000000000..4f77d9ffbb0e
--- /dev/null
+++ b/test/fixtures/test-runner/output/junit_quote.js
@@ -0,0 +1,9 @@
+// Flags: --test --test-reporter=junit
+'use strict';
+const test = require('node:test');
+
+test('quote"only', () => {});
+test('quote&quot;only', () => {});
+test('amp&and"quote"', () => {});
+test('lt<and"quote', () => {});
+test('line\n"break', () => {});
diff --git a/test/fixtures/test-runner/output/junit_quote.snapshot b/test/fixtures/test-runner/output/junit_quote.snapshot
new file mode 100644
index 000000000000..48d3ac2c53c2
--- /dev/null
+++ b/test/fixtures/test-runner/output/junit_quote.snapshot
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<testsuites>
+	<testcase name="quote&quot;only" time="*" classname="test" file="*"/>
+	<testcase name="quote&amp;quot;only" time="*" classname="test" file="*"/>
+	<testcase name="amp&amp;and&quot;quote&quot;" time="*" classname="test" file="*"/>
+	<testcase name="lt&lt;and&quot;quote" time="*" classname="test" file="*"/>
+	<testcase name="line&#10;&quot;break" time="*" classname="test" file="*"/>
+	<!-- tests 5 -->
+	<!-- suites 0 -->
+	<!-- pass 5 -->
+	<!-- fail 0 -->
+	<!-- cancelled 0 -->
+	<!-- skipped 0 -->
+	<!-- todo 0 -->
+	<!-- duration_ms * -->
+</testsuites>
diff --git a/test/fixtures/wasi-preview-1.js b/test/fixtures/wasi-preview-1.js
index 535bc3e5ec18..3fde5a30b759 100644
--- a/test/fixtures/wasi-preview-1.js
+++ b/test/fixtures/wasi-preview-1.js
@@ -68,6 +68,9 @@ assert.strictEqual(wasiPreview1.wasiImport,
       const name = `pthread-${tid}`;
       const sab = new SharedArrayBuffer(8 + 8192);
       const result = new Int32Array(sab);
+      // The thread stores 0 once it has loaded or 1 with an error; wait on a
+      // value neither of them writes so an early notify cannot be missed.
+      Atomics.store(result, 0, -1);
 
       const workerData = {
         name,
@@ -106,7 +109,7 @@ assert.strictEqual(wasiPreview1.wasiImport,
         throw new Error(e);
       });
 
-      const r = Atomics.wait(result, 0, 0, 1000);
+      const r = Atomics.wait(result, 0, -1, common.platformTimeout(30_000));
       if (r === 'timed-out') {
         workers[tid].terminate();
         delete workers[tid];
diff --git a/test/fixtures/webcrypto/supports-level-2.mjs b/test/fixtures/webcrypto/supports-level-2.mjs
index 674e4cf8c6de..b07ce9097bb7 100644
--- a/test/fixtures/webcrypto/supports-level-2.mjs
+++ b/test/fixtures/webcrypto/supports-level-2.mjs
@@ -1,4 +1,7 @@
+import { getFips } from 'node:crypto';
+
 const { subtle } = globalThis.crypto;
+const RSA_MINIMUM_MODULUS_LENGTH = getFips() === 1 ? 2048 : 512;
 
 const RSA_KEY_GEN = {
   modulusLength: 2048,
@@ -10,8 +13,6 @@ const [ECDH, X25519] = await Promise.all([
   subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']),
 ]);
 
-const boringSSL = process.features.openssl_is_boringssl;
-
 export const vectors = {
   'encrypt': [
     [false, 'Invalid'],
@@ -66,6 +67,30 @@ export const vectors = {
     [true, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256', ...RSA_KEY_GEN }],
     [true, { name: 'RSA-PSS', hash: 'SHA-256', ...RSA_KEY_GEN }],
     [true, { name: 'RSA-OAEP', hash: 'SHA-256', ...RSA_KEY_GEN }],
+    [true, {
+      name: 'RSA-PSS',
+      hash: 'SHA-256',
+      modulusLength: RSA_MINIMUM_MODULUS_LENGTH,
+      publicExponent: new Uint8Array([1, 0, 1]),
+    }],
+    [false, {
+      name: 'RSASSA-PKCS1-v1_5',
+      hash: 'SHA-256',
+      modulusLength: RSA_MINIMUM_MODULUS_LENGTH - 1,
+      publicExponent: new Uint8Array([1, 0, 1]),
+    }],
+    [false, {
+      name: 'RSA-PSS',
+      hash: 'SHA-256',
+      ...RSA_KEY_GEN,
+      publicExponent: new Uint8Array([2]),
+    }],
+    [false, {
+      name: 'RSA-OAEP',
+      hash: 'SHA-256',
+      ...RSA_KEY_GEN,
+      publicExponent: new Uint8Array([1, 0, 0, 0, 1]),
+    }],
     [true, { name: 'ECDSA', namedCurve: 'P-256' }],
     [false, { name: 'ECDSA', namedCurve: 'X25519' }],
     [true, { name: 'AES-CTR', length: 128 }],
@@ -97,6 +122,9 @@ export const vectors = {
     [true,
      { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 },
      { name: 'HMAC', hash: 'SHA-256' }],
+    [false,
+     { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 2 ** 31 },
+     { name: 'AES-CBC', length: 128 }],
     [false,
      { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 },
      'HKDF'],
@@ -146,6 +174,8 @@ export const vectors = {
   'deriveBits': [
     [true, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 8],
     [true, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 0],
+    [true, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 65280],
+    [false, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 65288],
     [false, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, null],
     [false, { name: 'HKDF', hash: 'SHA-256', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 7],
     [false, { name: 'HKDF', hash: 'Invalid', salt: Buffer.alloc(0), info: Buffer.alloc(0) }, 8],
@@ -154,6 +184,7 @@ export const vectors = {
     [true, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, 8],
     [true, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, 0],
     [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 0 }, 8],
+    [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 2 ** 31 }, 8],
     [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, null],
     [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, 7],
     [false, { name: 'PBKDF2', hash: 'Invalid', salt: Buffer.alloc(0), iterations: 1 }, 8],
@@ -234,4 +265,7 @@ export const vectors = {
   'get key length': [
     [false, { name: 'HMAC', hash: 'SHA-256' }],
   ],
+  'get shared key length': [
+    [false, 'ML-KEM-768'],
+  ],
 };
diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
index acb0e249dd38..67fad15f7f39 100644
--- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs
+++ b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
@@ -1,14 +1,16 @@
 import * as crypto from 'node:crypto'
 
-import { hasOpenSSL } from '../../common/crypto.js'
+import { hasOpenSSL, isBoringSSL } from '../../common/crypto.js'
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 const pqc = hasOpenSSL(3, 5) || boringSSL;
 const argon2 = hasOpenSSL(3, 2);
 const shake128 = crypto.getHashes().includes('shake128');
 const shake256 = crypto.getHashes().includes('shake256');
+const sha3 = crypto.getHashes().includes('sha3-256');
 const ocb = hasOpenSSL(3);
 const kmac = hasOpenSSL(3);
+const hybridKems = pqc && (!boringSSL || (sha3 && shake256));
 
 const { subtle } = globalThis.crypto;
 const X25519 = await subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']);
@@ -70,6 +72,12 @@ export const vectors = {
     [pqc, { name: 'ML-DSA-44', context: Buffer.alloc(32) }],
     [pqc, { name: 'ML-DSA-65', context: Buffer.alloc(32) }],
     [pqc, { name: 'ML-DSA-87', context: Buffer.alloc(32) }],
+    [pqc, { name: 'ML-DSA-44', context: Buffer.alloc(255) }],
+    [pqc, { name: 'ML-DSA-65', context: Buffer.alloc(255) }],
+    [pqc, { name: 'ML-DSA-87', context: Buffer.alloc(255) }],
+    [false, { name: 'ML-DSA-44', context: Buffer.alloc(256) }],
+    [false, { name: 'ML-DSA-65', context: Buffer.alloc(256) }],
+    [false, { name: 'ML-DSA-87', context: Buffer.alloc(256) }],
     [false, 'Argon2d'],
     [false, 'Argon2i'],
     [false, 'Argon2id'],
@@ -88,6 +96,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, { name: 'AES-OCB', length: 128 }],
     [false, 'Argon2d'],
     [false, 'Argon2i'],
@@ -109,6 +120,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, { name: 'AES-OCB', length: 128 }],
     [argon2, 'Argon2d'],
     [argon2, 'Argon2i'],
@@ -130,6 +144,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, 'AES-OCB'],
     [false, 'Argon2d'],
     [false, 'Argon2i'],
@@ -153,6 +170,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [false, 'AES-CTR'],
     [false, 'AES-CBC'],
     [false, 'AES-GCM'],
@@ -212,6 +232,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
   ],
   'encapsulateKey': [
     [pqc && !boringSSL, 'ML-KEM-512', 'AES-KW'],
@@ -225,14 +248,25 @@ export const vectors = {
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256' }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 256 }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 255 }],
+    [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 249 }],
     [pqc && kmac, 'ML-KEM-768', { name: 'KMAC128', length: 255 }],
+    [hybridKems, 'MLKEM768-P256', 'HKDF'],
+    [hybridKems, 'MLKEM768-X25519', 'HKDF'],
+    [hybridKems, 'MLKEM1024-P384', 'HKDF'],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 128 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 248 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 512 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 257 }],
     [false, 'ML-KEM-768', { name: 'KMAC128', length: 248 }],
+    [false, 'ML-KEM-768', 'Ed25519'],
   ],
   'decapsulateBits': [
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
   ],
   'decapsulateKey': [
     [pqc && !boringSSL, 'ML-KEM-512', 'AES-KW'],
@@ -246,8 +280,16 @@ export const vectors = {
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256' }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 256 }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 255 }],
+    [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 249 }],
     [pqc && kmac, 'ML-KEM-768', { name: 'KMAC128', length: 255 }],
+    [hybridKems, 'MLKEM768-P256', 'HKDF'],
+    [hybridKems, 'MLKEM768-X25519', 'HKDF'],
+    [hybridKems, 'MLKEM1024-P384', 'HKDF'],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 128 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 248 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 512 }],
+    [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 257 }],
     [false, 'ML-KEM-768', { name: 'KMAC128', length: 248 }],
+    [false, 'ML-KEM-768', 'Ed25519'],
   ],
 };
diff --git a/test/fixtures/webcrypto/supports-secure-curves.mjs b/test/fixtures/webcrypto/supports-secure-curves.mjs
index 56bb89c28afa..fa3f1d365213 100644
--- a/test/fixtures/webcrypto/supports-secure-curves.mjs
+++ b/test/fixtures/webcrypto/supports-secure-curves.mjs
@@ -1,10 +1,10 @@
-import { hasOpenSSL } from '../../common/crypto.js'
+import { hasOpenSSL, isBoringSSL } from '../../common/crypto.js'
 
 const supportsContext = hasOpenSSL(3, 2);
 
 const { subtle } = globalThis.crypto;
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 
 const X25519 = await subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']);
 let X448;
@@ -19,6 +19,8 @@ export const vectors = {
     [!boringSSL, 'Ed448'],
     [!boringSSL, { name: 'Ed448', context: Buffer.alloc(0) }],
     [!boringSSL && supportsContext, { name: 'Ed448', context: Buffer.alloc(32) }],
+    [!boringSSL && supportsContext, { name: 'Ed448', context: Buffer.alloc(255) }],
+    [false, { name: 'Ed448', context: Buffer.alloc(256) }],
   ],
   'generateKey': [
     [!boringSSL, 'X448'],
diff --git a/test/fixtures/webcrypto/supports-sha3.mjs b/test/fixtures/webcrypto/supports-sha3.mjs
index 73f5b778eeb9..fe256dcfb168 100644
--- a/test/fixtures/webcrypto/supports-sha3.mjs
+++ b/test/fixtures/webcrypto/supports-sha3.mjs
@@ -1,6 +1,8 @@
+import { isBoringSSL } from '../../common/crypto.js'
+
 const { subtle } = globalThis.crypto;
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 
 const RSA_KEY_GEN = {
   modulusLength: 2048,
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js
index 16c9ec6407bb..ce2010771aac 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derive.js
@@ -102,7 +102,7 @@ function registerDeriveTests(options) {
         failureTest(
             test.name,
             "InvalidAccessError",
-            () => derive(algorithmName, test.key, privateKey)
+            () => derive(algorithmName, test.key, privateKey, test.length)
         );
     });
 
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length.js
index 5a7ed7eb50a0..39b4ddce7fa8 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length.js
@@ -17,16 +17,16 @@ function define_tests() {
                         derivedBits = await subtle.deriveBits(testData.deriveAlg, privateKey);
                     else
                         derivedBits = await subtle.deriveBits(testData.deriveAlg, privateKey, testParam.length);
-                    if (testParam.expected === undefined) {
-                        assert_unreached("deriveBits should have thrown an OperationError exception.");
+                    if (testParam.expected === "TypeError" || testParam.expected === "OperationError") {
+                        assert_unreached("deriveBits should have thrown an " + testParam.expected + " exception.");
                     }
                     assert_array_equals(new Uint8Array(derivedBits), testParam.expected, "Derived bits do not match the expected result.");
                 } catch (err) {
-                    if (err instanceof AssertionError || testParam.expected !== undefined) {
+                    if (err instanceof AssertionError || !(testParam.expected === "TypeError" || testParam.expected === "OperationError")) {
                         throw err;
                     }
                     assert_true(privateKey !== undefined, "Key should be valid.");
-                    assert_equals(err.name, "OperationError", "deriveBits correctly threw OperationError: " + err.message);
+                    assert_equals(err.name, testParam.expected, "deriveBits correctly threw " + testParam.expected + ": " + err.message);
                 }
             }, algorithm + " derivation with " + testParam.length + " as 'length' parameter");
         });
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length_testcases.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length_testcases.js
index 2679fa79e2a0..e368ac86697a 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length_testcases.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/derived_bits_length_testcases.js
@@ -1,38 +1,49 @@
+var enforceRangeTestCases = [
+    // These cases should throw an error in all algorithms due to [EnforceRange]
+    {length: NaN, expected: "TypeError"},
+    {length: Infinity, expected: "TypeError"},
+    {length: -8, expected: "TypeError"},
+    {length: 2**32 + 8, expected: "TypeError"},
+];
 var testCases = {
     "HKDF": [
         {length: 256, expected: algorithms["HKDF"].derivation},
         {length: 384, expected: algorithms["HKDF"].derivation384},
-        {length: 230, expected: undefined}, // should throw an exception, not multiple of 8
+        {length: 230, expected: "OperationError"}, // should throw an exception, not multiple of 8
         {length: 0, expected: emptyArray},
-        {length: null, expected: undefined }, // should throw an exception
-        {length: undefined, expected: undefined }, // should throw an exception
-        {length: "omitted", expected: undefined }, // default value is null, so should throw
+        {length: null, expected: "OperationError"}, // should throw an exception
+        {length: undefined, expected: "OperationError"}, // should throw an exception
+        {length: "omitted", expected: "OperationError"}, // default value is null, so should throw
+        ...enforceRangeTestCases,
     ],
     "PBKDF2": [
         {length: 256, expected: algorithms["PBKDF2"].derivation},
         {length: 384, expected: algorithms["PBKDF2"].derivation384},
-        {length: 230, expected: undefined}, // should throw an exception, not multiple of 8
+        {length: 230, expected: "OperationError"}, // should throw an exception, not multiple of 8
         {length: 0, expected: emptyArray},
-        {length: null, expected: undefined }, // should throw an exception
-        {length: undefined, expected: undefined }, // should throw an exception
-        {length: "omitted", expected: undefined }, // default value is null, so should throw
+        {length: null, expected: "OperationError"}, // should throw an exception
+        {length: undefined, expected: "OperationError"}, // should throw an exception
+        {length: "omitted", expected: "OperationError"}, // default value is null, so should throw
+        ...enforceRangeTestCases,
     ],
     "ECDH": [
         {length: 256, expected: algorithms["ECDH"].derivation},
-        {length: 384, expected: undefined}, // should throw an exception, bigger than the output size
+        {length: 384, expected: "OperationError"}, // should throw an exception, bigger than the output size
         {length: 230, expected: algorithms["ECDH"].derivation230},
         {length: 0, expected: emptyArray},
         {length: null, expected: algorithms["ECDH"].derivation},
         {length: undefined, expected: algorithms["ECDH"].derivation},
-        {length: "omitted", expected: algorithms["ECDH"].derivation }, // default value is null
+        {length: "omitted", expected: algorithms["ECDH"].derivation}, // default value is null
+        ...enforceRangeTestCases,
     ],
     "X25519": [
         {length: 256, expected: algorithms["X25519"].derivation},
-        {length: 384, expected: undefined}, // should throw an exception, bigger than the output size
+        {length: 384, expected: "OperationError"}, // should throw an exception, bigger than the output size
         {length: 230, expected: algorithms["X25519"].derivation230},
         {length: 0, expected: emptyArray},
         {length: null, expected: algorithms["X25519"].derivation},
         {length: undefined, expected: algorithms["X25519"].derivation},
-        {length: "omitted", expected: algorithms["X25519"].derivation }, // default value is null
+        {length: "omitted", expected: algorithms["X25519"].derivation}, // default value is null
+        ...enforceRangeTestCases,
     ],
 }
diff --git a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js
index 99039f250c2c..cfb5b8701115 100644
--- a/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js
+++ b/test/fixtures/wpt/WebCryptoAPI/derive_bits_keys/ecdh.js
@@ -66,6 +66,7 @@ async function defineEcdhTests(operation) {
                 {
                     name: namedCurve + " mismatched curves",
                     key: keys[otherCurve].publicKey,
+                    length: 256,
                 },
                 {
                     name: namedCurve +
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
index e4a75c065152..8aa47b66d1a6 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures.js
@@ -101,13 +101,19 @@ function run_test(algorithmNames) {
 
         if (algorithmName.toUpperCase().substring(0, 3) === "AES") {
             // Specifier properties are name and length
-            [64, 127, 129, 255, 257, 512].forEach(function(length) {
+            [64, 127, 129, 255, 257, 512, 128 + 2**32, 128 - 2**32].forEach(function(length) {
                 results.push({name: algorithmName, length: length});
             });
+        } else if (algorithmName.toUpperCase() === "HMAC") {
+            [128 + 2**32, 128 - 2**32].forEach(function(length) {
+                results.push({name: algorithmName, hash: "SHA-256", length: length});
+            });
         } else if (algorithmName.toUpperCase().substring(0, 3) === "RSA") {
             [new Uint8Array([1]), new Uint8Array([1,0,0])].forEach(function(publicExponent) {
                 results.push({name: algorithmName, hash: "SHA-256", modulusLength: 1024, publicExponent: publicExponent});
             });
+            results.push({name: algorithmName, hash: "SHA-256", modulusLength: 1024 + 2 ** 32, publicExponent: new Uint8Array([1,0,1])});
+            results.push({name: algorithmName, hash: "SHA-256", modulusLength: 1024 - 2 ** 32, publicExponent: new Uint8Array([1,0,1])});
         } else if (algorithmName.toUpperCase().substring(0, 2) === "EC") {
             ["P-512", "Curve25519"].forEach(function(curveName) {
                 results.push({name: algorithmName, namedCurve: curveName});
@@ -177,6 +183,9 @@ function run_test(algorithmNames) {
                 [false, true].forEach(function(extractable) {
                     if (name.substring(0,2) === "EC") {
                         testError(algorithm, extractable, usages, "NotSupportedError", "Bad algorithm property");
+                    } else if (name.substring(0,3) === "RSA" && (algorithm.modulusLength < 0 || algorithm.modulusLength > 2**32) ||
+                        (name.substring(0,3) === "AES" || name === "HMAC") && (algorithm.length < 0 || algorithm.length > 2**32)) {
+                        testError(algorithm, extractable, usages, "TypeError", "Bad algorithm property");
                     } else {
                         testError(algorithm, extractable, usages, "OperationError", "Bad algorithm property");
                     }
diff --git a/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
index 97cf9dff48ae..a8f730e9bfc4 100644
--- a/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
@@ -65,6 +65,70 @@ testSupportsMethod();
 // Test standard WebCrypto algorithms for requested operations
 runSupportsTests(modernAlgorithms, operations);
 
+['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87'].forEach(name => {
+  ['sign', 'verify'].forEach(operation => {
+    test(() => {
+      assert_true(
+        SubtleCrypto.supports(operation, {
+          name,
+          context: new Uint8Array(255),
+        }),
+        `${name} ${operation} supports a 255-byte context`
+      );
+      assert_false(
+        SubtleCrypto.supports(operation, {
+          name,
+          context: new Uint8Array(256),
+        }),
+        `${name} ${operation} rejects a 256-byte context`
+      );
+    }, `supports validates ${name} ${operation} context length`);
+  });
+});
+
+const mlKemImportedKeyCases = [
+  {
+    description: 'a matching HMAC length',
+    additionalAlgorithm: {name: 'HMAC', hash: 'SHA-256', length: 256},
+    expected: true,
+  },
+  {
+    description: 'an algorithm without raw-secret import',
+    additionalAlgorithm: 'Ed25519',
+    expected: false,
+  },
+  {
+    description: 'an HMAC length shorter than the shared secret',
+    additionalAlgorithm: {name: 'HMAC', hash: 'SHA-256', length: 128},
+    expected: false,
+  },
+  {
+    description: 'an HMAC length longer than the shared secret',
+    additionalAlgorithm: {name: 'HMAC', hash: 'SHA-256', length: 512},
+    expected: false,
+  },
+];
+
+['encapsulateKey', 'decapsulateKey'].forEach(operation => {
+  mlKemImportedKeyCases.forEach(({
+    description,
+    additionalAlgorithm,
+    expected,
+  }) => {
+    test(() => {
+      assert_equals(
+        SubtleCrypto.supports(
+          operation,
+          'ML-KEM-768',
+          additionalAlgorithm
+        ),
+        expected,
+        `ML-KEM-768 ${operation} with ${description}`
+      );
+    }, `supports ${operation} with ${description}`);
+  });
+});
+
 // Test some algorithm objects with valid parameters
 test(() => {
   assert_true(
diff --git a/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js
index fcccbecd6916..294c961a7f02 100644
--- a/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/supports.tentative.https.any.js
@@ -49,13 +49,10 @@ const standardAlgorithms = {
     operations: ['generateKey', 'importKey', 'deriveBits', 'getPublicKey'],
     keyGenParams: { name: 'ECDH', namedCurve: 'P-256' },
     importParams: { name: 'ECDH', namedCurve: 'P-256' },
-    deriveBitsParams: {
-      name: 'ECDH',
-      public: crypto.subtle.generateKey(
-        { name: 'ECDH', namedCurve: 'P-256' },
-        false,
-        ['deriveBits']
-      ),
+    deriveBitsParamsFactory: async () => {
+      const {publicKey} = await crypto.subtle.generateKey(
+        {name: 'ECDH', namedCurve: 'P-256'}, false, ['deriveBits']);
+      return {name: 'ECDH', public: publicKey};
     },
   },
   Ed25519: {
@@ -66,9 +63,10 @@ const standardAlgorithms = {
   X25519: {
     operations: ['generateKey', 'importKey', 'deriveBits', 'getPublicKey'],
     keyGenParams: null,
-    deriveBitsParams: {
-      name: 'X25519',
-      public: crypto.subtle.generateKey('X25519', false, ['deriveBits']),
+    deriveBitsParamsFactory: async () => {
+      const {publicKey} = await crypto.subtle.generateKey(
+        'X25519', false, ['deriveBits']);
+      return {name: 'X25519', public: publicKey};
     },
   },
 
@@ -247,6 +245,13 @@ test(() => {
         tagLength: 100,
       }),
       'Invalid tag length for AES-GCM should return false');
+  assert_false(
+      SubtleCrypto.supports('decrypt', {
+        name: 'AES-GCM',
+        iv: new Uint8Array(16),
+        tagLength: 100,
+      }),
+      'Invalid tag length for AES-GCM should return false');
   assert_false(
       SubtleCrypto.supports('generateKey', {name: 'ECDH', namedCurve: 'P-51'}),
       'Invalid curve for ECDH should return false');
@@ -348,6 +353,214 @@ test(() => {
 
 }, 'supports returns false for algorithm objects with invalid parameters');
 
+[
+  ['SHA-1', 160],
+  ['SHA-256', 256],
+  ['SHA-384', 384],
+  ['SHA-512', 512],
+].forEach(([hash, hashLength]) => {
+  test(() => {
+    const algorithm = {
+      name: 'HKDF',
+      hash,
+      salt: new Uint8Array(),
+      info: new Uint8Array(),
+    };
+    const maximumLength = 255 * hashLength;
+
+    assert_true(
+      SubtleCrypto.supports('deriveBits', algorithm, maximumLength),
+      `HKDF with ${hash} supports its maximum output length`
+    );
+    assert_false(
+      SubtleCrypto.supports('deriveBits', algorithm, maximumLength + 8),
+      `HKDF with ${hash} rejects output longer than its maximum`
+    );
+  }, `supports validates HKDF ${hash} output length`);
+});
+
+test(() => {
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveKey',
+      {
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: new Uint8Array(),
+        info: new Uint8Array(),
+      },
+      {name: 'HMAC', hash: 'SHA-256', length: 65288}
+    ),
+    'HKDF rejects a derived key longer than 255 hash blocks'
+  );
+}, 'supports validates HKDF output length for deriveKey');
+
+test(() => {
+  assert_false(
+    SubtleCrypto.supports('importKey', {
+      name: 'HMAC',
+      hash: 'SHA-256',
+      length: 0,
+    }),
+    'HMAC rejects an explicitly zero-length imported key'
+  );
+}, 'supports validates HMAC import length');
+
+const invalidRsaKeyGenParameters = [
+  {
+    description: 'a modulus shorter than 4 bits',
+    modulusLength: 3,
+    publicExponent: Uint8Array.of(3),
+  },
+  {
+    description: 'a public exponent less than 3',
+    modulusLength: 2048,
+    publicExponent: Uint8Array.of(1),
+  },
+  {
+    description: 'an even public exponent',
+    modulusLength: 2048,
+    publicExponent: Uint8Array.of(4),
+  },
+  {
+    description: 'a public exponent equal to 2^modulusLength - 1',
+    modulusLength: 2048,
+    publicExponent: new Uint8Array(256).fill(0xff),
+  },
+];
+
+[
+  'RSASSA-PKCS1-v1_5',
+  'RSA-PSS',
+  'RSA-OAEP',
+].forEach(name => {
+  invalidRsaKeyGenParameters.forEach(({description, ...parameters}) => {
+    test(() => {
+      assert_false(
+        SubtleCrypto.supports('generateKey', {
+          name,
+          ...parameters,
+          hash: 'SHA-256',
+        }),
+        `${name} rejects ${description}`
+      );
+    }, `supports rejects ${name} generateKey with ${description}`);
+  });
+});
+
+['ECDSA', 'ECDH'].forEach(name => {
+  test(() => {
+    assert_false(
+      SubtleCrypto.supports('importKey', {
+        name,
+        namedCurve: 'not-a-curve',
+      }),
+      `${name} rejects an unknown named curve`
+    );
+  }, `supports validates ${name} import namedCurve`);
+});
+
+[
+  ['P-256', 256],
+  ['P-384', 384],
+  ['P-521', 528],
+].forEach(([namedCurve, maximumLength]) => {
+  promise_test(async () => {
+    const {publicKey} = await crypto.subtle.generateKey(
+      {name: 'ECDH', namedCurve}, false, ['deriveBits']);
+    const algorithm = {name: 'ECDH', public: publicKey};
+
+    assert_true(
+      SubtleCrypto.supports('deriveBits', algorithm, maximumLength),
+      `ECDH ${namedCurve} supports its maximum output length`
+    );
+    assert_false(
+      SubtleCrypto.supports('deriveBits', algorithm, maximumLength + 1),
+      `ECDH ${namedCurve} rejects output longer than its maximum`
+    );
+  }, `supports validates ECDH ${namedCurve} deriveBits length`);
+});
+
+promise_test(async () => {
+  const {publicKey} = await crypto.subtle.generateKey(
+    'X25519', false, ['deriveBits']);
+  const algorithm = {name: 'X25519', public: publicKey};
+
+  assert_true(
+    SubtleCrypto.supports('deriveBits', algorithm, 256),
+    'X25519 supports its maximum output length'
+  );
+  assert_false(
+    SubtleCrypto.supports('deriveBits', algorithm, 257),
+    'X25519 rejects output longer than its maximum'
+  );
+}, 'supports validates X25519 deriveBits length');
+
+promise_test(async () => {
+  const [ecdhKeyPair, x25519KeyPair] = await Promise.all([
+    crypto.subtle.generateKey(
+      {name: 'ECDH', namedCurve: 'P-256'}, false, ['deriveBits']),
+    crypto.subtle.generateKey('X25519', false, ['deriveBits']),
+  ]);
+
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveBits', {name: 'ECDH', public: ecdhKeyPair.privateKey}, 256),
+    'ECDH rejects a private public property'
+  );
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveBits', {name: 'ECDH', public: x25519KeyPair.publicKey}, 256),
+    'ECDH rejects a public property for another algorithm'
+  );
+}, 'supports validates the ECDH public key');
+
+promise_test(async () => {
+  const [x25519KeyPair, ecdhKeyPair] = await Promise.all([
+    crypto.subtle.generateKey('X25519', false, ['deriveBits']),
+    crypto.subtle.generateKey(
+      {name: 'ECDH', namedCurve: 'P-256'}, false, ['deriveBits']),
+  ]);
+
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveBits', {name: 'X25519', public: x25519KeyPair.privateKey}, 256),
+    'X25519 rejects a private public property'
+  );
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveBits', {name: 'X25519', public: ecdhKeyPair.publicKey}, 256),
+    'X25519 rejects a public property for another algorithm'
+  );
+}, 'supports validates the X25519 public key');
+
+promise_test(async () => {
+  const [p256KeyPair, p521KeyPair] = await Promise.all([
+    crypto.subtle.generateKey(
+      {name: 'ECDH', namedCurve: 'P-256'}, false, ['deriveBits']),
+    crypto.subtle.generateKey(
+      {name: 'ECDH', namedCurve: 'P-521'}, false, ['deriveBits']),
+  ]);
+  const derivedKeyAlgorithm = {name: 'HMAC', hash: 'SHA-256'};
+
+  assert_false(
+    SubtleCrypto.supports(
+      'deriveKey',
+      {name: 'ECDH', public: p256KeyPair.publicKey},
+      derivedKeyAlgorithm
+    ),
+    'ECDH P-256 cannot derive a 512-bit HMAC key'
+  );
+  assert_true(
+    SubtleCrypto.supports(
+      'deriveKey',
+      {name: 'ECDH', public: p521KeyPair.publicKey},
+      derivedKeyAlgorithm
+    ),
+    'ECDH P-521 can derive a 512-bit HMAC key'
+  );
+}, 'supports derives the ECDH output limit from the public curve');
+
 // Test some specific combinations that should work
 test(() => {
   // RSA algorithms
diff --git a/test/fixtures/wpt/WebCryptoAPI/util/supports.js b/test/fixtures/wpt/WebCryptoAPI/util/supports.js
index 18442424f4a2..d41e38e96f94 100644
--- a/test/fixtures/wpt/WebCryptoAPI/util/supports.js
+++ b/test/fixtures/wpt/WebCryptoAPI/util/supports.js
@@ -33,10 +33,9 @@ function runSupportsTests(algorithms, operations) {
             algorithm = algorithmInfo.encryptParams || algorithmName;
             break;
           case 'deriveBits':
-            algorithm = algorithmInfo.deriveBitsParams || algorithmName;
-            if (algorithm?.public instanceof Promise) {
-              algorithm.public = (await algorithm.public).publicKey;
-            }
+            algorithm = algorithmInfo.deriveBitsParamsFactory ?
+              await algorithmInfo.deriveBitsParamsFactory() :
+              algorithmInfo.deriveBitsParams || algorithmName;
             if (algorithmName === 'PBKDF2' || algorithmName === 'HKDF') {
               lengthOrAdditionalAlgorithm = 256;
             }
diff --git a/test/fixtures/wpt/interfaces/FileAPI.idl b/test/fixtures/wpt/interfaces/FileAPI.idl
index 49219fce277f..4a711a684459 100644
--- a/test/fixtures/wpt/interfaces/FileAPI.idl
+++ b/test/fixtures/wpt/interfaces/FileAPI.idl
@@ -20,6 +20,7 @@ interface Blob {
   [NewObject] ReadableStream stream();
   [NewObject] Promise<USVString> text();
   [NewObject] Promise<ArrayBuffer> arrayBuffer();
+  [NewObject] ReadableStream textStream();
   [NewObject] Promise<Uint8Array> bytes();
 };
 
diff --git a/test/fixtures/wpt/interfaces/compression.idl b/test/fixtures/wpt/interfaces/compression.idl
index defe4ba55cdf..6e44b4ad6dd9 100644
--- a/test/fixtures/wpt/interfaces/compression.idl
+++ b/test/fixtures/wpt/interfaces/compression.idl
@@ -4,6 +4,7 @@
 // Source: Compression Standard (https://compression.spec.whatwg.org/)
 
 enum CompressionFormat {
+  "brotli",
   "deflate",
   "deflate-raw",
   "gzip",
diff --git a/test/fixtures/wpt/interfaces/dom.idl b/test/fixtures/wpt/interfaces/dom.idl
index 1ddc084b949d..f61580f43a90 100644
--- a/test/fixtures/wpt/interfaces/dom.idl
+++ b/test/fixtures/wpt/interfaces/dom.idl
@@ -328,7 +328,7 @@ interface DOMImplementation {
   [NewObject] XMLDocument createDocument(DOMString? namespace, [LegacyNullToEmptyString] DOMString qualifiedName, optional DocumentType? doctype = null);
   [NewObject] Document createHTMLDocument(optional DOMString title);
 
-  boolean hasFeature(); // useless; always returns true
+  boolean hasFeature(); // historical; always returns true
 };
 
 [Exposed=Window]
@@ -347,9 +347,9 @@ interface DocumentFragment : Node {
 interface ShadowRoot : DocumentFragment {
   readonly attribute ShadowRootMode mode;
   readonly attribute boolean delegatesFocus;
+  readonly attribute boolean serializable;
   readonly attribute SlotAssignmentMode slotAssignment;
   readonly attribute boolean clonable;
-  readonly attribute boolean serializable;
   readonly attribute Element host;
 
   attribute EventHandler onslotchange;
@@ -409,9 +409,9 @@ interface Element : Node {
 dictionary ShadowRootInit {
   required ShadowRootMode mode;
   boolean delegatesFocus = false;
+  boolean serializable = false;
   SlotAssignmentMode slotAssignment = "named";
   boolean clonable = false;
-  boolean serializable = false;
   CustomElementRegistry? customElementRegistry;
 };
 
@@ -438,7 +438,7 @@ interface Attr : Node {
 
   readonly attribute Element? ownerElement;
 
-  readonly attribute boolean specified; // useless; always returns true
+  readonly attribute boolean specified; // historical; always returns true
 };
 [Exposed=Window]
 interface CharacterData : Node {
@@ -464,7 +464,17 @@ interface CDATASection : Text {
 };
 [Exposed=Window]
 interface ProcessingInstruction : CharacterData {
+  constructor(DOMString target, optional DOMString data = "");
+
   readonly attribute DOMString target;
+
+  boolean hasAttributes();
+  sequence<DOMString> getAttributeNames();
+  DOMString? getAttribute(DOMString name);
+  undefined setAttribute(DOMString name, DOMString value);
+  undefined removeAttribute(DOMString name);
+  boolean toggleAttribute(DOMString name, optional boolean force);
+  boolean hasAttribute(DOMString name);
 };
 [Exposed=Window]
 interface Comment : CharacterData {
diff --git a/test/fixtures/wpt/interfaces/html.idl b/test/fixtures/wpt/interfaces/html.idl
index 567e5a79a36a..e5ce24af481a 100644
--- a/test/fixtures/wpt/interfaces/html.idl
+++ b/test/fixtures/wpt/interfaces/html.idl
@@ -48,7 +48,8 @@ typedef (HTMLScriptElement or SVGScriptElement) HTMLOrSVGScriptElement;
 
 [LegacyOverrideBuiltIns]
 partial interface Document {
-  static Document parseHTMLUnsafe((TrustedHTML or DOMString) html);
+  static Document parseHTMLUnsafe((TrustedHTML or DOMString) html, optional ParseHTMLUnsafeOptions options = {});
+  static Document parseHTML(DOMString html, optional SetHTMLOptions options = {});
 
   // resource metadata management
   [PutForwards=href, LegacyUnforgeable] readonly attribute Location? location;
@@ -152,14 +153,14 @@ dictionary TogglePopoverOptions : ShowPopoverOptions {
 
 HTMLElement includes GlobalEventHandlers;
 HTMLElement includes ElementContentEditable;
-HTMLElement includes HTMLOrSVGElement;
+HTMLElement includes HTMLOrSVGOrMathMLElement;
 
 [Exposed=Window]
 interface HTMLUnknownElement : HTMLElement {
   // Note: intentionally no [HTMLConstructor]
 };
 
-interface mixin HTMLOrSVGElement {
+interface mixin HTMLOrSVGOrMathMLElement {
   [SameObject] readonly attribute DOMStringMap dataset;
   attribute DOMString nonce; // intentionally no [CEReactions]
 
@@ -349,13 +350,10 @@ interface HTMLDivElement : HTMLElement {
 interface HTMLAnchorElement : HTMLElement {
   [HTMLConstructor] constructor();
 
-  [CEReactions, Reflect] attribute DOMString target;
   [CEReactions, Reflect] attribute DOMString download;
   [CEReactions, Reflect] attribute USVString ping;
   [CEReactions, Reflect] attribute DOMString rel;
   [SameObject, PutForwards=value, Reflect="rel"] readonly attribute DOMTokenList relList;
-  [CEReactions, Reflect] attribute DOMString hreflang;
-  [CEReactions, Reflect] attribute DOMString type;
 
   [CEReactions] attribute DOMString text;
 
@@ -403,10 +401,14 @@ interface mixin HyperlinkElementUtils {
   [CEReactions] attribute USVString pathname;
   [CEReactions] attribute USVString search;
   [CEReactions] attribute USVString hash;
+
+  [CEReactions, Reflect] attribute DOMString hreflang;
+  [CEReactions, Reflect] attribute DOMString type;
 };
 
 interface mixin HTMLHyperlinkElementUtils {
   [CEReactions, ReflectSetter] stringifier attribute USVString href;
+  [CEReactions, Reflect] attribute DOMString target;
 };
 
 [Exposed=Window]
@@ -447,6 +449,7 @@ interface HTMLImageElement : HTMLElement {
   [CEReactions] attribute DOMString? crossOrigin;
   [CEReactions, Reflect] attribute DOMString useMap;
   [CEReactions, Reflect] attribute boolean isMap;
+  [CEReactions, Reflect] attribute boolean controls;
   [CEReactions, ReflectSetter] attribute unsigned long width;
   [CEReactions, ReflectSetter] attribute unsigned long height;
   readonly attribute unsigned long naturalWidth;
@@ -531,6 +534,7 @@ interface HTMLVideoElement : HTMLMediaElement {
   readonly attribute unsigned long videoHeight;
   [CEReactions, ReflectURL] attribute USVString poster;
   [CEReactions, Reflect] attribute boolean playsInline;
+
 };
 
 [Exposed=Window,
@@ -613,6 +617,7 @@ interface HTMLMediaElement : HTMLElement {
   attribute double volume;
   attribute boolean muted;
   [CEReactions, Reflect="muted"] attribute boolean defaultMuted;
+  [CEReactions] attribute DOMString loading;
 
   // tracks
   [SameObject] readonly attribute AudioTrackList audioTracks;
@@ -760,7 +765,6 @@ interface HTMLAreaElement : HTMLElement {
   [CEReactions, Reflect] attribute DOMString alt;
   [CEReactions, Reflect] attribute DOMString coords;
   [CEReactions, Reflect] attribute DOMString shape;
-  [CEReactions, Reflect] attribute DOMString target;
   [CEReactions, Reflect] attribute DOMString download;
   [CEReactions, Reflect] attribute USVString ping;
   [CEReactions, Reflect] attribute DOMString rel;
@@ -966,7 +970,7 @@ interface HTMLButtonElement : HTMLElement {
   [HTMLConstructor] constructor();
 
   [CEReactions, ReflectSetter] attribute DOMString command;
-  [CEReactions, Reflect] attribute Element? commandForElement;
+  [CEReactions, Reflect="commandfor"] attribute Element? commandForElement;
   [CEReactions, Reflect] attribute boolean disabled;
   readonly attribute HTMLFormElement? form;
   [CEReactions, ReflectSetter] attribute USVString formAction;
@@ -1271,10 +1275,12 @@ interface HTMLTemplateElement : HTMLElement {
   [HTMLConstructor] constructor();
 
   readonly attribute DocumentFragment content;
+  [CEReactions, Reflect="for"] attribute DOMString htmlFor;
   [CEReactions] attribute DOMString shadowRootMode;
   [CEReactions, Reflect] attribute boolean shadowRootDelegatesFocus;
-  [CEReactions, Reflect] attribute boolean shadowRootClonable;
   [CEReactions, Reflect] attribute boolean shadowRootSerializable;
+  [CEReactions] attribute DOMString shadowRootSlotAssignment;
+  [CEReactions, Reflect] attribute boolean shadowRootClonable;
   [CEReactions, Reflect] attribute DOMString shadowRootCustomElementRegistry;
 };
 
@@ -1808,7 +1814,7 @@ dictionary DragEventInit : MouseEventInit {
 };
 
 interface mixin PopoverTargetAttributes {
-  [CEReactions, Reflect] attribute Element? popoverTargetElement;
+  [CEReactions, Reflect="popovertarget"] attribute Element? popoverTargetElement;
   [CEReactions] attribute DOMString popoverTargetAction;
 };
 
@@ -2357,7 +2363,8 @@ Window includes WindowOrWorkerGlobalScope;
 WorkerGlobalScope includes WindowOrWorkerGlobalScope;
 
 partial interface Element {
-  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
+  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
+  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
   DOMString getHTML(optional GetHTMLOptions options = {});
 
   [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
@@ -2366,12 +2373,25 @@ partial interface Element {
 };
 
 partial interface ShadowRoot {
-  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
+  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
+  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
   DOMString getHTML(optional GetHTMLOptions options = {});
 
   [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
 };
 
+enum SanitizerPresets { "default" };
+dictionary SetHTMLOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = "default";
+};
+dictionary SetHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
+  boolean runScripts = false;
+};
+dictionary ParseHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
+};
+
 dictionary GetHTMLOptions {
   boolean serializableShadowRoots = false;
   sequence<ShadowRoot> shadowRoots = [];
@@ -2403,6 +2423,68 @@ interface XMLSerializer {
   DOMString serializeToString(Node root);
 };
 
+[Exposed=Window]
+interface Sanitizer {
+  constructor(optional (SanitizerConfig or SanitizerPresets) configuration = "default");
+
+  // Query configuration:
+  SanitizerConfig get();
+
+  // Modify a Sanitizer's lists and fields:
+  boolean allowElement(SanitizerElementWithAttributes element);
+  boolean removeElement(SanitizerElement element);
+  boolean replaceElementWithChildren(SanitizerElement element);
+  boolean allowProcessingInstruction(SanitizerPI pi);
+  boolean removeProcessingInstruction(SanitizerPI pi);
+  boolean allowAttribute(SanitizerAttribute attribute);
+  boolean removeAttribute(SanitizerAttribute attribute);
+  boolean setComments(boolean allow);
+  boolean setDataAttributes(boolean allow);
+
+  // Remove markup that executes script.
+  boolean removeUnsafe();
+};
+
+dictionary SanitizerElementNamespace {
+  required DOMString name;
+  DOMString? _namespace = "http://www.w3.org/1999/xhtml";
+};
+
+// Used by "elements"
+dictionary SanitizerElementNamespaceWithAttributes : SanitizerElementNamespace {
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+};
+
+dictionary SanitizerAttributeNamespace {
+  required DOMString name;
+  DOMString? _namespace = null;
+};
+
+dictionary SanitizerProcessingInstruction {
+  required DOMString target;
+};
+
+typedef (DOMString or SanitizerElementNamespace) SanitizerElement;
+typedef (DOMString or SanitizerElementNamespaceWithAttributes) SanitizerElementWithAttributes;
+typedef (DOMString or SanitizerProcessingInstruction) SanitizerPI;
+typedef (DOMString or SanitizerAttributeNamespace) SanitizerAttribute;
+
+dictionary SanitizerConfig {
+  sequence<SanitizerElementWithAttributes> elements;
+  sequence<SanitizerElement> removeElements;
+  sequence<SanitizerElement> replaceWithChildrenElements;
+
+  sequence<SanitizerPI> processingInstructions;
+  sequence<SanitizerPI> removeProcessingInstructions;
+
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+
+  boolean comments;
+  boolean dataAttributes;
+};
+
 [Exposed=Window]
 interface Navigator {
   // objects implementing this interface also implement the interfaces given below
diff --git a/test/fixtures/wpt/interfaces/resource-timing.idl b/test/fixtures/wpt/interfaces/resource-timing.idl
index ba8e3953b497..1391b09022e1 100644
--- a/test/fixtures/wpt/interfaces/resource-timing.idl
+++ b/test/fixtures/wpt/interfaces/resource-timing.idl
@@ -41,7 +41,8 @@ enum RenderBlockingStatusType {
     "non-blocking"
 };
 
-partial interface Performance {  undefined clearResourceTimings ();
-  undefined setResourceTimingBufferSize (unsigned long maxSize);
-  attribute EventHandler onresourcetimingbufferfull;
-};
+partial interface Performance {
+      undefined clearResourceTimings ();
+      undefined setResourceTimingBufferSize (unsigned long maxSize);
+      attribute EventHandler onresourcetimingbufferfull;
+    };
diff --git a/test/fixtures/wpt/interfaces/streams.idl b/test/fixtures/wpt/interfaces/streams.idl
index 8abc8f5cfda9..a0de8b89aa46 100644
--- a/test/fixtures/wpt/interfaces/streams.idl
+++ b/test/fixtures/wpt/interfaces/streams.idl
@@ -7,7 +7,7 @@
 interface ReadableStream {
   constructor(optional object underlyingSource, optional QueuingStrategy strategy = {});
 
-  static ReadableStream from(any asyncIterable);
+  static ReadableStream from(async_sequence<any> asyncIterable);
 
   readonly attribute boolean locked;
 
@@ -114,7 +114,7 @@ interface ReadableByteStreamController {
 
 [Exposed=*]
 interface ReadableStreamBYOBRequest {
-  readonly attribute ArrayBufferView? view;
+  readonly attribute Uint8Array? view;
 
   undefined respond([EnforceRange] unsigned long long bytesWritten);
   undefined respondWithNewView(ArrayBufferView view);
diff --git a/test/fixtures/wpt/interfaces/web-locks.idl b/test/fixtures/wpt/interfaces/web-locks.idl
index 00648cc3b1e5..d79e404b983f 100644
--- a/test/fixtures/wpt/interfaces/web-locks.idl
+++ b/test/fixtures/wpt/interfaces/web-locks.idl
@@ -10,7 +10,7 @@ interface mixin NavigatorLocks {
 Navigator includes NavigatorLocks;
 WorkerNavigator includes NavigatorLocks;
 
-[SecureContext, Exposed=(Window,Worker,SharedStorageWorklet)]
+[SecureContext, Exposed=(Window,Worker)]
 interface LockManager {
   Promise<any> request(DOMString name,
                        LockGrantedCallback callback);
@@ -43,7 +43,7 @@ dictionary LockInfo {
   DOMString clientId;
 };
 
-[SecureContext, Exposed=(Window,Worker,SharedStorageWorklet)]
+[SecureContext, Exposed=(Window,Worker)]
 interface Lock {
   readonly attribute DOMString name;
   readonly attribute LockMode mode;
diff --git a/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl b/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
index aeb1d650b7d7..00df80f74ccf 100644
--- a/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
+++ b/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
@@ -38,7 +38,7 @@ partial interface SubtleCrypto {
 
   static boolean supports(DOMString operation,
                    AlgorithmIdentifier algorithm,
-                   optional unsigned long? length = null);
+                   optional [EnforceRange] unsigned long? length = null);
   static boolean supports(DOMString operation,
                    AlgorithmIdentifier algorithm,
                    AlgorithmIdentifier additionalAlgorithm);
@@ -59,7 +59,7 @@ dictionary EncapsulatedBits {
 };
 
 partial dictionary JsonWebKey {
-  // The following fields are defined in draft-ietf-cose-dilithium-08
+  // The following fields are defined in RFC 9964
   DOMString pub;
   DOMString priv;
 };
@@ -99,7 +99,7 @@ dictionary KmacImportParams : Algorithm {
 };
 
 dictionary KmacKeyAlgorithm : KeyAlgorithm {
-  required unsigned long length;
+  required [EnforceRange] unsigned long length;
 };
 
 dictionary KmacParams : Algorithm {
diff --git a/test/fixtures/wpt/interfaces/webcrypto.idl b/test/fixtures/wpt/interfaces/webcrypto.idl
index ebb9cf5718b9..7599a1a994aa 100644
--- a/test/fixtures/wpt/interfaces/webcrypto.idl
+++ b/test/fixtures/wpt/interfaces/webcrypto.idl
@@ -79,7 +79,7 @@ interface SubtleCrypto {
   Promise<ArrayBuffer> deriveBits(
     AlgorithmIdentifier algorithm,
     CryptoKey baseKey,
-    optional unsigned long? length = null
+    optional [EnforceRange] unsigned long? length = null
   );
 
   Promise<CryptoKey> importKey(
@@ -161,7 +161,7 @@ dictionary RsaHashedKeyGenParams : RsaKeyGenParams {
 };
 
 dictionary RsaKeyAlgorithm : KeyAlgorithm {
-  required unsigned long modulusLength;
+  required [EnforceRange] unsigned long modulusLength;
   required BigInteger publicExponent;
 };
 
@@ -209,7 +209,7 @@ dictionary AesCtrParams : Algorithm {
 };
 
 dictionary AesKeyAlgorithm : KeyAlgorithm {
-  required unsigned short length;
+  required [EnforceRange] unsigned short length;
 };
 
 dictionary AesKeyGenParams : Algorithm {
@@ -237,7 +237,7 @@ dictionary HmacImportParams : Algorithm {
 
 dictionary HmacKeyAlgorithm : KeyAlgorithm {
   required KeyAlgorithm hash;
-  required unsigned long length;
+  required [EnforceRange] unsigned long length;
 };
 
 dictionary HmacKeyGenParams : Algorithm {
diff --git a/test/fixtures/wpt/streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/WEB_FEATURES.yml
index d10bbe4a7d70..54ea2128f328 100644
--- a/test/fixtures/wpt/streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/WEB_FEATURES.yml
@@ -1,5 +1,3 @@
-features:
-- name: streams
-  files:
-    # Top-level only. Subdirectories have their own mapping.
-    - "*"
+rules:
+# Top-level only. Subdirectories have their own mapping.
+- "*": [streams]
diff --git a/test/fixtures/wpt/streams/idlharness.any.js b/test/fixtures/wpt/streams/idlharness.any.js
index 0be03b2078f9..42a17da58c5a 100644
--- a/test/fixtures/wpt/streams/idlharness.any.js
+++ b/test/fixtures/wpt/streams/idlharness.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm-in-window
+// META: global=window,worker
 // META: script=/resources/WebIDLParser.js
 // META: script=/resources/idlharness.js
 // META: timeout=long
diff --git a/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml b/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml
index 8cf3517baf08..0f17f6b6b657 100644
--- a/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/piping/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: streams
-  files: "**"
+rules:
+- "**": [streams]
diff --git a/test/fixtures/wpt/streams/piping/abort.any.js b/test/fixtures/wpt/streams/piping/abort.any.js
index e813b017769c..f2e5429492e7 100644
--- a/test/fixtures/wpt/streams/piping/abort.any.js
+++ b/test/fixtures/wpt/streams/piping/abort.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js b/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js
index 25bd475ed13e..5ea47ab85c0c 100644
--- a/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js
+++ b/test/fixtures/wpt/streams/piping/close-propagation-backward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js b/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js
index 0ec94f80abf0..71b6e2628400 100644
--- a/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js
+++ b/test/fixtures/wpt/streams/piping/close-propagation-forward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js b/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js
index f786469d6c1d..ec74592f86ef 100644
--- a/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js
+++ b/test/fixtures/wpt/streams/piping/error-propagation-backward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js b/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js
index e9260f9ea22c..482da2f8a88e 100644
--- a/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js
+++ b/test/fixtures/wpt/streams/piping/error-propagation-forward.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/flow-control.any.js b/test/fixtures/wpt/streams/piping/flow-control.any.js
index e2318da375ab..09c4420f872a 100644
--- a/test/fixtures/wpt/streams/piping/flow-control.any.js
+++ b/test/fixtures/wpt/streams/piping/flow-control.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/piping/general-addition.any.js b/test/fixtures/wpt/streams/piping/general-addition.any.js
index cf4aa9bea6a1..2562b7064338 100644
--- a/test/fixtures/wpt/streams/piping/general-addition.any.js
+++ b/test/fixtures/wpt/streams/piping/general-addition.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(async t => {
diff --git a/test/fixtures/wpt/streams/piping/general.any.js b/test/fixtures/wpt/streams/piping/general.any.js
index f051d8102c2b..272b25a28e80 100644
--- a/test/fixtures/wpt/streams/piping/general.any.js
+++ b/test/fixtures/wpt/streams/piping/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/piping/multiple-propagation.any.js b/test/fixtures/wpt/streams/piping/multiple-propagation.any.js
index 9be828a23269..a78652fc0679 100644
--- a/test/fixtures/wpt/streams/piping/multiple-propagation.any.js
+++ b/test/fixtures/wpt/streams/piping/multiple-propagation.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/pipe-through.any.js b/test/fixtures/wpt/streams/piping/pipe-through.any.js
index 339cee199933..26b1cd26a3c8 100644
--- a/test/fixtures/wpt/streams/piping/pipe-through.any.js
+++ b/test/fixtures/wpt/streams/piping/pipe-through.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/piping/then-interception.any.js b/test/fixtures/wpt/streams/piping/then-interception.any.js
index fc48c3683114..543f916d940d 100644
--- a/test/fixtures/wpt/streams/piping/then-interception.any.js
+++ b/test/fixtures/wpt/streams/piping/then-interception.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/piping/throwing-options.any.js b/test/fixtures/wpt/streams/piping/throwing-options.any.js
index 186f8ded1968..b9f906778f63 100644
--- a/test/fixtures/wpt/streams/piping/throwing-options.any.js
+++ b/test/fixtures/wpt/streams/piping/throwing-options.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 class ThrowingOptions {
diff --git a/test/fixtures/wpt/streams/piping/transform-streams.any.js b/test/fixtures/wpt/streams/piping/transform-streams.any.js
index e079bb637cad..caae9fbad884 100644
--- a/test/fixtures/wpt/streams/piping/transform-streams.any.js
+++ b/test/fixtures/wpt/streams/piping/transform-streams.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(() => {
diff --git a/test/fixtures/wpt/streams/queuing-strategies.any.js b/test/fixtures/wpt/streams/queuing-strategies.any.js
index 9efc4570cf2e..fa959ebba283 100644
--- a/test/fixtures/wpt/streams/queuing-strategies.any.js
+++ b/test/fixtures/wpt/streams/queuing-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const highWaterMarkConversions = new Map([
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml
index a35508fc0dc6..e45d3ee347b3 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/readable-byte-streams/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: readable-byte-streams
-  files: "**"
+rules:
+- "**": [readable-byte-streams]
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js b/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js
index eae8dde03f6b..0f018d6d7819 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/bad-buffers-and-views.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(() => {
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js b/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js
index a26f949ee29d..8d460a1c81b7 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/construct-byob-request.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js b/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js
index 92bd0a26a0ec..d2b37f00a9d6 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/enqueue-with-detached-buffer.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 
 promise_test(async t => {
   const error = new Error('cannot proceed');
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/general.any.js b/test/fixtures/wpt/streams/readable-byte-streams/general.any.js
index 50f4f019ff22..6787ce1b474b 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/general.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js b/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js
index 4bddaef5d647..a70bb6cb23c7 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/non-transferable-buffers.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(async t => {
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js b/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js
index ce2e9e9993ae..39aa40e591ec 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/patched-global.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js b/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js
index 4010e3750ce2..a5d6ad944be5 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/read-min.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js b/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js
index e51efa061a65..b93cec97391e 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/respond-after-enqueue.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js b/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js
index 60d82b9cf6a1..2ae7e35fcb6a 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/tee.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
@@ -351,6 +351,39 @@ promise_test(async () => {
 
 }, 'ReadableStream teeing with byte source: canceling branch1 should finish when branch2 reads until end of stream');
 
+promise_test(async () => {
+
+  let controller;
+  const rs = new ReadableStream({
+    type: 'bytes',
+    start(c) {
+      controller = c;
+    }
+  });
+
+  const [branch1, branch2] = rs.tee();
+  const reader1 = branch1.getReader({ mode: 'byob' });
+  const reader2 = branch2.getReader({ mode: 'byob' });
+  const cancelPromise = reader1.cancel();
+
+  controller.enqueue(new Uint8Array([0x01]));
+
+  const read2 = await reader2.read(new Uint8Array(1));
+  assert_equals(read2.done, false, 'first read() from branch2 should not be done');
+  assert_typed_array_equals(read2.value, new Uint8Array([0x01]), 'first read() from branch2');
+
+  controller.close();
+
+  const read2b = await reader2.read(new Uint8Array(1));
+  assert_equals(read2b.done, true, 'second read() from branch2 should be done');
+
+  await Promise.all([
+    reader2.closed,
+    cancelPromise
+  ]);
+
+}, 'ReadableStream teeing with byte source: canceling branch1 should finish when branch2 reads with a BYOB reader until end of stream');
+
 promise_test(async t => {
 
   let controller;
diff --git a/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js b/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js
index e4c10f768596..8438db50e9e6 100644
--- a/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js
+++ b/test/fixtures/wpt/streams/readable-byte-streams/templated.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-test-templates.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml
index ad2cb549631f..46a402b60b27 100644
--- a/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/readable-streams/WEB_FEATURES.yml
@@ -1,14 +1,6 @@
-features:
-- name: streams
-  files:
-    - "*"
-    - "!async-iterator.any.js"
-    - "!from.any.js"
-    # 'owning' type is not yet standardized
-    - "!owning-type*"
-- name: async-iterable-streams
-  files:
-    - async-iterator.any.js
-- name: readablestream-from
-  files:
-    - from.any.js
+rules:
+- async-iterator.any.js: [async-iterable-streams]
+- from.any.js: [readablestream-from]
+# 'owning' type is not yet standardized
+- owning-type*: []
+- "*": [streams]
diff --git a/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js b/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js
index e192201b531d..d815e9d1a16b 100644
--- a/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/async-iterator.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js b/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js
index 49fa4bdbece5..409c63b8177e 100644
--- a/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/bad-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js b/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js
index 3d77b923d178..e9cf4c924930 100644
--- a/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/bad-underlying-sources.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 
diff --git a/test/fixtures/wpt/streams/readable-streams/cancel.any.js b/test/fixtures/wpt/streams/readable-streams/cancel.any.js
index d44222f1497f..8e186be586c1 100644
--- a/test/fixtures/wpt/streams/readable-streams/cancel.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/cancel.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/constructor.any.js b/test/fixtures/wpt/streams/readable-streams/constructor.any.js
index 0b995f0cb16b..608dc48cfa39 100644
--- a/test/fixtures/wpt/streams/readable-streams/constructor.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/constructor.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('error1');
diff --git a/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js b/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js
index a8c1b91d0068..02ac5bae5c2f 100644
--- a/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/count-queuing-strategy-integration.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml b/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml
index f4eaacc3edb4..fb282ca004eb 100644
--- a/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/readable-streams/crashtests/WEB_FEATURES.yml
@@ -1,7 +1,3 @@
-features:
-- name: streams
-  files:
-    - strategy-worker-terminate.html
-- name: readablestream-from
-  files:
-    - from-cross-realm.https.html
+rules:
+- strategy-worker-terminate.html: [streams]
+- from-cross-realm.https.html: [readablestream-from]
diff --git a/test/fixtures/wpt/streams/readable-streams/default-reader.any.js b/test/fixtures/wpt/streams/readable-streams/default-reader.any.js
index f92862719e47..59d7ab2f74db 100644
--- a/test/fixtures/wpt/streams/readable-streams/default-reader.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/default-reader.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js b/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js
index 8b88c21d7f0b..50cca3d951a9 100644
--- a/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/floating-point-total-queue-size.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Due to the limitations of floating-point precision, the calculation of desiredSize sometimes gives different answers
diff --git a/test/fixtures/wpt/streams/readable-streams/from.any.js b/test/fixtures/wpt/streams/readable-streams/from.any.js
index 2b28a05fee39..d8144c5f4c8a 100644
--- a/test/fixtures/wpt/streams/readable-streams/from.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/from.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
@@ -18,11 +18,6 @@ const iterableFactories = [
     return ['a', 'b'][Symbol.iterator]();
   }],
 
-  ['a string', () => {
-    // This iterates over the code points of the string.
-    return 'ab';
-  }],
-
   ['a Set', () => {
     return new Set(['a', 'b']);
   }],
@@ -81,6 +76,19 @@ const iterableFactories = [
     return iterable;
   }],
 
+  ['a sync iterable with a function iterator', () => {
+    const chunks = ['a', 'b'];
+    function functionIterator() {}
+    functionIterator.next = () => ({
+      done: chunks.length === 0,
+      value: chunks.shift()
+    });
+    const iterable = {
+      [Symbol.iterator]: () => functionIterator
+    };
+    return iterable;
+  }],
+
   ['an async iterable', () => {
     const chunks = ['a', 'b'];
     const asyncIterator = {
@@ -97,6 +105,19 @@ const iterableFactories = [
     return asyncIterable;
   }],
 
+  ['an async iterable with a function iterator', () => {
+    const chunks = ['a', 'b'];
+    function functionAsyncIterator() {}
+    functionAsyncIterator.next = () => Promise.resolve({
+      done: chunks.length === 0,
+      value: chunks.shift()
+    });
+    const asyncIterable = {
+      [Symbol.asyncIterator]: () => functionAsyncIterator
+    };
+    return asyncIterable;
+  }],
+
   ['a ReadableStream', () => {
     return new ReadableStream({
       start(c) {
@@ -144,6 +165,7 @@ const badIterables = [
   ['Object.create(null)', Object.create(null)],
   ['a function', () => 42],
   ['a symbol', Symbol()],
+  ['a string', 'ab'],
   ['an object with a non-callable @@iterator method', {
     [Symbol.iterator]: 42
   }],
diff --git a/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js b/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js
index abcb4cf21b89..907eb6006822 100644
--- a/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/garbage-collection.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=/common/gc.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/general.any.js b/test/fixtures/wpt/streams/readable-streams/general.any.js
index eee3f62215ee..2a32b27943c8 100644
--- a/test/fixtures/wpt/streams/readable-streams/general.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.any.js b/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.tentative.any.js
similarity index 97%
rename from test/fixtures/wpt/streams/readable-streams/owning-type-message-port.any.js
rename to test/fixtures/wpt/streams/readable-streams/owning-type-message-port.tentative.any.js
index 282c1f411485..e9961ce04225 100644
--- a/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/owning-type-message-port.tentative.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.any.js b/test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.tentative.any.js
similarity index 100%
rename from test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.any.js
rename to test/fixtures/wpt/streams/readable-streams/owning-type-video-frame.tentative.any.js
diff --git a/test/fixtures/wpt/streams/readable-streams/owning-type.any.js b/test/fixtures/wpt/streams/readable-streams/owning-type.tentative.any.js
similarity index 98%
rename from test/fixtures/wpt/streams/readable-streams/owning-type.any.js
rename to test/fixtures/wpt/streams/readable-streams/owning-type.tentative.any.js
index 34c2a55d5134..27a3dda894e4 100644
--- a/test/fixtures/wpt/streams/readable-streams/owning-type.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/owning-type.tentative.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/readable-streams/patched-global.any.js b/test/fixtures/wpt/streams/readable-streams/patched-global.any.js
index c208824c8644..a64a054a97f1 100644
--- a/test/fixtures/wpt/streams/readable-streams/patched-global.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/patched-global.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Tests which patch the global environment are kept separate to avoid
diff --git a/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js b/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js
index 8ae7b98e8d5e..b4988bc2433f 100644
--- a/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/reentrant-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
diff --git a/test/fixtures/wpt/streams/readable-streams/tee.any.js b/test/fixtures/wpt/streams/readable-streams/tee.any.js
index c2c2e4823072..00397932f4b6 100644
--- a/test/fixtures/wpt/streams/readable-streams/tee.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/tee.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
diff --git a/test/fixtures/wpt/streams/readable-streams/templated.any.js b/test/fixtures/wpt/streams/readable-streams/templated.any.js
index 4f2440c0880b..8fdb0176ceff 100644
--- a/test/fixtures/wpt/streams/readable-streams/templated.any.js
+++ b/test/fixtures/wpt/streams/readable-streams/templated.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-test-templates.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml b/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml
index 4ecacf5edbc7..a21859368559 100644
--- a/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/transferable/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: transferable-streams
-  files: "**"
+rules:
+- "**": [transferable-streams]
diff --git a/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js b/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js
index 05914e12ccbe..3679eb7b140a 100644
--- a/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js
+++ b/test/fixtures/wpt/streams/transferable/transform-stream-members.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 const combinations = [
   (t => [t, t.readable])(new TransformStream()),
diff --git a/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml
index f39dc16de4c7..197d23a07ffa 100644
--- a/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/transform-streams/WEB_FEATURES.yml
@@ -1,8 +1,3 @@
-features:
-- name: streams
-  files:
-    - "*"
-    - "!cancel.any.js"
-- name: transformstream-transformer-cancel
-  files:
-    - cancel.any.js
+rules:
+- cancel.any.js: [transformstream-transformer-cancel]
+- "*": [streams]
diff --git a/test/fixtures/wpt/streams/transform-streams/backpressure.any.js b/test/fixtures/wpt/streams/transform-streams/backpressure.any.js
index 47a21fb7e71f..6befba41b795 100644
--- a/test/fixtures/wpt/streams/transform-streams/backpressure.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/backpressure.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transform-streams/cancel.any.js b/test/fixtures/wpt/streams/transform-streams/cancel.any.js
index 9b369bfb7c68..fc5ef9570404 100644
--- a/test/fixtures/wpt/streams/transform-streams/cancel.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/cancel.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/transform-streams/errors.any.js b/test/fixtures/wpt/streams/transform-streams/errors.any.js
index bea060b65908..7efe894f4887 100644
--- a/test/fixtures/wpt/streams/transform-streams/errors.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/errors.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/transform-streams/flush.any.js b/test/fixtures/wpt/streams/transform-streams/flush.any.js
index c95d8ae11865..487de1c93b0f 100644
--- a/test/fixtures/wpt/streams/transform-streams/flush.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/flush.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/transform-streams/general.any.js b/test/fixtures/wpt/streams/transform-streams/general.any.js
index a40ef30843ec..dff2e7e8a70d 100644
--- a/test/fixtures/wpt/streams/transform-streams/general.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/rs-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js b/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js
index e334705db443..f9f148aaf1c6 100644
--- a/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/lipfuzz.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 class LipFuzzTransformer {
diff --git a/test/fixtures/wpt/streams/transform-streams/patched-global.any.js b/test/fixtures/wpt/streams/transform-streams/patched-global.any.js
index cc111eda452f..2d04e3b948b3 100644
--- a/test/fixtures/wpt/streams/transform-streams/patched-global.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/patched-global.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Tests which patch the global environment are kept separate to avoid
diff --git a/test/fixtures/wpt/streams/transform-streams/properties.any.js b/test/fixtures/wpt/streams/transform-streams/properties.any.js
index dbfd1aa372b9..02981b8bc76a 100644
--- a/test/fixtures/wpt/streams/transform-streams/properties.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/properties.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const transformerMethods = {
diff --git a/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js b/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js
index a6d459655856..306cce8fc8b7 100644
--- a/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/reentrant-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/rs-utils.js
 // META: script=../resources/test-utils.js
diff --git a/test/fixtures/wpt/streams/transform-streams/strategies.any.js b/test/fixtures/wpt/streams/transform-streams/strategies.any.js
index 57e113e668ce..94055ad99dc9 100644
--- a/test/fixtures/wpt/streams/transform-streams/strategies.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/transform-streams/terminate.any.js b/test/fixtures/wpt/streams/transform-streams/terminate.any.js
index a959e70fe693..670006366db2 100644
--- a/test/fixtures/wpt/streams/transform-streams/terminate.any.js
+++ b/test/fixtures/wpt/streams/transform-streams/terminate.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/recording-streams.js
 // META: script=../resources/test-utils.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml b/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml
index 8cf3517baf08..0f17f6b6b657 100644
--- a/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml
+++ b/test/fixtures/wpt/streams/writable-streams/WEB_FEATURES.yml
@@ -1,3 +1,2 @@
-features:
-- name: streams
-  files: "**"
+rules:
+- "**": [streams]
diff --git a/test/fixtures/wpt/streams/writable-streams/aborting.any.js b/test/fixtures/wpt/streams/writable-streams/aborting.any.js
index 9d8e80b1de63..58362b766901 100644
--- a/test/fixtures/wpt/streams/writable-streams/aborting.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/aborting.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js b/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js
index a1ef0791168f..63fa443065ee 100644
--- a/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/bad-strategies.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('a unique string');
diff --git a/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js b/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js
index 3c434ffe60cc..d0b3467978ea 100644
--- a/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/bad-underlying-sinks.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js b/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js
index eed86ee7004e..ce1962e8917f 100644
--- a/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/byte-length-queuing-strategy.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 promise_test(t => {
diff --git a/test/fixtures/wpt/streams/writable-streams/close.any.js b/test/fixtures/wpt/streams/writable-streams/close.any.js
index 3b2c07cc3bfe..9c1bc93b011d 100644
--- a/test/fixtures/wpt/streams/writable-streams/close.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/close.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/constructor.any.js b/test/fixtures/wpt/streams/writable-streams/constructor.any.js
index bb382a33b8e0..ba54e39cdbc5 100644
--- a/test/fixtures/wpt/streams/writable-streams/constructor.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/constructor.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('error1');
diff --git a/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js b/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js
index 8211757530d3..064e16e81506 100644
--- a/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/count-queuing-strategy.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/writable-streams/error.any.js b/test/fixtures/wpt/streams/writable-streams/error.any.js
index d08c8a54863b..faf3fdd95214 100644
--- a/test/fixtures/wpt/streams/writable-streams/error.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/error.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const error1 = new Error('error1');
diff --git a/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js b/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js
index 20a14fc19a51..bd34cc53a695 100644
--- a/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/floating-point-total-queue-size.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 // Due to the limitations of floating-point precision, the calculation of desiredSize sometimes gives different answers
diff --git a/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js b/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js
index 5e39e7c60d2c..a5d935c9aa00 100644
--- a/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/garbage-collection.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=/common/gc.js
 'use strict';
 
diff --git a/test/fixtures/wpt/streams/writable-streams/general.any.js b/test/fixtures/wpt/streams/writable-streams/general.any.js
index 48f8eeb89e41..cede7fd0845b 100644
--- a/test/fixtures/wpt/streams/writable-streams/general.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/general.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 test(() => {
diff --git a/test/fixtures/wpt/streams/writable-streams/properties.any.js b/test/fixtures/wpt/streams/writable-streams/properties.any.js
index ae0549f0871b..c95bd7d0c080 100644
--- a/test/fixtures/wpt/streams/writable-streams/properties.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/properties.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 'use strict';
 
 const sinkMethods = {
diff --git a/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js b/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js
index 18ce9e84759a..eb05cc068043 100644
--- a/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/reentrant-strategy.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/start.any.js b/test/fixtures/wpt/streams/writable-streams/start.any.js
index 17972b568ceb..82d869430dd7 100644
--- a/test/fixtures/wpt/streams/writable-streams/start.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/start.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/streams/writable-streams/write.any.js b/test/fixtures/wpt/streams/writable-streams/write.any.js
index 20a2885bf351..f0246f6cad39 100644
--- a/test/fixtures/wpt/streams/writable-streams/write.any.js
+++ b/test/fixtures/wpt/streams/writable-streams/write.any.js
@@ -1,4 +1,4 @@
-// META: global=window,worker,shadowrealm
+// META: global=window,worker
 // META: script=../resources/test-utils.js
 // META: script=../resources/recording-streams.js
 'use strict';
diff --git a/test/fixtures/wpt/url/resources/urltestdata.json b/test/fixtures/wpt/url/resources/urltestdata.json
index c4807f9e2cfc..aae7b1f65683 100644
--- a/test/fixtures/wpt/url/resources/urltestdata.json
+++ b/test/fixtures/wpt/url/resources/urltestdata.json
@@ -7581,6 +7581,18 @@
     "hash": ""
   },
   "# IPv6 tests",
+  "IPv4 pieces embedded in IPv6 addresses must not have leading zeroes",
+  {
+    "input": "https://[0:1:2:3:4:5:192.0.02.1]/",
+    "base": null,
+    "failure": true
+  },
+  "An embedded IPv4 address must end the IPv6 address",
+  {
+    "input": "https://[192.0.2.1::]/",
+    "base": null,
+    "failure": true
+  },
   {
     "input": "http://[1:0::]",
     "base": "http://example.net/",
diff --git a/test/fixtures/wpt/versions.json b/test/fixtures/wpt/versions.json
index b659c868d498..fde6838f1da4 100644
--- a/test/fixtures/wpt/versions.json
+++ b/test/fixtures/wpt/versions.json
@@ -52,7 +52,7 @@
     "path": "html/webappapis/timers"
   },
   "interfaces": {
-    "commit": "a8392bd0210378dda13278eeccf2c2602278e214",
+    "commit": "3f15e5c09448b8e917c9128d3b07cc78f044c83a",
     "path": "interfaces"
   },
   "performance-timeline": {
@@ -68,11 +68,11 @@
     "path": "resources"
   },
   "streams": {
-    "commit": "f8f26a372f357370846226ff64db1f9cc98a1edb",
+    "commit": "4832db47614f5f48cc57374cbf5c1f70937fad48",
     "path": "streams"
   },
   "url": {
-    "commit": "4832db47614f5f48cc57374cbf5c1f70937fad48",
+    "commit": "c23755a1449cc9c5a9131378c13ecf073c0885c6",
     "path": "url"
   },
   "urlpattern": {
@@ -96,11 +96,11 @@
     "path": "web-locks"
   },
   "WebCryptoAPI": {
-    "commit": "4c2fd05ed5d0b90a9e1fcdcb35f6671bd461de0d",
+    "commit": "e235e089b4e44a598f2d61e93732e0c4d9f03e04",
     "path": "WebCryptoAPI"
   },
   "webidl": {
-    "commit": "63ca529a021fec15b2996db82fd7dd04c11abe85",
+    "commit": "65bbe07908e5c19e8a6c7ff8701cc2a722cd215e",
     "path": "webidl"
   },
   "webidl/ecmascript-binding/es-exceptions": {
diff --git a/test/fixtures/wpt/webidl/META.yml b/test/fixtures/wpt/webidl/META.yml
new file mode 100644
index 000000000000..9a1192f67048
--- /dev/null
+++ b/test/fixtures/wpt/webidl/META.yml
@@ -0,0 +1,3 @@
+spec: https://webidl.spec.whatwg.org/
+suggested_reviewers:
+  - yuki3
diff --git a/test/fixtures/wpt/webidl/README.md b/test/fixtures/wpt/webidl/README.md
new file mode 100644
index 000000000000..136a7649981e
--- /dev/null
+++ b/test/fixtures/wpt/webidl/README.md
@@ -0,0 +1 @@
+Tests for the [Web IDL Standard](https://webidl.spec.whatwg.org/).
diff --git a/test/fixtures/wpt/webidl/current-realm.html b/test/fixtures/wpt/webidl/current-realm.html
new file mode 100644
index 000000000000..29e07d1f79ed
--- /dev/null
+++ b/test/fixtures/wpt/webidl/current-realm.html
@@ -0,0 +1,168 @@
+<!-- This tests the agreed upon outcome for https://www.w3.org/Bugs/Public/show_bug.cgi?id=24652
+     that has not been reflected in the IDL standard yet due to lack of editing resources.
+
+     TODO: https://github.com/w3c/webcrypto/issues/85 -->
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Current Realm</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="log"></div>
+<iframe srcdoc="<body test>"></iframe>
+<script>
+ setup({explicit_done:true})
+
+ function isObjectFromGlobal(object, global) {
+   return object instanceof global.Object;
+ }
+ function assert_global(obj) {
+   assert_false(isObjectFromGlobal(obj, self), obj + " should not be from top-level Realm")
+   assert_true(isObjectFromGlobal(obj, self[0]), obj + " should be from <iframe> Realm")
+ }
+
+ onload = function() {
+   [["querySelectorAll", "test"],
+    ["createElement", "x"],
+    ["createElementNS", null, "x"],
+    ["createDocumentFragment"],
+    ["createTextNode", "test"],
+    ["createComment", "test"],
+    ["createProcessingInstruction", "x", "x"],
+    ["createAttribute", "x"],
+    ["createAttributeNS", "x", "x"],
+    ["createEvent", "Event"],
+    ["createRange"],
+    ["createNodeIterator", document.head],
+    ["createTreeWalker", document.head]].forEach(function(val) {
+     test(function() {
+       const method = val.shift();
+       let obj = self[0].document[method](...val);
+       assert_global(obj)
+
+       obj = Document.prototype[method].call(self[0].document, ...val);
+       assert_global(obj)
+     }, val[0])
+   })
+
+   ;["Request", "Response"].forEach(val => {
+     test(() => {
+       const obj = new self[0][val]("about:blank");
+       assert_global(obj);
+
+       const cloneObj = obj.clone();
+       assert_global(cloneObj);
+
+       const involvedCloneObj = self[val].prototype["clone"].call(cloneObj);
+       assert_global(cloneObj);
+     }, val)
+   })
+
+   // Note: these are not [NewObject] and can be cached. But across globals?
+   ;[["getElementsByTagName", "x"],
+     ["getElementsByTagNameNS", null, "x"],
+     ["getElementsByClassName", "x"]].forEach(function(val) {
+     test(function() {
+       const method = val.shift();
+       const obj = self[0].document[method](...val);
+       assert_global(obj)
+
+       const obj2 = Document.prototype[method].call(self[0].document, ...val);
+       assert_global(obj)
+
+       assert_equals(obj, obj2) // XXX this might be controversial
+     }, val[0])
+   })
+
+   ;[["createDocumentType", "x", "", ""],
+     ["createDocument", null, "", null],
+     ["createHTMLDocument", "x"]].forEach(function(val) {
+     test(function() {
+       const method = val.shift();
+       let obj = self[0].document.implementation[method](...val);
+       assert_global(obj)
+
+       obj = DOMImplementation.prototype[method].call(self[0].document.implementation, ...val);
+       assert_global(obj)
+     }, val[0])
+   })
+
+   ;[["item", 0],
+     ["getNamedItem", "test"],
+     ["getNamedItemNS", null, "test"]].forEach(function(val) {
+     test(function() {
+       const method = val.shift();
+       const obj = self[0].document.body.attributes[method](...val);
+       assert_global(obj)
+
+       const obj2 = NamedNodeMap.prototype[method].call(self[0].document.body.attributes, ...val);
+       assert_global(obj)
+
+       assert_equals(obj, obj2)
+     }, "NamedNodeMap " + val[0])
+   })
+
+   test(function() {
+     var c = self[0].document.createTextNode(""),
+         obj = c.splitText(0)
+     assert_global(obj)
+
+     obj = Text.prototype.splitText.call(c, "")
+     assert_global(obj)
+   }, "splitText")
+
+   ;["extractContents",
+     "cloneContents",
+     "cloneRange"].forEach(function(val) {
+     test(function() {
+       var c = self[0].document.createRange(),
+           obj = c[val]()
+       assert_global(obj)
+
+       obj = Range.prototype[val].call(c)
+       assert_global(obj)
+     }, val)
+   })
+
+   ;["2d", "webgl"].forEach(function(val) {
+     test(function() {
+       var c = self[0].document.createElement("canvas"),
+           obj = c.getContext(val)
+
+       // WebGL might not be enabled in this environment
+       if (!obj && val === "webgl") {
+         return;
+       }
+
+       assert_global(obj)
+       obj = HTMLCanvasElement.prototype.getContext.call(c, val)
+       assert_global(obj)
+     }, "getContext " + val)
+   })
+
+   ;[["createImageData", 5, 5],
+     ["getImageData", 5, 5, 5, 5]].forEach(function(val) {
+     test(function() {
+       const method = val.shift();
+       const c = self[0].document.createElement("canvas").getContext("2d");
+       let obj = c[method](...val);
+       assert_global(obj)
+       assert_global(obj.data)
+
+       obj = CanvasRenderingContext2D.prototype[method].call(c, ...val);
+       assert_global(obj)
+       assert_global(obj.data)
+     }, val[0])
+   })
+
+   test(function() {
+     var c = new self[0].FontFace("test", "about:blank"),
+         obj = c.load()
+     assert_global(obj)
+
+     obj = FontFace.prototype.load.call(c)
+     assert_global(obj)
+   }, "FontFace's load()")
+
+   done()
+ }
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/allow-resizable.html b/test/fixtures/wpt/webidl/ecmascript-binding/allow-resizable.html
new file mode 100644
index 000000000000..54daa57bce67
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/allow-resizable.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/sab.js"></script>
+<script type="module">
+test(t => {
+  // Fixed-length ABs should not throw
+  const ab = new ArrayBuffer(16);
+  new Response(new Uint8Array(ab));
+
+  const rab = new ArrayBuffer(16, { maxByteLength: 1024 });
+  // Response doesn't have [AllowResizable] or [AllowShared]
+  assert_throws_js(TypeError, () => {
+    new Response(new Uint8Array(rab));
+  });
+}, "APIs without [AllowResizable] throw when passed resizable ArrayBuffers");
+
+test(t => {
+  const enc = new TextEncoder();
+
+  // Fixed-length SABs should not throw
+  const sab = createBuffer('SharedArrayBuffer', 16);
+  enc.encodeInto("foobar", new Uint8Array(sab));
+
+  const gsab = createBuffer('SharedArrayBuffer', 16, { maxByteLength: 1024 });
+  // TextEncoder.encodeInto doesn't have [AllowResizable] but has [AllowShared]
+  assert_throws_js(TypeError, () => {
+    enc.encodeInto("foobar", new Uint8Array(gsab));
+  });
+}, "APIs with [AllowShared] but without [AllowResizable] throw when passed growable SharedArrayBuffers");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html b/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
new file mode 100644
index 000000000000..b4cd1e37fd94
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>WebIDL [AllowShared] semantics</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#AllowShared">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/sab.js"></script>
+<script>
+  "use strict";
+
+  test(t => {
+    // Create a standard SharedArrayBuffer (safe even without COOP/COEP headers)
+    const sab = createBuffer('SharedArrayBuffer', 128);
+    const arr = new Uint8Array(sab);
+    arr.fill(42);
+    assert_equals(sab.constructor.name, 'SharedArrayBuffer');
+    new ImageDecoder({
+      data: arr,
+      // We don't really need encoding to succeed, just for argument conversion before the native call.
+      type: "invalid"
+    });
+
+    assert_throws_js(TypeError, () => {
+      new MIDIMessageEvent('message', { data: arr });
+    }, "An attempt to pass a view backed by a shared array buffer should throw");
+
+  }, "APIs without [AllowShared] do not accept SharedArrayBuffer-backed views with pre-existing wrapper");
+
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/attributes-accessors-unique-function-objects.html b/test/fixtures/wpt/webidl/ecmascript-binding/attributes-accessors-unique-function-objects.html
new file mode 100644
index 000000000000..167f55bcef7e
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/attributes-accessors-unique-function-objects.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>All attributes accessors are unique function objects</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#idl-interface-mixins">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+"use strict";
+
+test(() => {
+  const seenPrototypes = new WeakSet([Function.prototype]);
+  const seenFunctions = new WeakMap();
+
+  for (const windowKey of Object.getOwnPropertyNames(window)) {
+    const windowValue = window[windowKey];
+    if (typeof windowValue !== "function") continue;
+
+    const {prototype} = windowValue;
+    if (!prototype || seenPrototypes.has(prototype)) continue;
+    seenPrototypes.add(prototype);
+
+    for (const key of Object.getOwnPropertyNames(prototype)) {
+      const assert_not_seen = (fn, field) => {
+        const fnInfo = `${windowKey}.${key}.${field}`;
+        assert_equals(seenFunctions.get(fn), undefined, fnInfo);
+        seenFunctions.set(fn, fnInfo);
+      };
+
+      const desc = Object.getOwnPropertyDescriptor(prototype, key);
+      if (desc.get) assert_not_seen(desc.get, "[[Get]]");
+      if (desc.set) assert_not_seen(desc.set, "[[Set]]");
+    }
+  }
+}, "For attributes, each copy of the accessor property has distinct built-in function objects for its getters and setters.");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/builtin-function-properties.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/builtin-function-properties.any.js
new file mode 100644
index 000000000000..885bb441ead4
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/builtin-function-properties.any.js
@@ -0,0 +1,23 @@
+"use strict";
+
+test(() => {
+  const ownPropKeys = Reflect.ownKeys(Blob).slice(0, 3);
+  assert_array_equals(ownPropKeys, ["length", "name", "prototype"]);
+}, 'Constructor property enumeration order of "length", "name", and "prototype"');
+
+test(() => {
+  assert_own_property(Blob.prototype, "slice");
+
+  const ownPropKeys = Reflect.ownKeys(Blob.prototype.slice).slice(0, 2);
+  assert_array_equals(ownPropKeys, ["length", "name"]);
+}, 'Method property enumeration order of "length" and "name"');
+
+test(() => {
+  assert_own_property(Blob.prototype, "size");
+
+  const desc = Reflect.getOwnPropertyDescriptor(Blob.prototype, "size");
+  assert_equals(typeof desc.get, "function");
+
+  const ownPropKeys = Reflect.ownKeys(desc.get).slice(0, 2);
+  assert_array_equals(ownPropKeys, ["length", "name"]);
+}, 'Getter property enumeration order of "length" and "name"');
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/class-string-interface.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/class-string-interface.any.js
new file mode 100644
index 000000000000..ee792d536838
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/class-string-interface.any.js
@@ -0,0 +1,62 @@
+"use strict";
+
+test(() => {
+  assert_own_property(Blob.prototype, Symbol.toStringTag);
+
+  const propDesc = Object.getOwnPropertyDescriptor(Blob.prototype, Symbol.toStringTag);
+  assert_equals(propDesc.value, "Blob", "value");
+  assert_equals(propDesc.configurable, true, "configurable");
+  assert_equals(propDesc.enumerable, false, "enumerable");
+  assert_equals(propDesc.writable, false, "writable");
+}, "@@toStringTag exists on the prototype with the appropriate descriptor");
+
+test(() => {
+  assert_not_own_property(new Blob(), Symbol.toStringTag);
+}, "@@toStringTag must not exist on the instance");
+
+test(() => {
+  assert_equals(Object.prototype.toString.call(Blob.prototype), "[object Blob]");
+}, "Object.prototype.toString applied to the prototype");
+
+test(() => {
+  assert_equals(Object.prototype.toString.call(new Blob()), "[object Blob]");
+}, "Object.prototype.toString applied to an instance");
+
+test(t => {
+  assert_own_property(Blob.prototype, Symbol.toStringTag, "Precondition for this test: @@toStringTag on the prototype");
+
+  t.add_cleanup(() => {
+    Object.defineProperty(Blob.prototype, Symbol.toStringTag, { value: "Blob" });
+  });
+
+  Object.defineProperty(Blob.prototype, Symbol.toStringTag, { value: "NotABlob" });
+  assert_equals(Object.prototype.toString.call(Blob.prototype), "[object NotABlob]", "prototype");
+  assert_equals(Object.prototype.toString.call(new Blob()), "[object NotABlob]", "instance");
+}, "Object.prototype.toString applied after modifying the prototype's @@toStringTag");
+
+test(t => {
+  const instance = new Blob();
+  assert_not_own_property(instance, Symbol.toStringTag, "Precondition for this test: no @@toStringTag on the instance");
+
+  Object.defineProperty(instance, Symbol.toStringTag, { value: "NotABlob" });
+  assert_equals(Object.prototype.toString.call(instance), "[object NotABlob]");
+}, "Object.prototype.toString applied to the instance after modifying the instance's @@toStringTag");
+
+// Chrome had a bug (https://bugs.chromium.org/p/chromium/issues/detail?id=793406) where if there
+// was no @@toStringTag in the prototype, it would fall back to a magic class string. This tests
+// that the bug is fixed.
+
+test(() => {
+  const instance = new Blob();
+  Object.setPrototypeOf(instance, null);
+
+  assert_equals(Object.prototype.toString.call(instance), "[object Object]");
+}, "Object.prototype.toString applied to a null-prototype instance");
+
+// This test must be last.
+test(() => {
+  delete Blob.prototype[Symbol.toStringTag];
+
+  assert_equals(Object.prototype.toString.call(Blob.prototype), "[object Object]", "prototype");
+  assert_equals(Object.prototype.toString.call(new Blob()), "[object Object]", "instance");
+}, "Object.prototype.toString applied after deleting @@toStringTag");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/class-string-iterator-prototype-object.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/class-string-iterator-prototype-object.any.js
new file mode 100644
index 000000000000..5ca549d69cff
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/class-string-iterator-prototype-object.any.js
@@ -0,0 +1,51 @@
+"use strict";
+
+const iteratorProto = Object.getPrototypeOf((new URLSearchParams()).entries());
+
+test(() => {
+  assert_own_property(iteratorProto, Symbol.toStringTag);
+
+  const propDesc = Object.getOwnPropertyDescriptor(iteratorProto, Symbol.toStringTag);
+  assert_equals(propDesc.value, "URLSearchParams Iterator", "value");
+  assert_equals(propDesc.configurable, true, "configurable");
+  assert_equals(propDesc.enumerable, false, "enumerable");
+  assert_equals(propDesc.writable, false, "writable");
+}, "@@toStringTag exists with the appropriate descriptor");
+
+test(() => {
+  assert_equals(Object.prototype.toString.call(iteratorProto), "[object URLSearchParams Iterator]");
+}, "Object.prototype.toString");
+
+test(t => {
+  assert_own_property(iteratorProto, Symbol.toStringTag, "Precondition for this test: @@toStringTag exists");
+
+  t.add_cleanup(() => {
+    Object.defineProperty(iteratorProto, Symbol.toStringTag, { value: "URLSearchParams Iterator" });
+  });
+
+  Object.defineProperty(iteratorProto, Symbol.toStringTag, { value: "Not URLSearchParams Iterator" });
+  assert_equals(Object.prototype.toString.call(iteratorProto), "[object Not URLSearchParams Iterator]");
+}, "Object.prototype.toString applied after modifying @@toStringTag");
+
+// Chrome had a bug (https://bugs.chromium.org/p/chromium/issues/detail?id=793406) where if there
+// was no @@toStringTag, it would fall back to a magic class string. This tests that the bug is
+// fixed.
+
+test(() => {
+  const iterator = (new URLSearchParams()).keys();
+  assert_equals(Object.prototype.toString.call(iterator), "[object URLSearchParams Iterator]");
+
+  Object.setPrototypeOf(iterator, null);
+  assert_equals(Object.prototype.toString.call(iterator), "[object Object]");
+}, "Object.prototype.toString applied to a null-prototype instance");
+
+test(t => {
+  const proto = Object.getPrototypeOf(iteratorProto);
+  t.add_cleanup(() => {
+    Object.setPrototypeOf(iteratorProto, proto);
+  });
+
+  Object.setPrototypeOf(iteratorProto, null);
+
+  assert_equals(Object.prototype.toString.call(iteratorProto), "[object URLSearchParams Iterator]");
+}, "Object.prototype.toString applied after nulling the prototype");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/class-string-named-properties-object.window.js b/test/fixtures/wpt/webidl/ecmascript-binding/class-string-named-properties-object.window.js
new file mode 100644
index 000000000000..a427a2f8142e
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/class-string-named-properties-object.window.js
@@ -0,0 +1,23 @@
+"use strict";
+
+const namedPropertiesObject = Object.getPrototypeOf(Window.prototype);
+
+test(() => {
+  assert_own_property(namedPropertiesObject, Symbol.toStringTag);
+
+  const propDesc = Object.getOwnPropertyDescriptor(namedPropertiesObject, Symbol.toStringTag);
+  assert_equals(propDesc.value, "WindowProperties", "value");
+  assert_equals(propDesc.configurable, true, "configurable");
+  assert_equals(propDesc.enumerable, false, "enumerable");
+  assert_equals(propDesc.writable, false, "writable");
+}, "@@toStringTag exists with the appropriate descriptor");
+
+test(() => {
+  assert_equals(Object.prototype.toString.call(namedPropertiesObject), "[object WindowProperties]");
+}, "Object.prototype.toString");
+
+// Chrome had a bug (https://bugs.chromium.org/p/chromium/issues/detail?id=793406) where if there
+// was no @@toStringTag, it would fall back to a magic class string. Tests for this are present in
+// the sibling class-string*.any.js tests. However, the named properties object always fails calls
+// to [[DefineOwnProperty]] or [[SetPrototypeOf]] per the Web IDL spec, so there is no way to
+// trigger the buggy behavior for it.
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/constructors.html b/test/fixtures/wpt/webidl/ecmascript-binding/constructors.html
new file mode 100644
index 000000000000..61993a6200ed
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/constructors.html
@@ -0,0 +1,132 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>Realm for constructed objects</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id=log></div>
+<script>
+function object_realm(dp) {
+  // Note that browsers use the URL of the relevant global object's associated
+  // Document.
+  // https://github.com/w3c/DOM-Parsing/issues/46
+  var url = DOMParser.prototype.parseFromString.call(dp, "x", "text/html").documentURI;
+  var file = url.slice(url.lastIndexOf("/") + 1);
+  switch (file) {
+  case "constructors.html":
+    return "parent window";
+  case "constructors-support.html":
+    return "child window";
+  default:
+    return "???";
+  }
+}
+
+async_test(function() {
+  var iframe = document.createElement("iframe");
+  iframe.onload = this.step_func_done(function() {
+    var child = iframe.contentWindow;
+    test(function() {
+      var dp = new DOMParser();
+      assert_equals(Object.getPrototypeOf(dp), DOMParser.prototype);
+      assert_equals(object_realm(dp), "parent window");
+    }, "Normal constructor in parent window");
+
+    test(function() {
+      var dp = new child.DOMParser();
+      assert_equals(Object.getPrototypeOf(dp), child.DOMParser.prototype);
+      assert_equals(object_realm(dp), "child window");
+    }, "Normal constructor in child window");
+
+    test(function() {
+      var dp = Reflect.construct(child.DOMParser, [], DOMParser);
+      assert_equals(Object.getPrototypeOf(dp), DOMParser.prototype);
+      assert_equals(object_realm(dp), "child window");
+    }, "Constructor in child window with normal NewTarget from parent window");
+
+    test(function() {
+      var dp = Reflect.construct(DOMParser, [], child.DOMParser);
+      assert_equals(Object.getPrototypeOf(dp), child.DOMParser.prototype);
+      assert_equals(object_realm(dp), "parent window");
+    }, "Constructor in parent window with normal NewTarget from child window");
+
+    test(function() {
+      class DOMParserSubclass extends DOMParser {}
+      var dp = new DOMParserSubclass();
+      assert_equals(Object.getPrototypeOf(dp), DOMParserSubclass.prototype);
+      assert_equals(object_realm(dp), "parent window");
+    }, "Subclass constructor in parent window");
+
+    test(function() {
+      var dp = new child.DOMParserSubclass();
+      assert_equals(Object.getPrototypeOf(dp), child.DOMParserSubclass.prototype);
+      assert_equals(object_realm(dp), "child window");
+    }, "Subclass constructor in child window");
+
+    test(function() {
+      class ForeignDOMParserSubclass extends child.DOMParser {}
+      var dp = new ForeignDOMParserSubclass();
+      assert_equals(Object.getPrototypeOf(dp), ForeignDOMParserSubclass.prototype);
+      assert_equals(object_realm(dp), "child window");
+    }, "Subclass constructor in parent window with parent class in child window");
+
+    test(function() {
+      var dp = new child.ForeignDOMParserSubclass();
+      assert_equals(Object.getPrototypeOf(dp), child.ForeignDOMParserSubclass.prototype);
+      assert_equals(object_realm(dp), "parent window");
+    }, "Subclass constructor in child window with parent class in parent window");
+
+    test(function() {
+      var badNewTarget = function() {};
+      badNewTarget.prototype = 7;
+
+      var dp = Reflect.construct(child.DOMParser, [], badNewTarget);
+      assert_equals(Object.getPrototypeOf(dp), DOMParser.prototype);
+      assert_equals(object_realm(dp), "child window");
+    }, "Constructor in child window with bad NewTarget from parent window");
+
+    test(function() {
+      var dp = Reflect.construct(DOMParser, [], child.badNewTarget);
+      assert_equals(Object.getPrototypeOf(dp), child.DOMParser.prototype);
+      assert_equals(object_realm(dp), "parent window");
+    }, "Constructor in parent window with bad NewTarget from child window");
+
+    test(function() {
+      var badNewTarget = Function.prototype.bind.call(new child.Function());
+      badNewTarget.prototype = 7;
+
+      var dp = Reflect.construct(DOMParser, [], badNewTarget);
+      assert_equals(Object.getPrototypeOf(dp), child.DOMParser.prototype);
+      assert_equals(object_realm(dp), "parent window");
+    }, "Constructor in parent window with bad NewTarget from parent window that's a bound child window function");
+
+    test(function() {
+      var badNewTarget = child.Function.prototype.bind.call(new Function());
+      badNewTarget.prototype = 7;
+
+      var dp = Reflect.construct(child.DOMParser, [], badNewTarget);
+      assert_equals(Object.getPrototypeOf(dp), DOMParser.prototype);
+      assert_equals(object_realm(dp), "child window");
+    }, "Constructor in child window with bad NewTarget from child window that's a bound parent window function");
+
+    test(function() {
+      var badNewTarget = new Proxy(new child.Function(), {});
+      badNewTarget.prototype = 7;
+
+      var dp = Reflect.construct(DOMParser, [], badNewTarget);
+      assert_equals(Object.getPrototypeOf(dp), child.DOMParser.prototype);
+      assert_equals(object_realm(dp), "parent window");
+    }, "Constructor in parent window with bad NewTarget from parent window that's a proxy for a child window function");
+
+    test(function() {
+      var badNewTarget = new child.Proxy(new Function(), {});
+      badNewTarget.prototype = 7;
+
+      var dp = Reflect.construct(child.DOMParser, [], badNewTarget);
+      assert_equals(Object.getPrototypeOf(dp), DOMParser.prototype);
+      assert_equals(object_realm(dp), "child window");
+    }, "Constructor in child window with bad NewTarget from child window that's a proxy for a parent window function");
+  });
+  iframe.src = "support/constructors-support.html";
+  document.body.appendChild(iframe);
+});
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/default-iterator-object.html b/test/fixtures/wpt/webidl/ecmascript-binding/default-iterator-object.html
new file mode 100644
index 000000000000..c7e9188521a2
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/default-iterator-object.html
@@ -0,0 +1,27 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Default iterator objects</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const iterator1 = new URLSearchParams()[Symbol.iterator]();
+  const iterator2 = new URLSearchParams().keys();
+  const iterator3 = new URLSearchParams().values();
+  const iterator4 = new URLSearchParams().entries();
+  assert_equals(Object.getPrototypeOf(iterator1), Object.getPrototypeOf(iterator2));
+  assert_equals(Object.getPrototypeOf(iterator1), Object.getPrototypeOf(iterator3));
+  assert_equals(Object.getPrototypeOf(iterator1), Object.getPrototypeOf(iterator4));
+}, "Default iterator objects for an interface have the same prototype");
+
+test(() => {
+  const iterator = new URLSearchParams().entries();
+  assert_equals(Object.prototype.toString.call(iterator), "[object URLSearchParams Iterator]");
+}, "Object.prototype.toString returns correct value");
+
+test(() => {
+  const iterator = new URLSearchParams().entries();
+  assert_equals(iterator[Symbol.toStringTag], "URLSearchParams Iterator");
+  assert_equals(Object.getOwnPropertyDescriptor(iterator, Symbol.toStringTag), undefined);
+}, "@@toStringTag has correct value from prototype");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/default-toJSON-cross-realm.html b/test/fixtures/wpt/webidl/ecmascript-binding/default-toJSON-cross-realm.html
new file mode 100644
index 000000000000..79c3097f339b
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/default-toJSON-cross-realm.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Cross-realm [Default] toJSON() creates result object in its realm</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#default-tojson-steps">
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/create-realm.js"></script>
+
+<body>
+<script>
+promise_test(async t => {
+    const other = await createRealm(t);
+    const json = other.DOMRectReadOnly.prototype.toJSON.call(new DOMRectReadOnly());
+
+    assert_equals(Object.getPrototypeOf(json), other.Object.prototype);
+}, "Cross-realm [Default] toJSON() creates result object in its realm");
+
+promise_test(async t => {
+    const other = await createRealm(t);
+    const json = other.DOMQuad.prototype.toJSON.call(new DOMQuad());
+
+    assert_equals(Object.getPrototypeOf(json.p1), DOMPoint.prototype);
+}, "Cross-realm [Default] toJSON() converts its interface attributes to ECMAScript values of correct realm");
+</script>
+</body>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
index 9b6978783723..856d13681e60 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
index 011521652654..ca0fc84fc66a 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 test(function() {
     assert_own_property(self, "DOMException", "property of global");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
index c4ddabdafd45..10aad220b917 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
index d1c86930d4cd..467bf054c3a9 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 "use strict";
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
index 6f3097b222ed..dc39c978217b 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
new file mode 100644
index 000000000000..24f6fd486bdc
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
@@ -0,0 +1,80 @@
+// META: global=window,dedicatedworker
+
+// https://tc39.es/proposal-error-stack-accessor/
+// https://github.com/whatwg/webidl/pull/1421
+
+"use strict";
+
+test(() => {
+  const e = new DOMException("some message", "SyntaxError");
+  assert_equals(typeof e.stack, "string", "stack must be a string");
+}, "new DOMException() has a stack property that is a string");
+
+test(() => {
+  const e = new DOMException();
+  assert_equals(typeof e.stack, "string", "stack must be a string");
+}, "new DOMException() with no arguments has a stack property that is a string");
+
+if (typeof document !== "undefined") {
+  test(() => {
+    let caught;
+    try {
+      document.createElement("");
+    } catch (e) {
+      caught = e;
+    }
+    assert_true(caught instanceof DOMException, "must be a DOMException");
+    assert_equals(typeof caught.stack, "string", "stack must be a string");
+  }, "thrown DOMException from DOM API has a stack property that is a string");
+}
+
+test(() => {
+  const e = new DOMException("some message", "SyntaxError");
+  assert_false(e.hasOwnProperty("stack"), "stack must not be an own property of the instance");
+}, "DOMException instance does not have an own stack property");
+
+test(() => {
+  assert_false(DOMException.prototype.hasOwnProperty("stack"),
+    "DOMException.prototype must not have an own stack property");
+}, "DOMException.prototype does not have an own stack property");
+
+test(() => {
+  const desc = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  assert_not_equals(desc, undefined, "Error.prototype must have a stack property descriptor");
+  assert_equals(typeof desc.get, "function", "stack must have a getter");
+  assert_equals(typeof desc.set, "function", "stack must have a setter");
+  assert_false(desc.enumerable, "stack must not be enumerable");
+  assert_true(desc.configurable, "stack must be configurable");
+}, "Error.prototype.stack is an accessor property with correct attributes");
+
+test(() => {
+  const getter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").get;
+  const e = new DOMException("some message", "SyntaxError");
+  const stack = getter.call(e);
+  assert_equals(typeof stack, "string", "getter must return a string for DOMException");
+  assert_equals(stack, e.stack, "getter result must match e.stack");
+}, "Error.prototype.stack getter works on DOMException instances");
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").set;
+  const e = new DOMException("some message", "SyntaxError");
+  setter.call(e, "custom stack");
+  assert_true(e.hasOwnProperty("stack"), "after setter, stack must be an own property");
+  assert_equals(e.stack, "custom stack", "own stack property must have the set value");
+
+  const desc = Object.getOwnPropertyDescriptor(e, "stack");
+  assert_equals(desc.value, "custom stack", "must be a data property");
+  assert_true(desc.writable, "must be writable");
+  assert_true(desc.enumerable, "must be enumerable");
+  assert_true(desc.configurable, "must be configurable");
+}, "Error.prototype.stack setter installs own data property on DOMException instances");
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").set;
+  // SetterThatIgnoresPrototypeProperties should not install a property on Error.prototype itself
+  const originalStack = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  setter.call(Error.prototype, "custom stack");
+  const afterStack = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  assert_equals(typeof afterStack.get, "function",
+    "Error.prototype.stack must still be an accessor after calling setter on it");
+}, "Error.prototype.stack setter ignores Error.prototype itself");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/global-immutable-prototype.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/global-immutable-prototype.any.js
new file mode 100644
index 000000000000..6291c3ae9356
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/global-immutable-prototype.any.js
@@ -0,0 +1,25 @@
+// META: global=window,worker
+// META: title=Immutability of the global prototype chain
+
+const objects = [];
+setup(() => {
+  for (let object = self; object; object = Object.getPrototypeOf(object)) {
+    objects.push(object);
+  }
+});
+
+test(() => {
+  for (const object of objects) {
+    assert_throws_js(TypeError, () => {
+      Object.setPrototypeOf(object, {});
+    });
+  }
+}, "Setting to a different prototype");
+
+test(() => {
+  for (const object of objects) {
+    const expected = Object.getPrototypeOf(object);
+    Object.setPrototypeOf(object, expected);
+    assert_equals(Object.getPrototypeOf(object), expected);
+  }
+}, "Setting to the same prototype");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/global-object-implicit-this-value-cross-realm.html b/test/fixtures/wpt/webidl/ecmascript-binding/global-object-implicit-this-value-cross-realm.html
new file mode 100644
index 000000000000..b9939b801cbd
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/global-object-implicit-this-value-cross-realm.html
@@ -0,0 +1,97 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Cross-realm getter / setter / operation doesn't use lexical global object if |this| value is incompatible object / null / undefined</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#dfn-attribute-getter">
+<link rel="help" href="https://webidl.spec.whatwg.org/#dfn-attribute-setter">
+<link rel="help" href="https://webidl.spec.whatwg.org/#dfn-create-operation-function">
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/create-realm.js"></script>
+
+<body>
+<script>
+promise_test(async t => {
+    const other = await createRealm(t);
+    const notWindow = Object.create(Object.getPrototypeOf(other));
+
+    assert_throws_js(other.TypeError, () => { Object.create(other).window; });
+    assert_throws_js(other.TypeError, () => { Object.getOwnPropertyDescriptor(other, "history").get.call(notWindow); });
+    assert_throws_js(other.TypeError, () => { Reflect.get(other, "screen", notWindow); });
+    assert_throws_js(other.TypeError, () => { new Proxy(other, {}).onclick; });
+}, "Cross-realm global object's getter throws when called on incompatible object");
+
+promise_test(async t => {
+    const other = await createRealm(t);
+    const notWindow = Object.create(Object.getPrototypeOf(other));
+
+    assert_throws_js(other.TypeError, () => { Object.create(other).name = "dummy"; });
+    assert_throws_js(other.TypeError, () => { Object.getOwnPropertyDescriptor(other, "status").set.call(notWindow, other.status); });
+    // parent is [Replaceable]
+    assert_throws_js(other.TypeError, () => { Reflect.set(other, "parent", window, notWindow); });
+    assert_throws_js(other.TypeError, () => { new Proxy(other, {}).location = location; });
+}, "Cross-realm global object's setter throws when called on incompatible object");
+
+promise_test(async t => {
+    const other = await createRealm(t);
+    const notWindow = Object.create(Object.getPrototypeOf(other));
+
+    assert_throws_js(other.TypeError, () => { Object.create(other).focus(); });
+    assert_throws_js(other.TypeError, () => { other.clearInterval.call(notWindow, 0); });
+    assert_throws_js(other.TypeError, () => { Reflect.apply(other.blur, notWindow, []); });
+    assert_throws_js(other.TypeError, () => { new Proxy(other, {}).removeEventListener("foo", () => {}); });
+}, "Cross-realm global object's operation throws when called on incompatible object");
+
+promise_test(async t => {
+    const other = await createRealm(t);
+    const otherNameGetter = Object.getOwnPropertyDescriptor(other, "name").get;
+
+    assert_equals(Reflect.get(other, "self", null), other);
+    assert_equals(Reflect.get(other, "document", undefined), other.document);
+    assert_equals(otherNameGetter.call(null), "dummy");
+    // An engine might have different code path for calling a function from outer scope to implement step 1.b.iii of https://tc39.es/ecma262/#sec-evaluatecall
+    assert_equals((() => otherNameGetter())(), "dummy");
+}, "Cross-realm global object's getter called on null / undefined");
+
+promise_test(async t => {
+    const other = await createRealm(t);
+    const otherLocationSetter = Object.getOwnPropertyDescriptor(other, "location").set;
+    const otherHref = other.location.href;
+    const newSelf = {};
+
+    // self is [Replaceable]
+    assert_true(Reflect.set(other, "self", newSelf, null));
+    assert_true(Reflect.set(other, "name", "newName", undefined));
+
+    otherLocationSetter.call(null, `${otherHref}#foo`);
+    assert_equals(other.location.hash, "#foo");
+    // An engine might have different code path for calling a function from outer scope to implement step 1.b.iii of https://tc39.es/ecma262/#sec-evaluatecall
+    (() => { otherLocationSetter(`${otherHref}#bar`); })();
+    assert_equals(other.location.hash, "#bar");
+
+    // Check these after calling "location" setter make sure no navigation has occurred
+    assert_equals(other.self, newSelf);
+    assert_equals(other.name, "newName");
+}, "Cross-realm global object's setter called on null / undefined");
+
+promise_test(async t => {
+    const other = await createRealm(t);
+    const otherFocus = other.focus;
+    const otherDispatchEvent = other.dispatchEvent;
+
+    assert_equals(document.activeElement, document.body);
+    // An engine might have different code path for calling a function from outer scope to implement step 1.b.iii of https://tc39.es/ecma262/#sec-evaluatecall
+    (() => { otherFocus(); })();
+    assert_equals(document.activeElement.contentWindow, other);
+
+    let caughtEvent;
+    other.addEventListener.call(null, "foo", event => { caughtEvent = event; });
+    const dispatchedEvent = new other.Event("foo");
+    assert_true(otherDispatchEvent(dispatchedEvent));
+    assert_equals(caughtEvent, dispatchedEvent);
+
+    const messagePromise = new EventWatcher(t, other, "message").wait_for("message");
+    other.postMessage.call(null, "foo");
+    assert_equals((await messagePromise).data, "foo");
+}, "Cross-realm global object's operation called on null / undefined");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/global-object-implicit-this-value.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/global-object-implicit-this-value.any.js
new file mode 100644
index 000000000000..4c159c67519c
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/global-object-implicit-this-value.any.js
@@ -0,0 +1,85 @@
+// META: global=window,worker
+
+// https://webidl.spec.whatwg.org/#dfn-attribute-getter (step 1.1.2.1)
+// https://webidl.spec.whatwg.org/#dfn-attribute-setter (step 4.5.1)
+// https://webidl.spec.whatwg.org/#dfn-create-operation-function (step 2.1.2.1)
+
+const notGlobalObject = Object.create(Object.getPrototypeOf(globalThis));
+
+test(() => {
+    assert_throws_js(TypeError, () => { Object.create(globalThis).self; });
+    assert_throws_js(TypeError, () => { getGlobalPropertyDescriptor("location").get.call(notGlobalObject); });
+    assert_throws_js(TypeError, () => { Reflect.get(globalThis, "navigator", notGlobalObject); });
+    assert_throws_js(TypeError, () => { new Proxy(globalThis, {}).onerror; });
+}, "Global object's getter throws when called on incompatible object");
+
+test(() => {
+    assert_throws_js(TypeError, () => { Object.create(globalThis).origin = origin; });
+    assert_throws_js(TypeError, () => { getGlobalPropertyDescriptor("onerror").set.call(notGlobalObject, onerror); });
+    assert_throws_js(TypeError, () => { Reflect.set(globalThis, "onoffline", onoffline, notGlobalObject); });
+    assert_throws_js(TypeError, () => { new Proxy(globalThis, {}).ononline = ononline; });
+}, "Global object's setter throws when called on incompatible object");
+
+test(() => {
+    assert_throws_js(TypeError, () => { Object.create(globalThis).setInterval(() => {}, 100); });
+    assert_throws_js(TypeError, () => { clearTimeout.call(notGlobalObject, () => {}); });
+    assert_throws_js(TypeError, () => { Reflect.apply(btoa, notGlobalObject, [""]); });
+    assert_throws_js(TypeError, () => { new Proxy(globalThis, {}).removeEventListener("foo", () => {}); });
+}, "Global object's operation throws when called on incompatible object");
+
+if (typeof document !== "undefined") {
+    test(() => {
+        assert_throws_js(TypeError, () => { Object.getOwnPropertyDescriptor(window, "document").get.call(document.all); });
+    }, "Global object's getter throws when called on incompatible object (document.all)");
+
+    test(() => {
+        assert_throws_js(TypeError, () => { Object.getOwnPropertyDescriptor(window, "name").set.call(document.all); });
+    }, "Global object's setter throws when called on incompatible object (document.all)");
+
+    test(() => {
+        assert_throws_js(TypeError, () => { focus.call(document.all); });
+    }, "Global object's operation throws when called on incompatible object (document.all)");
+}
+
+// An engine might have different code path for calling a function from outer scope to implement step 1.b.iii of https://tc39.es/ecma262/#sec-evaluatecall
+const locationGetter = getGlobalPropertyDescriptor("location").get;
+test(() => {
+    assert_equals(getGlobalPropertyDescriptor("self").get.call(null), self);
+    assert_equals((() => locationGetter())(), location);
+    assert_equals(Reflect.get(globalThis, "origin", null), origin);
+    assert_equals(Reflect.get(globalThis, "onoffline", undefined), onoffline);
+}, "Global object's getter works when called on null / undefined");
+
+test(() => {
+    const fn = () => {};
+
+    // origin is [Replaceable]
+    getGlobalPropertyDescriptor("origin").set.call(null, "foo");
+    assert_equals(origin, "foo");
+    getGlobalPropertyDescriptor("onerror").set.call(undefined, fn);
+    assert_equals(onerror, fn);
+    assert_true(Reflect.set(globalThis, "onoffline", fn, null));
+    assert_equals(onoffline, fn);
+
+    const ononlineSetter = getGlobalPropertyDescriptor("ononline").set;
+    (() => { ononlineSetter(fn); })();
+    assert_equals(ononline, fn);
+}, "Global object's setter works when called on null / undefined");
+
+// An engine might have different code path for calling a function from outer scope to implement step 1.b.iii of https://tc39.es/ecma262/#sec-evaluatecall
+const __addEventListener = addEventListener;
+test(() => {
+    assert_equals(atob.call(null, ""), "");
+    assert_equals(typeof (0, setInterval)(() => {}, 100), "number");
+
+    (() => { __addEventListener("foo", event => { event.preventDefault(); }); })();
+    const __dispatchEvent = dispatchEvent;
+    (() => { assert_false(__dispatchEvent(new Event("foo", { cancelable: true }))); })();
+}, "Global object's operation works when called on null / undefined");
+
+function getGlobalPropertyDescriptor(key) {
+    for (let obj = globalThis; obj; obj = Object.getPrototypeOf(obj)) {
+        const desc = Object.getOwnPropertyDescriptor(obj, key);
+        if (desc) return desc;
+    }
+}
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/has-instance.html b/test/fixtures/wpt/webidl/ecmascript-binding/has-instance.html
new file mode 100644
index 000000000000..caf0be472906
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/has-instance.html
@@ -0,0 +1,26 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>instanceof behavior</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<iframe></iframe>
+
+<script>
+test(function() {
+  var obj = Object.create(Element.prototype);
+  assert_true(obj instanceof Element);
+  assert_true(obj instanceof Node);
+  assert_false(obj instanceof Attr);
+}, "Manually-constructed prototype chains are correctly handled by instanceof");
+
+test(() => {
+  // This tests that the historical override of [[HasInstance]] was removed:
+  // https://github.com/heycam/webidl/pull/356
+  assert_false(document.body instanceof frames[0].Element);
+}, "instanceof must return false across different globals, for platform objects");
+
+test(() => {
+  assert_false(EventTarget.hasOwnProperty(Symbol.hasInstance));
+}, "platform objects do not have Symbol.hasInstance installed");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/interface-object-set-receiver.html b/test/fixtures/wpt/webidl/ecmascript-binding/interface-object-set-receiver.html
new file mode 100644
index 000000000000..ca75a96bbad5
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/interface-object-set-receiver.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>window.Interface is defined on [[Set]] receiver</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#define-the-global-property-references">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+"use strict";
+const testValue = Object.freeze(function() {});
+
+test(() => {
+  window.Window = testValue;
+  assert_false(window.propertyIsEnumerable("Window"));
+
+  window.History = testValue;
+  assert_false(window.propertyIsEnumerable("History"));
+
+  window.HTMLDivElement = testValue;
+  assert_false(window.propertyIsEnumerable("HTMLDivElement"))
+}, "Direct [[Set]] preserves [[Enumerable]]: false property attribute");
+
+test(() => {
+  const heir = Object.create(window);
+
+  heir.Location = testValue;
+  assert_equals(heir.Location, testValue);
+  assert_not_equals(window.Location, testValue);
+
+  heir.HTMLDocument = testValue;
+  assert_equals(heir.HTMLDocument, testValue);
+  assert_not_equals(window.HTMLDocument, testValue);
+
+  heir.HTMLPreElement = testValue;
+  assert_equals(heir.HTMLPreElement, testValue);
+  assert_not_equals(window.HTMLPreElement, testValue);
+}, "Prototype chain [[Set]] creates property on receiver");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/interface-object.html b/test/fixtures/wpt/webidl/ecmascript-binding/interface-object.html
new file mode 100644
index 000000000000..132c61ddaed4
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/interface-object.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Interface objects</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(function () {
+    assert_equals(typeof window.Blob, "function")
+    delete window.Blob;
+    assert_equals(window.Blob, undefined);
+}, "An interface object deleted after it has been accessed is undefined");
+
+test(function () {
+    delete window.File;
+    assert_equals(window.File, undefined);
+}, "An interface object deleted before it has been defined is undefined");
+
+test(function () {
+    delete window.ImageData;
+    assert_equals(Object.getOwnPropertyDescriptor(window, "ImageData"), undefined);
+    delete window.ImageData;
+    assert_equals(Object.getOwnPropertyDescriptor(window, "ImageData"), undefined);
+}, "Interface objects deleted multiple times stay deleted");
+
+test(function () {
+    assert_equals(window["abc\udc88"], undefined);
+}, "Fancy property names don't break the resolve hook on Window");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/interface-prototype-constructor-set-receiver.html b/test/fixtures/wpt/webidl/ecmascript-binding/interface-prototype-constructor-set-receiver.html
new file mode 100644
index 000000000000..64a2da8eb2da
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/interface-prototype-constructor-set-receiver.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Interface.prototype.constructor is defined on [[Set]] receiver</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#interface-prototype-object">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+"use strict";
+const testValue = Object.freeze(function() {});
+
+test(() => {
+  Location.prototype.constructor = testValue;
+  assert_false(Location.prototype.propertyIsEnumerable("constructor"));
+
+  HTMLDocument.prototype.constructor = testValue;
+  assert_false(HTMLDocument.prototype.propertyIsEnumerable("constructor"));
+
+  HTMLDivElement.prototype.constructor = testValue;
+  assert_false(HTMLDivElement.prototype.propertyIsEnumerable("constructor"));
+}, "Direct [[Set]] preserves [[Enumerable]]: false property attribute");
+
+test(() => {
+  window.constructor = testValue;
+  assert_equals(window.constructor, testValue);
+  assert_equals(Window.prototype.constructor, Window);
+
+  navigator.constructor = testValue;
+  assert_equals(navigator.constructor, testValue);
+  assert_equals(Navigator.prototype.constructor, Navigator);
+
+  const span = document.createElement("span");
+  span.constructor = testValue;
+  assert_equals(span.constructor, testValue);
+  assert_equals(HTMLSpanElement.prototype.constructor, HTMLSpanElement);
+}, "Prototype chain [[Set]] creates property on receiver");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/interface-prototype-object.html b/test/fixtures/wpt/webidl/ecmascript-binding/interface-prototype-object.html
new file mode 100644
index 000000000000..299bcf926dc2
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/interface-prototype-object.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Interface prototype objects</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#interface-prototype-object">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(function() {
+  // https://webidl.spec.whatwg.org/#create-an-interface-prototype-object
+  assert_own_property(Element.prototype, Symbol.unscopables, "Element.prototype has @@unscopables.");
+  let unscopables = Element.prototype[Symbol.unscopables];
+  assert_equals(typeof unscopables, "object", "@@unscopables is an Object.");
+  assert_equals(Object.getPrototypeOf(unscopables), null, "@@unscopables's prototype is null.");
+}, "[Unscopable] extended attribute makes @@unscopables object on the prototype object, whose prototype is null.");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/invalid-this-value-cross-realm.html b/test/fixtures/wpt/webidl/ecmascript-binding/invalid-this-value-cross-realm.html
new file mode 100644
index 000000000000..0535115ac61f
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/invalid-this-value-cross-realm.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Cross-realm getter / setter / operation doesn't use lexical global object to throw an error for incompatible |this| value</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#dfn-attribute-getter">
+<link rel="help" href="https://webidl.spec.whatwg.org/#dfn-attribute-setter">
+<link rel="help" href="https://webidl.spec.whatwg.org/#dfn-create-operation-function">
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/create-realm.js"></script>
+
+<body>
+<script>
+promise_test(async t => {
+    const other = await createRealm(t);
+    const notElement = Object.create(other.HTMLElement.prototype);
+
+    assert_throws_js(other.TypeError, () => { Object.create(other.document).head; });
+    assert_throws_js(other.TypeError, () => { Object.getOwnPropertyDescriptor(other.HTMLElement.prototype, "title").get.call(notElement); });
+    assert_throws_js(other.TypeError, () => { Reflect.get(other.document.createElement("div"), "hidden", notElement); });
+    assert_throws_js(other.TypeError, () => { new Proxy(other.text, {}).nodeType; });
+}, "Cross-realm getter throws when called on incompatible object");
+
+promise_test(async t => {
+    const other = await createRealm(t);
+    const notElement = Object.create(other.HTMLElement.prototype);
+    const notText = Object.create(other.Text.prototype);
+
+    assert_throws_js(other.TypeError, () => { Object.create(other.element).innerHTML = ""; });
+    assert_throws_js(other.TypeError, () => { Object.getOwnPropertyDescriptor(other.HTMLElement.prototype, "onclick").set.call(notElement, null); });
+    assert_throws_js(other.TypeError, () => { Reflect.set(new other.Text("foo"), "data", "foo", notText); });
+    assert_throws_js(other.TypeError, () => { new Proxy(other.document, {}).title = ""; });
+}, "Cross-realm setter throws when called on incompatible object");
+
+promise_test(async t => {
+    const other = await createRealm(t);
+    const notDocument = Object.create(other.HTMLDocument.prototype);
+    const notText = Object.create(other.Text.prototype);
+
+    assert_throws_js(other.TypeError, () => { Object.create(other.element).click(); });
+    assert_throws_js(other.TypeError, () => { other.document.querySelector.call(notDocument, "*"); });
+    assert_throws_js(other.TypeError, () => { Reflect.apply(other.text.remove, notText, []); });
+    assert_throws_js(other.TypeError, () => { new Proxy(other.document.createElement("a"), {}).addEventListener("foo", () => {}); });
+}, "Cross-realm operation throws when called on incompatible object");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/iterator-invalidation-foreach.html b/test/fixtures/wpt/webidl/ecmascript-binding/iterator-invalidation-foreach.html
new file mode 100644
index 000000000000..9d2e3b9cb25c
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/iterator-invalidation-foreach.html
@@ -0,0 +1,40 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Behavior of iterators when modified within foreach</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="help" href="https://webidl.spec.whatwg.org/#es-forEach">
+<link rel="author" title="Manish Goregaokar" href="mailto:manishsmail@gmail.com">
+<script>
+test(function() {
+    let params = new URLSearchParams("a=1&b=2&c=3");
+    let arr = [];
+    params.forEach((p) => {
+        arr.push(p);
+        params.delete("b");
+    })
+    assert_array_equals(arr, ["1", "3"]);
+}, "forEach will not iterate over elements removed during iteration");
+test(function() {
+    let params = new URLSearchParams("a=1&b=2&c=3&d=4");
+    let arr = [];
+    params.forEach((p) => {
+        arr.push(p);
+        if (p == "2") {
+            params.delete("a");
+        }
+    })
+    assert_array_equals(arr, ["1", "2", "4"]);
+}, "Removing elements already iterated over during forEach will cause iterator to skip an element");
+test(function() {
+    let params = new URLSearchParams("a=1&b=2&c=3&d=4");
+    let arr = [];
+    params.forEach((p) => {
+        arr.push(p);
+        if (p == "2") {
+            params.append("e", "5");
+        }
+    })
+    assert_array_equals(arr, ["1", "2", "3", "4", "5"]);
+}, "Elements added during iteration with forEach will be reached");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/iterator-prototype-object.html b/test/fixtures/wpt/webidl/ecmascript-binding/iterator-prototype-object.html
new file mode 100644
index 000000000000..7859c1e46ac4
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/iterator-prototype-object.html
@@ -0,0 +1,47 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Iterator prototype objects</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  const esIteratorPrototype = Object.getPrototypeOf(Object.getPrototypeOf([][Symbol.iterator]()));
+  const iteratorProto = Object.getPrototypeOf(new URLSearchParams().entries());
+  assert_equals(Object.getPrototypeOf(iteratorProto), esIteratorPrototype);
+}, "Has %IteratorPrototype% as prototype");
+
+test(() => {
+  const iteratorProto = Object.getPrototypeOf(new URLSearchParams().entries());
+  const desc = Object.getOwnPropertyDescriptor(iteratorProto, "next");
+  assert_equals(typeof desc.value, "function");
+  assert_equals(desc.writable, true);
+  assert_equals(desc.enumerable, true);
+  assert_equals(desc.configurable, true);
+}, "next() exists and is writable, enumerable, and configurable");
+
+test(() => {
+  const usp = new URLSearchParams();
+  const iteratorProto = Object.getPrototypeOf(usp.entries());
+
+  assert_throws_js(TypeError, () => {
+    iteratorProto.next();
+  });
+  assert_throws_js(TypeError, () => {
+    iteratorProto.next.call(undefined);
+  });
+  assert_throws_js(TypeError, () => {
+    iteratorProto.next.call(42);
+  });
+  assert_throws_js(TypeError, () => {
+    iteratorProto.next.call(new Headers().entries());
+  });
+}, "next() throws TypeError when called on ineligible receiver");
+
+// class string behavior tested in a dedicated file
+
+test(() => {
+  const iteratorProto1 = Object.getPrototypeOf(new URLSearchParams().entries());
+  const iteratorProto2 = Object.getPrototypeOf(new Headers().entries());
+  assert_not_equals(iteratorProto1, iteratorProto2);
+}, "Is specific to an interface");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/legacy-callback-interface-object.html b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-callback-interface-object.html
new file mode 100644
index 000000000000..627d29507f7d
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-callback-interface-object.html
@@ -0,0 +1,69 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Legacy callback interface objects</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="author" title="Domenic Denicola" href="mailto:d@domenic.me">
+<link rel="help" href="https://webidl.spec.whatwg.org/#legacy-callback-interface-object">
+
+<script>
+test(() => {
+  assert_equals(typeof NodeFilter, "function");
+}, "Must be a function according to typeof");
+
+test(() => {
+  assert_true(Object.getPrototypeOf(NodeFilter) === Function.prototype);
+}, "Must have the correct [[Prototype]]");
+
+test(() => {
+  const propDesc = Object.getOwnPropertyDescriptor(window, "NodeFilter");
+  assert_true(propDesc.writable, "writable");
+  assert_false(propDesc.enumerable, "enumerable");
+  assert_true(propDesc.configurable, "configurable");
+}, "Must have the correct property descriptor");
+
+test(() => {
+  assert_throws_js(TypeError, () => NodeFilter(), "call");
+  assert_throws_js(TypeError, () => new NodeFilter(), "construct");
+}, "Must throw a TypeError when called or constructed")
+
+test(() => {
+  assert_false(NodeFilter.hasOwnProperty("prototype"));
+}, "Must not have a .prototype property");
+
+test(() => {
+  assert_true(NodeFilter.hasOwnProperty("name"));
+  assert_equals(NodeFilter.name, "NodeFilter");
+
+  const propDesc = Object.getOwnPropertyDescriptor(NodeFilter, "name");
+  assert_false(propDesc.writable, "writable");
+  assert_false(propDesc.enumerable, "enumerable");
+  assert_true(propDesc.configurable, "configurable");
+}, "Must have an own name property equal to the interface name and with the correct descriptors");
+
+test(() => {
+  assert_true(NodeFilter.hasOwnProperty("length"));
+  assert_equals(NodeFilter.length, 0);
+
+  const propDesc = Object.getOwnPropertyDescriptor(NodeFilter, "length");
+  assert_false(propDesc.writable, "writable");
+  assert_false(propDesc.enumerable, "enumerable");
+  assert_true(propDesc.configurable, "configurable");
+}, "Must have an own length property with value zero and the correct descriptors");
+
+test(() => {
+  // The JS spec (OrdinaryHasInstance) bails out early for non-objects
+  // Historically we overrode [[HasInstance]] to throw anyway, but this was removed:
+  // https://github.com/heycam/webidl/pull/356
+  assert_false(5 instanceof NodeFilter, "5");
+
+  // OrdinaryHasInstance throws a TypeError if the right-hand-side doesn't have a .prototype object,
+  // which is the case for callback interfaces.
+  assert_throws_js(TypeError, () => {
+    (function () { }) instanceof NodeFilter;
+  });
+  assert_throws_js(TypeError, () => {
+    ({ }) instanceof NodeFilter;
+  });
+}, "instanceof must throw but only when we don't bail out early");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/legacy-factor-function-subclass.window.js b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-factor-function-subclass.window.js
new file mode 100644
index 000000000000..1fd64f41bb2e
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-factor-function-subclass.window.js
@@ -0,0 +1,13 @@
+"use strict";
+
+test(() => {
+  class CustomImage extends Image {}
+  var instance = new CustomImage();
+
+  assert_equals(
+    Object.getPrototypeOf(instance), CustomImage.prototype,
+    "Object.getPrototypeOf(instance) === CustomImage.prototype");
+
+  assert_true(instance instanceof CustomImage, "instance instanceof CustomImage");
+  assert_true(instance instanceof HTMLImageElement, "instance instanceof HTMLImageElement");
+}, "[LegacyFactoryFunction] can be subclassed and correctly handles NewTarget");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/legacy-factory-function-builtin-properties.window.js b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-factory-function-builtin-properties.window.js
new file mode 100644
index 000000000000..fc5c48aca380
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-factory-function-builtin-properties.window.js
@@ -0,0 +1,6 @@
+"use strict";
+
+test(() => {
+  const ownPropKeys = Reflect.ownKeys(Image).slice(0, 3);
+  assert_array_equals(ownPropKeys, ["length", "name", "prototype"]);
+}, 'Legacy factory function property enumeration order of "length", "name", and "prototype"');
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/DefineOwnProperty.html b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/DefineOwnProperty.html
new file mode 100644
index 000000000000..bd7ba19c1a90
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/DefineOwnProperty.html
@@ -0,0 +1,165 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Legacy platform objects [[DefineOwnProperty]] method</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#legacy-platform-object-defineownproperty">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./helper.js"></script>
+<script>
+
+test(function() {
+  let span = document.createElement("span");
+  span.className = "foo";
+  // DOMTokenList supports an indexed property getter but not a setter.
+  let domTokenList = span.classList;
+  // Confirm the test settings.
+  assert_equals(domTokenList.length, 1);
+  assert_prop_desc_equals(domTokenList, "0",
+                          {value: "foo", writable: false, enumerable: true,
+                           configurable: true});
+  assert_prop_desc_equals(domTokenList, "1", undefined);
+  // Actual test
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(domTokenList, "0", {value: true, writable: true}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(domTokenList, "1", {value: true, writable: true}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(domTokenList, "0", {get: () => {}}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(domTokenList, "0", {set: () => {}}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(domTokenList, "1", {get: () => {}}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(domTokenList, "1", {set: () => {}}));
+  assert_equals(domTokenList[0], "foo");
+  assert_equals(domTokenList[1], undefined);
+  domTokenList[0] = "bar";
+  domTokenList[1] = "bar";
+  assert_equals(domTokenList[0], "foo");
+  assert_equals(domTokenList[1], undefined);
+  assert_throws_js(TypeError, () => {
+    "use strict";
+    domTokenList[0] = "bar";
+  });
+  assert_throws_js(TypeError, () => {
+    "use strict";
+    domTokenList[1] = "bar";
+  });
+  // Nothing must change after all.
+  assert_equals(domTokenList.length, 1);
+  assert_prop_desc_equals(domTokenList, "0",
+                          {value: "foo", writable: false, enumerable: true,
+                           configurable: true});
+  assert_prop_desc_equals(domTokenList, "1", undefined);
+}, "Test [[DefineOwnProperty]] with no indexed property setter support.");
+
+test(function() {
+  // HTMLSelectElement supports an indexed property setter.
+  let select = document.createElement("select");
+  let option0 = document.createElement("option");
+  let option1 = document.createElement("option");
+  // Confirm the test settings.
+  assert_equals(select.length, 0);
+  assert_prop_desc_equals(select, "0", undefined);
+  // Try to define an accessor property with non supported property index.
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(select, "0", {get: () => {}}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(select, "0", {set: () => {}}));
+  assert_prop_desc_equals(select, "0", undefined);
+  // writable, enumerable, configurable will be ignored.
+  Object.defineProperty(select, "0", {value: option0, writable: false,
+                                      enumerable: false, configurable: false});
+  assert_prop_desc_equals(select, "0",
+                          {value: option0, writable: true, enumerable: true,
+                           configurable: true});
+  select[1] = option1;
+  assert_prop_desc_equals(select, "1",
+                          {value: option1, writable: true, enumerable: true,
+                           configurable: true});
+  // Try to define an accessor property with a supported property index.
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(select, "0", {get: () => {}}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(select, "0", {set: () => {}}));
+  assert_prop_desc_equals(select, "0",
+                          {value: option0, writable: true, enumerable: true,
+                           configurable: true});
+}, "Test [[DefineOwnProperty]] with indexed property setter support.");
+
+test(function() {
+  let dataList = document.createElement("datalist");
+  let option0 = document.createElement("option");
+  option0.id = "foo";
+  dataList.append(option0);
+  // HTMLCollection supports a named property getter but not a setter.
+  let htmlCollection = dataList.options;
+  // Confirm the test settings.
+  assert_equals(htmlCollection.length, 1);
+  // HTMLCollection is marked LegacyUnenumerableNamedProperties so enumerable
+  // is false.
+  assert_prop_desc_equals(htmlCollection, "foo",
+                          {value: option0, writable: false, enumerable: false,
+                           configurable: true});
+  assert_prop_desc_equals(htmlCollection, "bar", undefined);
+  // Actual test
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(htmlCollection, "foo",
+                            {value: true, writable: true}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(htmlCollection, "foo", {get: () => {}}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(htmlCollection, "foo", {set: () => {}}));
+  let option1 = document.createElement("option");
+  option1.id = "bar";
+  Object.defineProperty(htmlCollection, "bar",
+                        {value: option1, writable: true});
+  assert_equals(htmlCollection["foo"], option0);
+  assert_equals(htmlCollection["bar"], option1);
+  htmlCollection["foo"] = document.documentElement;
+  htmlCollection["baz"] = document.documentElement;
+  assert_equals(htmlCollection["foo"], option0);
+  assert_equals(htmlCollection["baz"], document.documentElement);
+  assert_throws_js(TypeError, () => {
+    "use strict";
+    htmlCollection["foo"] = document.documentElement;
+  });
+  // Nothing must change after all for supported property names.
+  assert_prop_desc_equals(htmlCollection, "foo",
+                          {value: option0, writable: false, enumerable: false,
+                           configurable: true});
+}, "Test [[DefineOwnProperty]] with no named property setter support.");
+
+test(function() {
+  let element = document.createElement("div");
+  // DOMStringMap supports a named property setter.
+  let domStringMap = element.dataset;
+  // Confirm the test settings.
+  assert_prop_desc_equals(domStringMap, "foo", undefined);
+  // Try to define an accessor property with non supported property name.
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(domStringMap, "foo", {get: () => {}}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(domStringMap, "foo", {set: () => {}}));
+  assert_prop_desc_equals(domStringMap, "foo", undefined);
+  // writable, enumerable, configurable will be ignored.
+  Object.defineProperty(domStringMap, "foo",
+                        {value: "foo content", writable: false,
+                         enumerable: false, configurable: false});
+  assert_prop_desc_equals(domStringMap, "foo",
+                          {value: "foo content", writable: true,
+                           enumerable: true, configurable: true});
+  domStringMap["bar"] = "bar content";
+  assert_prop_desc_equals(domStringMap, "bar",
+                          {value: "bar content", writable: true,
+                           enumerable: true, configurable: true});
+  // Try to define an accessor property with a supported property name.
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(domStringMap, "foo", {get: () => {}}));
+  assert_throws_js(TypeError, () =>
+      Object.defineProperty(domStringMap, "foo", {set: () => {}}));
+  assert_prop_desc_equals(domStringMap, "foo",
+                          {value: "foo content", writable: true,
+                           enumerable: true, configurable: true});
+}, "Test [[DefineOwnProperty]] with named property setter support.");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/GetOwnProperty.html b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/GetOwnProperty.html
new file mode 100644
index 000000000000..be3bcc61f0a3
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/GetOwnProperty.html
@@ -0,0 +1,84 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Legacy platform objects [[GetOwnProperty]] method</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#legacy-platform-object-getownproperty">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./helper.js"></script>
+<script>
+
+test(function() {
+  // DOMTokenList has an indexed property getter, no indexed property setter
+  // and no named property handlers.
+  let div = document.createElement("div");
+  div.classList.add("baz", "quux");
+  const domTokenList = div.classList;
+  assert_prop_desc_equals(
+      domTokenList, "1",
+      {value: "quux", writable: false, enumerable: true, configurable: true},
+      "[[GetOwnProperty]] for indexed properties returns the right descriptor");
+  assert_prop_desc_equals(
+      domTokenList, "42", undefined,
+      "[[GetOwnProperty]] with invalid index returns undefined");
+  assert_array_equals(Object.keys(domTokenList), ["0", "1"]);
+  assert_array_equals(Object.values(domTokenList), ["baz", "quux"]);
+
+  // getElementsByTagName() returns an HTMLCollection.
+  // HTMLCollection has indexed and named property getters, no setters. Its IDL
+  // interface declaration has [LegacyUnenumerableNamedProperties] so its named
+  // properties are not enumerable.
+  let span1 = document.createElement("span");
+  span1.id = "foo";
+  let span2 = document.createElement("span");
+  span2.id = "bar";
+  document.head.appendChild(span1);
+  document.head.appendChild(span2);
+  const elementList = document.getElementsByTagName("span");
+  assert_prop_desc_equals(
+      elementList, "foo",
+      {value: span1, writable: false, enumerable: false, configurable: true},
+      "[[GetOwnProperty]] for named properties returns the right descriptor");
+  assert_prop_desc_equals(
+      elementList, "1",
+      {value: span2, writable: false, enumerable: true, configurable: true},
+      "[[GetOwnProperty]] for indexed properties returns the right descriptor");
+  assert_prop_desc_equals(
+      elementList, "unknown", undefined,
+      "[[GetOwnProperty]] with invalid property name returns undefined");
+  assert_array_equals(Object.keys(elementList), ["0", "1"]);
+  assert_array_equals(Object.values(elementList), [span1, span2]);
+}, "[[GetOwnProperty]] with getters and no setters");
+
+test(function() {
+  // DOMStringMap supports named property getters and setters, but not indexed
+  // properties.
+  let span = document.createElement("span");
+  span.dataset.foo = "bar";
+  assert_prop_desc_equals(
+      span.dataset, "foo",
+      {value: "bar", writable: true, enumerable: true, configurable: true},
+      "[[GetOwnProperty]] for named properties returns the right descriptor");
+  assert_prop_desc_equals(
+      span.dataset, "unknown", undefined,
+      "[[GetOwnProperty]] with invalid property name returns undefined");
+  assert_array_equals(Object.keys(span.dataset), ["foo"]);
+  assert_array_equals(Object.values(span.dataset), ["bar"]);
+}, "[[GetOwnProperty]] with named property getters and setters");
+
+test(function() {
+  // HTMLSelectElement has indexed property getters and setters, but no support
+  // for named properties.
+  let selectElement = document.createElement("select");
+  assert_prop_desc_equals(
+      selectElement, "0", undefined,
+      "[[GetOwnProperty]] with invalid property index returns undefined");
+  let optionElement = document.createElement("option");
+  selectElement.appendChild(optionElement);
+  assert_prop_desc_equals(
+      selectElement, "0",
+      {value: optionElement, writable: true, enumerable: true, configurable: true},
+      "[[GetOwnProperty]] for indexed properties returns the right descriptor");
+  assert_array_equals(Object.keys(selectElement), ["0"]);
+  assert_array_equals(Object.values(selectElement), [optionElement]);
+}, "[[GetOwnProperty]] with indexed property getters and setters");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/OwnPropertyKeys.html b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/OwnPropertyKeys.html
new file mode 100644
index 000000000000..d33980517b1a
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/OwnPropertyKeys.html
@@ -0,0 +1,65 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Legacy platform objects [[OwnPropertyKeys]] method</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#legacy-platform-object-ownpropertykeys">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+    function custom_assert_array_equals(actual, expected, msg) {
+        function replacer(k, v) {
+          if (typeof v === "symbol") {
+            return v.toString();
+          }
+          return v;
+        }
+        assert_array_equals(actual, expected, " actual " + JSON.stringify(actual, replacer) + " expected " + JSON.stringify(expected, replacer));
+    }
+
+    test(function() {
+        var element = document.createElement("div");
+        element.appendChild(document.createElement("div"));
+        element.appendChild(document.createElement("div"));
+        element.appendChild(document.createElement("div"));
+        custom_assert_array_equals(Reflect.ownKeys(element.childNodes), ["0", "1", "2"]);
+    }, "must enumerate property indices in ascending numerical order");
+
+    test(function() {
+        var element = document.createElement("div");
+        element.setAttribute("data-foo", "foo content");
+        element.setAttribute("data-bar", "bar content");
+        element.setAttribute("data-baz", "baz content");
+        custom_assert_array_equals(Reflect.ownKeys(element.dataset), ["foo", "bar", "baz"]);
+    }, "must enumerate property names in list order");
+
+
+    test(function() {
+        var element = document.createElement("div");
+        element.setAttribute("id", "foo");
+        element.setAttribute("class", "bar");
+        custom_assert_array_equals(Reflect.ownKeys(element.attributes), ["0", "1", "id", "class"]);
+    }, "must first enumerate property indices in ascending numerical order, then named properties in list order");
+
+
+    test(function() {
+        var element = document.createElement("div");
+        element.attributes.foo = "some value";
+        element.attributes.bar = "and another";
+        element.setAttribute("id", "foo");
+        element.setAttribute("class", "bar");
+        custom_assert_array_equals(Reflect.ownKeys(element.attributes), ["0", "1", "id", "class", "foo", "bar"]);
+    }, "must enumerate own properties after indexed and named properties even when they're added first");
+
+    test(function() {
+        var symb1 = Symbol();
+        var symb2 = Symbol();
+        var element = document.createElement("div");
+        element.attributes.foo = "some value";
+        element.attributes[symb1] = "symb1";
+        element.attributes[symb2] = "symb2";
+        element.attributes.bar = "and another";
+        element.setAttribute("id", "foo");
+        element.setAttribute("class", "bar");
+        custom_assert_array_equals(Reflect.ownKeys(element.attributes),
+            ["0", "1", "id", "class", "foo", "bar", symb1, symb2]);
+    }, "must enumerate symbols after strings, regardless of which ones got added first");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/Set.html b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/Set.html
new file mode 100644
index 000000000000..1390b51cd03b
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/Set.html
@@ -0,0 +1,94 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Legacy platform objects [[Set]] method</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#legacy-platform-object-set">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+    test(function() {
+        var element = document.createElement("div");
+        element.appendChild(document.createElement("div"));
+        element.childNodes["5"] = "foo";
+        assert_equals(element.childNodes["5"], undefined);
+    }, "must not set the property value when assigning to a numeric property on an object which implements an indexed property getter but not a setter when not in strict mode");
+
+    test(function() {
+        "use strict";
+        var element = document.createElement("div");
+        element.appendChild(document.createElement("div"));
+        assert_throws_js(TypeError, function() { element.childNodes["5"] = "foo"; });
+    }, "must throw when assigning to a numeric property on an object which implements a indexed property getter but not a setter in strict mode");
+
+    test(function() {
+        var element = document.createElement("div");
+        element.attributes.foo = "foo";
+        assert_equals(element.attributes.foo, "foo");
+    }, "must allow assigning to a named property on an object which implements a named property getter but not a setter when not in strict mode");
+
+    test(function() {
+        "use strict";
+        var element = document.createElement("div");
+        element.attributes.foo = "foo";
+        assert_equals(element.attributes.foo, "foo");
+    }, "must allow assigning to a named property on an object which implements a named property getter but not a setter in strict mode");
+
+    test(function() {
+        "use strict";
+        var form = document.createElement("form");
+        assert_equals(form.method, "get");
+        var input = document.createElement("input");
+        input.name = "method";
+        input.id = "method";
+        form.appendChild(input);
+        assert_equals(form.method, input);
+        form.method = "post";
+        assert_equals(form.method, input);
+        input.remove();
+        assert_equals(form.method, "post");
+    }, "must allow setting built-in property on a [LegacyOverrideBuiltIns] object even if a named property shadows it");
+
+    var symbol = Symbol();
+
+    test(function() {
+        var element = document.createElement("div");
+        element.appendChild(document.createElement("div"));
+        element.childNodes[symbol] = "foo";
+        assert_equals(element.childNodes[symbol], "foo");
+    }, "must allow assigning to a symbol property on an object which implements an indexed property getter but not a setter when not in strict mode");
+
+    test(function() {
+        "use strict";
+        var element = document.createElement("div");
+        element.appendChild(document.createElement("div"));
+        element.childNodes[symbol] = "foo";
+        assert_equals(element.childNodes[symbol], "foo");
+    }, "must allow assigning to a symbol property on an object which implements an indexed property getter but not a setter in strict mode");
+
+    test(function() {
+        var element = document.createElement("div");
+        element.attributes[symbol] = "foo";
+        assert_equals(element.attributes[symbol], "foo");
+    }, "must allow assigning to a symbol property on an object which implements indexed and named property getters but no setters when not in strict mode");
+
+    test(function() {
+        "use strict";
+        var element = document.createElement("div");
+        element.attributes[symbol] = "foo";
+        assert_equals(element.attributes[symbol], "foo");
+    }, "must allow assigning to a symbol property on an object which implements indexed and named property getters but no setters in strict mode");
+
+    test(function() {
+        sessionStorage.clear();
+        this.add_cleanup(function() { sessionStorage.clear(); });
+        sessionStorage[symbol] = "foo";
+        assert_equals(sessionStorage[symbol], "foo");
+    }, "must allow assigning to a symbol property on an object which implements indexed and named property getters and setters when not in strict mode");
+
+    test(function() {
+        "use strict";
+        sessionStorage.clear();
+        this.add_cleanup(function() { sessionStorage.clear(); });
+        sessionStorage[symbol] = "foo";
+        assert_equals(sessionStorage[symbol], "foo");
+    }, "must allow assigning to a symbol property on an object which implements indexed and named property getters and setters in strict mode");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/helper.js b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/helper.js
new file mode 100644
index 000000000000..01c1d00694eb
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/legacy-platform-object/helper.js
@@ -0,0 +1,22 @@
+function assert_prop_desc_equals(object, property_key, expected) {
+  let actual = Object.getOwnPropertyDescriptor(object, property_key);
+  if (expected === undefined) {
+    assert_equals(
+        actual, undefined,
+        "(assert_prop_desc_equals: no property descriptor expected)");
+    return;
+  }
+  for (p in actual) {
+    assert_true(
+        expected.hasOwnProperty(p),
+        "(assert_prop_desc_equals: property '" + p + "' is not expected)");
+    assert_equals(
+        actual[p], expected[p],
+        "(assert_prop_desc_equals: property '" + p + "')");
+  }
+  for (p in expected) {
+    assert_true(
+        actual.hasOwnProperty(p),
+        "(assert_prop_desc_equals: expected property '" + p + "' missing)");
+  }
+}
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/no-regexp-special-casing.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/no-regexp-special-casing.any.js
new file mode 100644
index 000000000000..4446dbf69c02
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/no-regexp-special-casing.any.js
@@ -0,0 +1,47 @@
+"use strict";
+// RegExps used to be special-cased in Web IDL, but that was removed in
+// https://github.com/heycam/webidl/commit/bbb2bde. These tests check that implementations no longer
+// do any such special-casing.
+
+test(() => {
+  const regExp = new RegExp();
+  regExp.message = "some message";
+
+  const errorEvent = new ErrorEvent("type", regExp);
+
+  assert_equals(errorEvent.message, "some message");
+}, "Conversion to a dictionary works");
+
+test(() => {
+  const messageChannel = new MessageChannel();
+  const regExp = new RegExp();
+  regExp[Symbol.iterator] = function* () {
+    yield messageChannel.port1;
+  };
+
+  const messageEvent = new MessageEvent("type", { ports: regExp });
+
+  assert_array_equals(messageEvent.ports, [messageChannel.port1]);
+}, "Conversion to a sequence works");
+
+promise_test(async () => {
+  const regExp = new RegExp();
+
+  const response = new Response(regExp);
+
+  assert_equals(await response.text(), "/(?:)/");
+}, "Can convert a RegExp to a USVString");
+
+test(() => {
+  let functionCalled = false;
+
+  const regExp = new RegExp();
+  regExp.handleEvent = () => {
+    functionCalled = true;
+  };
+
+  self.addEventListener("testevent", regExp);
+  self.dispatchEvent(new Event("testevent"));
+
+  assert_true(functionCalled);
+}, "Can be used as an object implementing a callback interface");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/observable-array-no-leak-of-internals.window.js b/test/fixtures/wpt/webidl/ecmascript-binding/observable-array-no-leak-of-internals.window.js
new file mode 100644
index 000000000000..f93464005d01
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/observable-array-no-leak-of-internals.window.js
@@ -0,0 +1,18 @@
+"use strict";
+
+test(() => {
+  const observableArray = document.adoptedStyleSheets;
+
+  let leaked_target = null;
+  let leaked_handler = null;
+
+  let target_leaker = (target) => { leaked_target = target; return null; };
+  Object.defineProperty(Object.prototype, "getPrototypeOf", {get: function() {
+    leaked_handler = this;
+    return target_leaker;
+  }})
+  Object.getPrototypeOf(observableArray);
+
+  assert_equals(leaked_target, null, "The proxy target leaked.");
+  assert_equals(leaked_handler, null, "The proxy handler leaked.");
+}, "ObservableArray's internals won't leak");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/observable-array-ownkeys.window.js b/test/fixtures/wpt/webidl/ecmascript-binding/observable-array-ownkeys.window.js
new file mode 100644
index 000000000000..29b537c4750a
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/observable-array-ownkeys.window.js
@@ -0,0 +1,34 @@
+"use strict";
+
+test(() => {
+  const observableArray = document.adoptedStyleSheets;
+  assert_array_equals(
+      Object.getOwnPropertyNames(observableArray),
+      ["length"],
+      "Initially only \"length\".");
+
+  observableArray["zzz"] = true;
+  observableArray["aaa"] = true;
+  assert_array_equals(
+      Object.getOwnPropertyNames(observableArray),
+      ["length", "zzz", "aaa"],
+      "Own properties whose key is a string have been added.");
+
+  observableArray[0] = new CSSStyleSheet();
+  observableArray[1] = new CSSStyleSheet();
+  assert_array_equals(
+      Object.getOwnPropertyNames(observableArray),
+      ["0", "1", "length", "zzz", "aaa"],
+      "Own properties whose key is an array index have been added.");
+
+  observableArray[Symbol.toStringTag] = "string_tag";
+  observableArray[Symbol.toPrimitive] = "primitive";
+  assert_array_equals(
+      Object.getOwnPropertyNames(observableArray),
+      ["0", "1", "length", "zzz", "aaa"],
+      "Own properties whose key is a symbol have been added (non-symbol).");
+  assert_array_equals(
+      Object.getOwnPropertySymbols(observableArray),
+      [Symbol.toStringTag, Symbol.toPrimitive],
+      "Own properties whose key is a symbol have been added (symbol).");
+}, "ObservableArray's ownKeys trap");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/put-forwards.html b/test/fixtures/wpt/webidl/ecmascript-binding/put-forwards.html
new file mode 100644
index 000000000000..7d99d65aa213
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/put-forwards.html
@@ -0,0 +1,148 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>[PutForwards] behavior</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="author" title="Jens Widell" href="mailto:jl@opera.com">
+<link rel="help" href="https://webidl.spec.whatwg.org/#PutForwards">
+
+<script>
+test(() => {
+  var getter_called = false;
+  var element = document.createElement("div");
+  var element_style = element.style;
+  var descriptor = Object.getOwnPropertyDescriptor(HTMLElement.prototype, "style");
+
+  Object.defineProperty(element, "style", {
+    get: function () {
+      getter_called = true;
+      return element_style;
+    },
+    set: descriptor.set
+  });
+
+  element.style = "color: green";
+
+  assert_true(getter_called, "Overridden getter should be called");
+  assert_equals(element_style.color, "green", "Put forwarding still works");
+}, "Overriding getter of [PutForwards] attribute");
+
+test(() => {
+  var setter_called = false;
+  var element = document.createElement("div");
+  var element_style = element.style;
+  var descriptor = Object.getOwnPropertyDescriptor(CSSStyleDeclaration.prototype, "cssText");
+
+  Object.defineProperty(element_style, "cssText", {
+    get: descriptor.get,
+    set: function (v) {
+      setter_called = true;
+      descriptor.set.call(this, v);
+    }
+  });
+
+  element.style = "color: green";
+
+  assert_true(setter_called, "Overridden setter should be called");
+  assert_equals(element_style.color, "green", "Put forwarding still works");
+}, "Overriding setter of [PutForwards] target attribute");
+
+test(() => {
+  var element = document.createElement("div");
+  var element_style = element.style;
+  var fake_style = { cssText: "original" };
+  var descriptor = Object.getOwnPropertyDescriptor(HTMLElement.prototype, "style");
+
+  Object.defineProperty(element, "style", {
+    get: function () {
+      return fake_style;
+    },
+    set: descriptor.set
+  });
+
+  element.style = "color: green";
+
+  assert_equals(element_style.cssText, "", "Original value intact");
+  assert_equals(fake_style.cssText, "color: green", "Fake style object updated");
+}, "Overriding target of [PutForwards] attribute");
+
+test(() => {
+  var element = document.createElement("div");
+  var descriptor = Object.getOwnPropertyDescriptor(HTMLElement.prototype, "style");
+
+  Object.defineProperty(element, "style", {
+    get: function () {
+      throw new SyntaxError();
+    },
+    set: descriptor.set
+  });
+
+  assert_throws_js(SyntaxError, () => {
+    element.style = "color: green";
+  });
+}, "Exception propagation from getter of [PutForwards] attribute");
+
+test(() => {
+  var element = document.createElement("div");
+  var element_style = element.style;
+  var descriptor = Object.getOwnPropertyDescriptor(CSSStyleDeclaration.prototype, "cssText");
+
+  Object.defineProperty(element_style, "cssText", {
+    get: descriptor.get,
+    set: function (v) {
+      throw new SyntaxError();
+    }
+  });
+
+  assert_throws_js(SyntaxError, () => {
+    element.style = "color: green";
+  });
+}, "Exception propagation from setter of [PutForwards] target attribute");
+
+test(() => {
+  var element = document.createElement("div");
+  var descriptor = Object.getOwnPropertyDescriptor(HTMLElement.prototype, "style");
+
+  Object.defineProperty(element, "style", {
+    get: function () {
+      return null;
+    },
+    set: descriptor.set
+  });
+
+  assert_throws_js(TypeError, () => {
+    element.style = "color: green";
+  });
+}, "TypeError when getter of [PutForwards] attribute returns non-object");
+
+
+test(() => {
+  var element = document.createElement("div");
+
+  var element_style = element.style;
+  Object.defineProperty(element.style, "cssText", {
+    value: null,
+    writable: false,
+  });
+
+  element.style = "color: green";
+  assert_equals(element.style, element_style);
+  assert_equals(element.style.cssText, null);
+}, "Does not throw when setter of [PutForwards] attribute returns false");
+
+function test_token_list(elementName, attribute, target, value) {
+  test(() => {
+    var element=document.createElement(elementName);
+    assert_true(element[attribute] instanceof DOMTokenList,"The attribute is a DOMTokenList");
+    element[attribute]=value;
+    assert_equals(element.getAttribute(target),value,"Setting the attribute is reflected in the target");
+    element[attribute]="";
+    assert_equals(element.getAttribute(target),"","Clearing the attribute is reflected in the target");
+  },"Setting "+elementName+"."+attribute+" to "+value+" is reflected in "+target)
+}
+
+test_token_list("a","relList","rel","noreferrer");
+test_token_list("area","relList","rel","noreferrer");
+test_token_list("form","relList","rel","noreferrer");
+test_token_list("link","relList","rel","stylesheet");
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/replaceable-setter-throws-if-defineownproperty-fails.html b/test/fixtures/wpt/webidl/ecmascript-binding/replaceable-setter-throws-if-defineownproperty-fails.html
new file mode 100644
index 000000000000..872bbff96042
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/replaceable-setter-throws-if-defineownproperty-fails.html
@@ -0,0 +1,38 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>[Replaceable] setter throws TypeError if [[DefineOwnProperty]] fails</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="author" title="Alexey Shvayka" href="shvaikalesh@gmail.com">
+<link rel="help" href="https://webidl.spec.whatwg.org/#Replaceable">
+
+<body>
+<script>
+for (const key of ["self", "parent", "origin", "innerWidth"]) {
+    test(() => {
+        Object.defineProperty(window, key, { configurable: false });
+        assert_throws_js(TypeError, () => { window[key] = 1; });
+
+        const desc = Object.getOwnPropertyDescriptor(window, key);
+        assert_false("value" in desc);
+        assert_equals(typeof desc.get, "function");
+        assert_equals(typeof desc.set, "function");
+        assert_true(desc.enumerable);
+        assert_false(desc.configurable);
+    }, `window.${key} setter throws TypeError if called on non-configurable accessor property`);
+}
+
+for (const key of ["screen", "length", "event", "outerHeight"]) {
+    test(() => {
+        const { set } = Object.getOwnPropertyDescriptor(window, key);
+        Object.defineProperty(window, key, { value: 1, writable: false, configurable: false });
+        assert_throws_js(TypeError, () => { set.call(window, 2); });
+
+        const desc = Object.getOwnPropertyDescriptor(window, key);
+        assert_equals(desc.value, 1);
+        assert_false(desc.writable);
+        assert_true(desc.enumerable);
+        assert_false(desc.configurable);
+    }, `window.${key} setter throws TypeError if called on non-configurable non-writable data property`);
+}
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/sequence-conversion.html b/test/fixtures/wpt/webidl/ecmascript-binding/sequence-conversion.html
new file mode 100644
index 000000000000..40764e9f5776
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/sequence-conversion.html
@@ -0,0 +1,157 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Sequence conversion</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#es-sequence">
+<link rel="author" title="Domenic Denicola" href="mailto:d@domenic.me">
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<canvas></canvas>
+
+<script>
+"use strict";
+
+const canvas = document.querySelector("canvas");
+const ctx = canvas.getContext("2d");
+
+test(() => {
+  ctx.setLineDash([1, 2]);
+  assert_array_equals(ctx.getLineDash(), [1, 2]);
+}, "An array");
+
+test(() => {
+  function* generatorFunc() {
+    yield 4;
+    yield 5;
+  }
+  const generator = generatorFunc();
+
+  ctx.setLineDash(generator);
+  assert_array_equals(ctx.getLineDash(), [4, 5]);
+}, "A generator");
+
+test(() => {
+  function* generatorFunc() {
+    yield 6;
+    yield 7;
+  }
+
+  let callCount = 0;
+  const array = [1, 2];
+  Object.defineProperty(array, Symbol.iterator, {
+    get() {
+      ++callCount;
+      return generatorFunc;
+    }
+  });
+
+  ctx.setLineDash(array);
+  assert_array_equals(ctx.getLineDash(), [6, 7]);
+  assert_equals(callCount, 1, "@@iterator must only have been gotten once");
+}, "An array with an overridden Symbol.iterator");
+
+test(t => {
+  function* generatorFunc() {
+    yield ["foo", "bar"];
+    yield ["baz", "quux"];
+  }
+
+  let callCount = 0;
+  const obj = {};
+  Object.defineProperty(obj, Symbol.iterator, {
+    get() {
+      ++callCount;
+      return generatorFunc;
+    }
+  });
+
+  const searchParams = new URLSearchParams(obj);
+  assert_equals(searchParams.get("foo"), "bar");
+  assert_equals(searchParams.get("baz"), "quux");
+  assert_equals(callCount, 1, "@@iterator must only have been gotten once");
+}, "An object with an overriden Symbol.iterator");
+
+test(t => {
+  const originalIterator = Object.getOwnPropertyDescriptor(Array.prototype, Symbol.iterator);
+  t.add_cleanup(() => {
+    Object.defineProperty(Array.prototype, Symbol.iterator, originalIterator);
+  });
+
+  function* generatorFunc() {
+    yield 11;
+    yield 12;
+  }
+
+  let callCount = 0;
+  const array = [1, 2];
+  Object.defineProperty(Array.prototype, Symbol.iterator, {
+    get() {
+      ++callCount;
+      return generatorFunc;
+    }
+  });
+
+  ctx.setLineDash(array);
+  assert_array_equals(ctx.getLineDash(), [11, 12]);
+  assert_equals(callCount, 1, "@@iterator must only have been gotten once");
+}, "An array with an overridden Symbol.iterator on the prototype");
+
+test(t => {
+  const arrayIteratorPrototype = Object.getPrototypeOf(Array.prototype[Symbol.iterator]());
+  const nextBefore = arrayIteratorPrototype.next;
+  t.add_cleanup(() => {
+    arrayIteratorPrototype.next = nextBefore;
+  });
+
+  let callCount = 0;
+  arrayIteratorPrototype.next = () => {
+    switch (callCount) {
+      case 0: {
+        ++callCount;
+        return { done: false, value: 8 };
+      }
+      case 1: {
+        ++callCount;
+        return { done: false, value: 9 };
+      }
+      case 2: {
+        ++callCount;
+        return { done: true, value: 10 }; // value should be ignored this time
+      }
+      default: {
+        assert_unreached("next() should be called three times exactly");
+      }
+    }
+  };
+
+  const array = [1, 2];
+  ctx.setLineDash(array);
+  assert_array_equals(ctx.getLineDash(), [8, 9]);
+  assert_equals(callCount, 3, "next() must have been called thrice");
+}, "An array with an overridden %ArrayIterator%.prototype.next");
+
+test(t => {
+  t.add_cleanup(() => {
+    delete Array.prototype[1];
+  });
+
+  Object.defineProperty(Array.prototype, "1", {
+    configurable: true,
+    enumerable: true,
+    get() {
+      return 14;
+    }
+  });
+
+  const array = [13, , 15, 16];
+  ctx.setLineDash(array);
+  assert_array_equals(ctx.getLineDash(), [13, 14, 15, 16]);
+}, "A holey array with fallback to an accessor on the prototype");
+
+test(t => {
+  // Should fail rather than falling back to record
+  assert_throws_js(TypeError, function() { new URLSearchParams(["key", "value"]); });
+}, "A string array in sequence<sequence> or record");
+
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/setter-argument.html b/test/fixtures/wpt/webidl/ecmascript-binding/setter-argument.html
new file mode 100644
index 000000000000..bfa4291b2365
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/setter-argument.html
@@ -0,0 +1,176 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Setter should treat no arguments as undefined</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<script>
+const invalidThisValues = [undefined, null, 1, {}, new Image()];
+
+// String attribute.
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Animation.prototype, "id").set;
+
+  for (const thisValue of invalidThisValues) {
+    assert_throws_js(TypeError, () => { setter.call(thisValue); });
+    assert_throws_js(TypeError, () => { setter.call(thisValue, undefined); });
+    assert_throws_js(TypeError, () => { setter.call(thisValue, "foo"); });
+  }
+}, `String attribute setter should throw if this value is invalid`);
+
+test(() => {
+  const thisValue = new Animation();
+  const setter = Object.getOwnPropertyDescriptor(Animation.prototype, "id").set;
+
+  assert_equals(thisValue.id, "");
+
+  setter.call(thisValue);
+  assert_equals(thisValue.id, "undefined",
+               "undefined value should be stringified");
+}, `String attribute setter should treat no arguments as undefined`);
+
+test(() => {
+  const thisValue = new Animation();
+  const setter = Object.getOwnPropertyDescriptor(Animation.prototype, "id").set;
+
+  assert_equals(thisValue.id, "");
+
+  setter.call(thisValue, undefined);
+  assert_equals(thisValue.id, "undefined",
+               "undefined value should be stringified");
+}, `String attribute setter called with undefined should behave in the same way as no arguments`);
+
+test(() => {
+  const thisValue = new Animation();
+  const setter = Object.getOwnPropertyDescriptor(Animation.prototype, "id").set;
+
+  assert_equals(thisValue.id, "");
+
+  setter.call(thisValue, "foo");
+  assert_equals(thisValue.id, "foo");
+}, `String attribute setter called with string should just work`);
+
+// Object attribute.
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Document.prototype, "body").set;
+
+  for (const thisValue of invalidThisValues) {
+    assert_throws_js(TypeError, () => { setter.call(thisValue); });
+    assert_throws_js(TypeError, () => { setter.call(thisValue, undefined); });
+    assert_throws_js(TypeError, () => { setter.call(thisValue, "foo"); });
+  }
+}, `Object attribute setter should throw if this value is invalid`);
+
+test(() => {
+  const thisValue = new Document();
+  const setter = Object.getOwnPropertyDescriptor(Document.prototype, "body").set;
+
+  assert_throws_dom("HierarchyRequestError", () => { setter.call(thisValue); });
+}, `Object attribute setter should treat no arguments as undefined`);
+
+test(() => {
+  const thisValue = new Document();
+  const setter = Object.getOwnPropertyDescriptor(Document.prototype, "body").set;
+
+  assert_throws_dom("HierarchyRequestError", () => { setter.call(thisValue, undefined); });
+}, `Object attribute setter called with undefined should behave in the same way as no arguments`);
+
+// [Replaceable] attribute.
+
+test(() => {
+  const thisValue = window;
+  const setter = Object.getOwnPropertyDescriptor(window, "scrollX").set;
+
+  setter.call(thisValue);
+  assert_equals(thisValue.scrollX, undefined);
+}, `[Replaceable] setter should treat no arguments as undefined`);
+
+test(() => {
+  const thisValue = window;
+  const setter = Object.getOwnPropertyDescriptor(window, "screenLeft").set;
+
+  setter.call(thisValue, undefined);
+  assert_equals(thisValue.screenLeft, undefined);
+}, `[Replaceable] setter called with undefined should behave in the same way as no arguments`);
+
+test(() => {
+  const thisValue = window;
+  const setter = Object.getOwnPropertyDescriptor(window, "screenTop").set;
+
+  setter.call(thisValue, "foo");
+  assert_equals(thisValue.screenTop, "foo");
+}, `[Replaceable] setter called with other value should just work`);
+
+// [LegacyLenientThis] attribute.
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(HTMLElement.prototype, "onmouseenter").set;
+
+  for (const thisValue of invalidThisValues) {
+    setter.call(thisValue);
+    setter.call(thisValue, undefined);
+    setter.call(thisValue, "foo");
+  }
+}, `[LegacyLenientThis] setter should not throw even if this value is invalid, regardless of the arguments count`);
+
+test(() => {
+  const thisValue = document.createElement("div");
+  const setter = Object.getOwnPropertyDescriptor(HTMLElement.prototype, "onmouseenter").set;
+
+  setter.call(thisValue);
+  assert_equals(thisValue.onmouseenter, null);
+}, `[LegacyLenientThis] setter should treat no arguments as undefined`);
+
+test(() => {
+  const thisValue = document.createElement("div");
+  const setter = Object.getOwnPropertyDescriptor(HTMLElement.prototype, "onmouseenter").set;
+
+  setter.call(thisValue, undefined);
+  assert_equals(thisValue.onmouseenter, null);
+}, `[LegacyLenientThis] setter called with undefined should behave in the same way as no arguments`);
+
+// [LegacyLenientSetter] attribute.
+
+test(() => {
+  const thisValue = new Document();
+  const setter = Object.getOwnPropertyDescriptor(Document.prototype, "fullscreenEnabled").set;
+
+  setter.call(thisValue);
+  assert_equals(thisValue.fullscreenEnabled, false);
+}, `[LegacyLenientSetter] setter should treat no arguments as undefined`);
+
+test(() => {
+  const thisValue = new Document();
+  const setter = Object.getOwnPropertyDescriptor(Document.prototype, "fullscreenEnabled").set;
+
+  setter.call(thisValue, undefined);
+  assert_equals(thisValue.fullscreenEnabled, false);
+}, `[LegacyLenientSetter] setter called with undefined should behave in the same way as no arguments`);
+
+// [PutForward] attribute.
+
+test(() => {
+  const thisValue = document.createElement("a");
+  const setter = Object.getOwnPropertyDescriptor(HTMLAnchorElement.prototype, "relList").set;
+
+  assert_equals(thisValue.relList.length, 0);
+
+  setter.call(thisValue);
+  assert_equals(thisValue.relList.length, 1);
+  assert_equals(thisValue.relList[0], "undefined");
+}, `[PutForward] setter should treat no arguments as undefined`);
+
+test(() => {
+  const thisValue = document.createElement("a");
+  const setter = Object.getOwnPropertyDescriptor(HTMLAnchorElement.prototype, "relList").set;
+
+  assert_equals(thisValue.relList.length, 0);
+
+  setter.call(thisValue, undefined);
+
+  assert_equals(thisValue.relList.length, 1);
+  assert_equals(thisValue.relList[0], "undefined");
+}, `[PutForward] setter called with undefined should behave in the same way as no arguments`);
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/support/constructors-support.html b/test/fixtures/wpt/webidl/ecmascript-binding/support/constructors-support.html
new file mode 100644
index 000000000000..3b2616170b1d
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/support/constructors-support.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+window.badNewTarget = function() {};
+badNewTarget.prototype = 8;
+
+window.DOMParserSubclass = class extends DOMParser {}
+window.ForeignDOMParserSubclass = class extends parent.DOMParser {}
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/support/create-realm.js b/test/fixtures/wpt/webidl/ecmascript-binding/support/create-realm.js
new file mode 100644
index 000000000000..45ded884fc1f
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/support/create-realm.js
@@ -0,0 +1,12 @@
+"use strict";
+
+function createRealm(t) {
+    return new Promise(resolve => {
+        const iframe = document.createElement("iframe");
+        t.add_cleanup(() => { iframe.remove(); });
+        iframe.onload = () => { resolve(iframe.contentWindow); };
+        iframe.name = "dummy";
+        iframe.src = "support/dummy-iframe.html";
+        document.body.append(iframe);
+    });
+}
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/support/dummy-iframe.html b/test/fixtures/wpt/webidl/ecmascript-binding/support/dummy-iframe.html
new file mode 100644
index 000000000000..3f773ae6f811
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/support/dummy-iframe.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<body>foo
+<button id="element"></button>
+<script>
+    window.text = document.body.firstChild;
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/window-named-properties-object.html b/test/fixtures/wpt/webidl/ecmascript-binding/window-named-properties-object.html
new file mode 100644
index 000000000000..cc4976890683
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/window-named-properties-object.html
@@ -0,0 +1,284 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Internal methods of Window's named properties object</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#named-properties-object">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+<script>
+function sloppyModeSet(base, key, value) { base[key] = value; }
+</script>
+<script>
+"use strict";
+
+const supportedNonIndex = "supported non-index property name";
+const supportedIndex = "supported indexed property name";
+const unsupportedNonIndex = "unsupported non-index property name";
+const unsupportedIndex = "unsupported indexed property name";
+const existingSymbol = "existing symbol property name";
+const nonExistingSymbol = "non-existing symbol property name";
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+
+    Object.setPrototypeOf(wp, w.EventTarget.prototype); // Setting current [[Prototype]] value shouldn't throw
+
+    assert_throws_js(TypeError, () => { Object.setPrototypeOf(wp, {}); });
+    assert_throws_js(w.TypeError, () => { wp.__proto__ = null; });
+    assert_false(Reflect.setPrototypeOf(wp, w.Object.prototype));
+
+    assert_equals(Object.getPrototypeOf(wp), w.EventTarget.prototype);
+}, "[[SetPrototypeOf]] and [[GetPrototypeOf]]");
+
+test(t => {
+    const { wp } = createWindowProperties(t);
+
+    assert_throws_js(TypeError, () => { Object.preventExtensions(wp); });
+    assert_false(Reflect.preventExtensions(wp));
+
+    assert_true(Object.isExtensible(wp));
+}, "[[PreventExtensions]] and [[IsExtensible]]");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+
+    const elA = appendElementWithId(w, "a");
+    const el0 = appendIframeWithName(w, 0);
+
+    assert_prop_desc(Object.getOwnPropertyDescriptor(wp, "a"), elA, supportedNonIndex);
+    assert_prop_desc(Reflect.getOwnPropertyDescriptor(wp, 0), el0, supportedIndex);
+    assert_equals(Reflect.getOwnPropertyDescriptor(wp, "b"), undefined, unsupportedNonIndex);
+    assert_equals(Object.getOwnPropertyDescriptor(wp, 1), undefined, unsupportedIndex);
+}, "[[GetOwnProperty]]");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+
+    appendIframeWithName(w, "hasOwnProperty");
+    appendFormWithName(w, "addEventListener");
+    appendElementWithId(w, "a");
+    appendIframeWithName(w, 0);
+
+    w.Object.prototype.a = {};
+    w.EventTarget.prototype[0] = {};
+
+    // These are shadowed by properties higher in [[Prototype]] chain. See https://webidl.spec.whatwg.org/#dfn-named-property-visibility
+    assert_equals(Object.getOwnPropertyDescriptor(wp, "hasOwnProperty"), undefined, supportedNonIndex);
+    assert_equals(Reflect.getOwnPropertyDescriptor(wp, "addEventListener"), undefined, supportedNonIndex);
+    assert_equals(Object.getOwnPropertyDescriptor(wp, "a"), undefined, supportedNonIndex);
+    assert_equals(Reflect.getOwnPropertyDescriptor(wp, 0), undefined, supportedIndex);
+}, "[[GetOwnProperty]] (named property visibility algorithm)");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+
+    appendElementWithId(w, "a");
+    appendFormWithName(w, 0);
+
+    assert_define_own_property_fails(wp, "a", {}, supportedNonIndex);
+    assert_define_own_property_fails(wp, 0, {}, supportedIndex);
+    assert_define_own_property_fails(wp, "b", {}, unsupportedNonIndex);
+    assert_define_own_property_fails(wp, 1, {}, unsupportedIndex);
+    assert_define_own_property_fails(wp, Symbol.toStringTag, {}, existingSymbol);
+    assert_define_own_property_fails(wp, Symbol(), {}, nonExistingSymbol);
+}, "[[DefineOwnProperty]]");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+
+    appendFormWithName(w, "a");
+    appendElementWithId(w, 0);
+
+    assert_true("a" in wp, supportedNonIndex);
+    assert_true(Reflect.has(wp, "a"), supportedNonIndex);
+    assert_true(0 in wp, supportedIndex);
+    assert_true(Reflect.has(wp, 0), supportedIndex);
+
+    assert_false("b" in wp, unsupportedNonIndex);
+    assert_false(Reflect.has(wp, 1), unsupportedIndex);
+}, "[[HasProperty]]");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+    const elA = appendFormWithName(w, "a");
+    const el0 = appendIframeWithName(w, 0);
+
+    assert_equals(wp.a, elA, supportedNonIndex);
+    assert_equals(wp[0], el0, supportedIndex);
+    assert_equals(wp[Symbol.toStringTag], "WindowProperties", existingSymbol);
+
+    assert_equals(wp.b, undefined, unsupportedNonIndex);
+    assert_equals(wp[1], undefined, unsupportedIndex);
+    assert_equals(wp[Symbol.iterator], undefined, nonExistingSymbol);
+}, "[[Get]]");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+
+    appendIframeWithName(w, "isPrototypeOf");
+    appendFormWithName(w, "dispatchEvent");
+    appendElementWithId(w, "a");
+    appendElementWithId(w, 0);
+
+    w.EventTarget.prototype.a = 10;
+    w.Object.prototype[0] = 20;
+
+    // These are shadowed by properties higher in [[Prototype]] chain. See https://webidl.spec.whatwg.org/#dfn-named-property-visibility
+    assert_equals(wp.isPrototypeOf, w.Object.prototype.isPrototypeOf, supportedNonIndex);
+    assert_equals(wp.dispatchEvent, w.EventTarget.prototype.dispatchEvent, supportedNonIndex);
+    assert_equals(wp.a, 10, supportedNonIndex);
+    assert_equals(wp[0], 20, supportedIndex);
+}, "[[Get]] (named property visibility algorithm)");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+    const elA = appendIframeWithName(w, "a");
+    const el0 = appendFormWithName(w, 0);
+
+    assert_set_fails(wp, "a", supportedNonIndex);
+    assert_set_fails(wp, "b", unsupportedNonIndex);
+    assert_set_fails(wp, 0, supportedIndex);
+    assert_set_fails(wp, 1, unsupportedIndex);
+    assert_set_fails(wp, Symbol.toStringTag, existingSymbol);
+    assert_set_fails(wp, Symbol(), nonExistingSymbol);
+
+    assert_equals(wp.a, elA, supportedNonIndex);
+    assert_equals(wp[0], el0, supportedIndex);
+    assert_equals(wp.b, undefined, unsupportedNonIndex);
+    assert_equals(wp[1], undefined, unsupportedIndex);
+}, "[[Set]] (direct)");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+    const receiver = Object.create(wp);
+
+    appendIframeWithName(w, "a");
+    appendElementWithId(w, 0);
+
+    let setterThisValue;
+    Object.defineProperty(w.Object.prototype, 1, { set() { setterThisValue = this; } });
+    Object.defineProperty(w.EventTarget.prototype, "b", { writable: false });
+
+    receiver.a = 10;
+    assert_throws_js(TypeError, () => { receiver.b = {}; }, unsupportedNonIndex);
+    receiver[0] = 20;
+    receiver[1] = {};
+
+    assert_equals(receiver.a, 10, supportedNonIndex);
+    assert_equals(receiver[0], 20, supportedIndex);
+    assert_false(receiver.hasOwnProperty("b"), unsupportedNonIndex);
+    assert_false(receiver.hasOwnProperty(1), unsupportedIndex);
+    assert_equals(setterThisValue, receiver, "setter |this| value is receiver");
+}, "[[Set]] (prototype chain)");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+    const receiver = {};
+
+    appendFormWithName(w, "a");
+    appendIframeWithName(w, 0);
+
+    let setterThisValue;
+    Object.defineProperty(w.Object.prototype, "b", { set() { setterThisValue = this; } });
+    Object.defineProperty(w.EventTarget.prototype, 1, { writable: false });
+
+    assert_true(Reflect.set(wp, "a", 10, receiver), supportedNonIndex);
+    assert_true(Reflect.set(wp, 0, 20, receiver), supportedIndex);
+    assert_true(Reflect.set(wp, "b", {}, receiver), unsupportedNonIndex);
+    assert_false(Reflect.set(wp, 1, {}, receiver), unsupportedIndex);
+
+    assert_equals(receiver.a, 10, supportedNonIndex);
+    assert_equals(receiver[0], 20, supportedIndex);
+    assert_false(receiver.hasOwnProperty("b"), unsupportedNonIndex);
+    assert_equals(setterThisValue, receiver, "setter |this| value is receiver");
+    assert_false(receiver.hasOwnProperty(1), unsupportedIndex);
+}, "[[Set]] (Reflect.set)");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+    const elA = appendFormWithName(w, "a");
+    const el0 = appendElementWithId(w, 0);
+
+    assert_delete_fails(wp, "a", supportedNonIndex);
+    assert_delete_fails(wp, 0, supportedIndex);
+    assert_delete_fails(wp, "b", unsupportedNonIndex);
+    assert_delete_fails(wp, 1, unsupportedIndex);
+    assert_delete_fails(wp, Symbol.toStringTag, existingSymbol);
+    assert_delete_fails(wp, Symbol("foo"), nonExistingSymbol);
+
+    assert_equals(wp.a, elA, supportedNonIndex);
+    assert_equals(wp[0], el0, supportedIndex);
+    assert_equals(wp[Symbol.toStringTag], "WindowProperties", existingSymbol);
+}, "[[Delete]]");
+
+test(t => {
+    const { w, wp } = createWindowProperties(t);
+
+    appendIframeWithName(w, "a");
+    appendElementWithId(w, 0);
+    appendFormWithName(w, "b");
+
+    const forInKeys = [];
+    for (const key in wp)
+        forInKeys.push(key);
+
+    assert_array_equals(forInKeys, Object.keys(w.EventTarget.prototype));
+    assert_array_equals(Object.getOwnPropertyNames(wp), []);
+    assert_array_equals(Reflect.ownKeys(wp), [Symbol.toStringTag]);
+}, "[[OwnPropertyKeys]]");
+
+function createWindowProperties(t) {
+    const iframe = document.createElement("iframe");
+    document.body.append(iframe);
+    t.add_cleanup(() => { iframe.remove(); });
+
+    const w = iframe.contentWindow;
+    const wp = Object.getPrototypeOf(w.Window.prototype);
+    return { w, wp };
+}
+
+function appendIframeWithName(w, name) {
+    const el = w.document.createElement("iframe");
+    el.name = name;
+    w.document.body.append(el);
+    return el.contentWindow;
+}
+
+function appendFormWithName(w, name) {
+    const el = w.document.createElement("form");
+    el.name = name;
+    w.document.body.append(el);
+    return el;
+}
+
+function appendElementWithId(w, id) {
+    const el = w.document.createElement("div");
+    el.id = id;
+    w.document.body.append(el);
+    return el;
+}
+
+function assert_prop_desc(desc, value, testInfo) {
+    assert_equals(typeof desc, "object", `${testInfo} typeof desc`);
+    assert_equals(desc.value, value, `${testInfo} [[Value]]`);
+    assert_true(desc.writable, `${testInfo} [[Writable]]`);
+    assert_false(desc.enumerable, `${testInfo} [[Enumerable]]`);
+    assert_true(desc.configurable, `${testInfo} [[Configurable]]`);
+}
+
+function assert_define_own_property_fails(object, key, desc, testInfo) {
+    assert_throws_js(TypeError, () => { Object.defineProperty(object, key, desc); }, testInfo);
+    assert_false(Reflect.defineProperty(object, key, desc), testInfo);
+}
+
+function assert_set_fails(object, key, value, testInfo) {
+    sloppyModeSet(object, key, value);
+    assert_throws_js(TypeError, () => { object[key] = value; }, testInfo);
+    assert_false(Reflect.set(object, key, value), testInfo);
+}
+
+function assert_delete_fails(object, key, testInfo) {
+    assert_throws_js(TypeError, () => { delete object[key]; }, testInfo);
+    assert_false(Reflect.deleteProperty(object, key), testInfo);
+}
+</script>
diff --git a/test/fixtures/wpt/webidl/idlharness.any.js b/test/fixtures/wpt/webidl/idlharness.any.js
new file mode 100644
index 000000000000..164fa0e65c8d
--- /dev/null
+++ b/test/fixtures/wpt/webidl/idlharness.any.js
@@ -0,0 +1,17 @@
+// META: script=/resources/WebIDLParser.js
+// META: script=/resources/idlharness.js
+// META: global=window,dedicatedworker
+
+"use strict";
+
+idl_test(
+  ['webidl'],
+  [],
+  idl_array => {
+    idl_array.add_objects({
+      DOMException: ['new DOMException()',
+                     'new DOMException("my message")',
+                     'new DOMException("my message", "myName")']
+    });
+  }
+);
diff --git a/test/fuzzers/fuzz_ClientHelloParser.cc b/test/fuzzers/fuzz_ClientHelloParser.cc
deleted file mode 100644
index 87d7ae5e303e..000000000000
--- a/test/fuzzers/fuzz_ClientHelloParser.cc
+++ /dev/null
@@ -1,16 +0,0 @@
-/*
- * A fuzzer focused on node::crypto::ClientHelloParser.
- */
-
-#include <stdlib.h>
-#include "crypto/crypto_clienthello-inl.h"
-
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  node::crypto::ClientHelloParser parser;
-  bool end_cb_called = false;
-  parser.Start([](void* arg, auto hello) { },
-               [](void* arg) { },
-               &end_cb_called);
-  parser.Parse(data, size);
-  return 0;
-}
diff --git a/test/message/node_run_list.js b/test/message/node_run_list.js
new file mode 100644
index 000000000000..aef49734615d
--- /dev/null
+++ b/test/message/node_run_list.js
@@ -0,0 +1,14 @@
+'use strict';
+
+require('../common');
+const assert = require('node:assert/strict');
+const childProcess = require('node:child_process');
+const fixtures = require('../common/fixtures');
+
+const child = childProcess.spawnSync(
+  process.execPath,
+  [ '--no-warnings', '--run'],
+  { cwd: fixtures.path('run-script'), encoding: 'utf8' },
+);
+assert.strictEqual(child.status, 9);
+console.log(child.stderr);
diff --git a/test/message/node_run_list.out b/test/message/node_run_list.out
new file mode 100644
index 000000000000..5f634a03506b
--- /dev/null
+++ b/test/message/node_run_list.out
@@ -0,0 +1,14 @@
+Available scripts are:
+  test: echo "Error: no test specified" && exit 1
+  ada: ada
+  ada-windows: ada.bat
+  positional-args: positional-args
+  positional-args-windows: positional-args.bat
+  custom-env: custom-env
+  custom-env-windows: custom-env.bat
+  path-env: path-env
+  path-env-windows: path-env.bat
+  special-env-variables: special-env-variables
+  special-env-variables-windows: special-env-variables.bat
+  pwd: pwd
+  pwd-windows: cd
diff --git a/test/node-api/node-api.status b/test/node-api/node-api.status
index 151687e3549f..8dc149486f8a 100644
--- a/test/node-api/node-api.status
+++ b/test/node-api/node-api.status
@@ -21,6 +21,10 @@ test_sea_addon/test: SKIP
 # https://github.com/nodejs/postject/issues/105
 test_sea_addon/test: SKIP
 
+[$system==linux && $arch==riscv64]
+# https://github.com/nodejs/node/issues/61110
+test_sea_addon/test: SKIP
+
 [$system==macos && $arch==x64]
 # https://github.com/nodejs/node/issues/59553
 test_sea_addon/test: SKIP
diff --git a/test/node-api/test_worker_buffer_callback/test-free-called.js b/test/node-api/test_worker_buffer_callback/test-free-called.js
index 2a3cc9e47c22..1d2b43daa8cc 100644
--- a/test/node-api/test_worker_buffer_callback/test-free-called.js
+++ b/test/node-api/test_worker_buffer_callback/test-free-called.js
@@ -6,12 +6,13 @@ const { Worker } = require('worker_threads');
 const binding = path.resolve(__dirname, `./build/${common.buildType}/binding`);
 const { getFreeCallCount } = require(binding);
 
+assert.strictEqual(getFreeCallCount(), 0);
+
 // Test that buffers allocated with a free callback through our APIs are
 // released when a Worker owning it exits.
 
 const w = new Worker(`require(${JSON.stringify(binding)})`, { eval: true });
 
-assert.strictEqual(getFreeCallCount(), 0);
 w.on('exit', common.mustCall(() => {
   assert.strictEqual(getFreeCallCount(), 1);
 }));
diff --git a/test/parallel/test-abort-controller-any-timeout.js b/test/parallel/test-abort-controller-any-timeout.js
index 2d94afaa63d9..675be3af703c 100644
--- a/test/parallel/test-abort-controller-any-timeout.js
+++ b/test/parallel/test-abort-controller-any-timeout.js
@@ -1,28 +1,42 @@
+// Flags: --expose-gc
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const { once } = require('node:events');
 const { describe, it } = require('node:test');
 
 describe('AbortSignal.any() with timeout signals', () => {
   it('should abort when the first timeout signal fires', async () => {
-    const signal = AbortSignal.any([AbortSignal.timeout(9000), AbortSignal.timeout(110000)]);
+    const signal = AbortSignal.any([
+      AbortSignal.timeout(common.platformTimeout(1000)),
+      AbortSignal.timeout(110000),
+    ]);
+    let timeout;
 
     const abortPromise = Promise.race([
       once(signal, 'abort').then(() => {
         throw signal.reason;
       }),
-      new Promise((resolve) => setTimeout(resolve, 10000)),
+      new Promise((resolve) => {
+        timeout = setTimeout(resolve, common.platformTimeout(10000));
+      }),
     ]);
 
-    // The promise should be aborted by the 9000ms timeout
-    await assert.rejects(
-      () => abortPromise,
-      {
-        name: 'TimeoutError',
-        message: 'The operation was aborted due to timeout'
-      }
-    );
+    // Collect after this turn so the WeakRefs no longer keep the timeout
+    // signals alive by themselves.
+    setImmediate(common.mustCall(() => globalThis.gc()));
+
+    try {
+      await assert.rejects(
+        () => abortPromise,
+        {
+          name: 'TimeoutError',
+          message: 'The operation was aborted due to timeout'
+        }
+      );
+    } finally {
+      clearTimeout(timeout);
+    }
   });
 });
diff --git a/test/parallel/test-abortcontroller-internal.js b/test/parallel/test-abortcontroller-internal.js
index 63dd26c36e32..cd6dfb1a74d8 100644
--- a/test/parallel/test-abortcontroller-internal.js
+++ b/test/parallel/test-abortcontroller-internal.js
@@ -30,3 +30,22 @@ test('A weak event listener should not prevent gc', async () => {
   globalThis.gc();
   assert.strictEqual(ref.deref(), undefined);
 });
+
+test('two weak listeners with the same retainer should both run on abort', async () => {
+  // Regression test for https://github.com/nodejs/node/issues/63954
+  const ac = new AbortController();
+  let aRan = false;
+  let bRan = false;
+
+  ac.signal.addEventListener('a', () => { aRan = true; }, { [kWeakHandler]: ac });
+  ac.signal.addEventListener('b', () => { bRan = true; }, { [kWeakHandler]: ac });
+
+  await sleep(10);
+  globalThis.gc();
+
+  ac.signal.dispatchEvent(new Event('a'));
+  ac.signal.dispatchEvent(new Event('b'));
+
+  assert.strictEqual(aRan, true);
+  assert.strictEqual(bRan, true);
+});
diff --git a/test/parallel/test-abortsignal-any-source-gc.mjs b/test/parallel/test-abortsignal-any-source-gc.mjs
new file mode 100644
index 000000000000..06fd0c0e29f4
--- /dev/null
+++ b/test/parallel/test-abortsignal-any-source-gc.mjs
@@ -0,0 +1,31 @@
+// Flags: --expose-gc
+
+import '../common/index.mjs';
+import { gcUntil } from '../common/gc.js';
+import assert from 'node:assert/strict';
+import { it } from 'node:test';
+
+for (const nested of [false, true]) {
+  for (const accessor of ['aborted', 'reason', 'throwIfAborted']) {
+    it(`preserves ${accessor} after source GC (nested: ${nested})`, async () => {
+      let controller = new AbortController();
+      const sourceRef = new WeakRef(controller.signal);
+      let signal = AbortSignal.any([controller.signal]);
+      if (nested) signal = AbortSignal.any([signal]);
+      const reason = { message: 'stop' };
+
+      controller.abort(reason);
+      controller = null;
+
+      // Do not observe the composite or attach a listener before source GC.
+      await gcUntil('source signal is collected', () => sourceRef.deref() === undefined);
+
+      // Exercise each entry point before any other accessor can refresh state.
+      if (accessor === 'aborted') assert.strictEqual(signal.aborted, true);
+      if (accessor === 'reason') assert.strictEqual(signal.reason, reason);
+      assert.throws(() => signal.throwIfAborted(), (err) => err === reason);
+      assert.strictEqual(signal.aborted, true);
+      assert.strictEqual(signal.reason, reason);
+    });
+  }
+}
diff --git a/test/parallel/test-abortsignal-drop-settled-signals.mjs b/test/parallel/test-abortsignal-drop-settled-signals.mjs
index 224d65abc70f..d4c81a7165d4 100644
--- a/test/parallel/test-abortsignal-drop-settled-signals.mjs
+++ b/test/parallel/test-abortsignal-drop-settled-signals.mjs
@@ -122,16 +122,22 @@ describe('when there is a long-lived signal', () => {
     }, true);
   });
 
-  it('does not keep retained dependent signals without listeners', (t, done) => {
+  it('propagates abort to retained dependent signals without listeners', (t, done) => {
     const ac = new AbortController();
     const retainedSignals = [];
-    const kDependantSignals = Object.getOwnPropertySymbols(ac.signal).find(
-      (s) => s.toString() === 'Symbol(kDependantSignals)'
-    );
 
     function run(iteration) {
       if (iteration > limit) {
-        t.assert.strictEqual(ac.signal[kDependantSignals]?.size ?? 0, 0);
+        const kDependantSignals = Object.getOwnPropertySymbols(ac.signal).find(
+          (s) => s.toString() === 'Symbol(kDependantSignals)'
+        );
+        t.assert.strictEqual(ac.signal[kDependantSignals].size, limit);
+        ac.abort('stop');
+        for (const signal of retainedSignals) {
+          t.assert.strictEqual(signal.aborted, true);
+          t.assert.strictEqual(signal.reason, 'stop');
+          t.assert.throws(() => signal.throwIfAborted(), (err) => err === 'stop');
+        }
         done();
         return;
       }
@@ -143,6 +149,24 @@ describe('when there is a long-lived signal', () => {
     run(1);
   });
 
+  it('drops unreachable dependent signals without listeners', async () => {
+    const ac = new AbortController();
+    const size = () => {
+      const sym = Object.getOwnPropertySymbols(ac.signal).find(
+        (s) => s.toString() === 'Symbol(kDependantSignals)'
+      );
+      return ac.signal[sym]?.size ?? 0;
+    };
+
+    // Reuse a long-lived source across batches to catch accumulating WeakRefs.
+    for (let batch = 0; batch < 3; batch++) {
+      for (let i = 0; i < limit; i++) {
+        AbortSignal.any([ac.signal]);
+      }
+      await gcUntil('unreachable dependents are dropped', () => size() === 0);
+    }
+  });
+
   it('drops observed dependent signals once they are transitively aborted', async () => {
     const longLived = new AbortController();
     const handler = () => {};
diff --git a/test/parallel/test-assert-deep.js b/test/parallel/test-assert-deep.js
index 80d8bf1b728f..3350b67821cc 100644
--- a/test/parallel/test-assert-deep.js
+++ b/test/parallel/test-assert-deep.js
@@ -278,6 +278,10 @@ test('es6 Maps and Sets', () => {
   assertDeepAndStrictEqual(new Set([[1, 2], [3, 4]]), new Set([[3, 4], [1, 2]]));
   assertNotDeepOrStrict(new Set([{ a: 0 }]), new Set([{ a: 1 }]));
   assertNotDeepOrStrict(new Set([Symbol()]), new Set([Symbol()]));
+  // A null/primitive member lined up against object-only members in the other
+  // set must report inequality, not throw on `member.constructor`.
+  assertNotDeepOrStrict(new Set([null, {}, {}]), new Set([{}, {}, {}]));
+  assertNotDeepOrStrict(new Set([undefined, {}, {}]), new Set([{}, {}, {}]));
 
   {
     const a = [ 1, 2 ];
@@ -298,6 +302,17 @@ test('es6 Maps and Sets', () => {
     new Map([[[1], 1], [{}, 2]]),
     new Map([[[1], 2], [{}, 1]])
   );
+  // A null/primitive key that lines up with object-only keys in the other map
+  // must report inequality, not throw on `key.constructor`. Refs: object keys
+  // of `b` equal in count to `a.size` used to skip the primitive-key handling.
+  assertNotDeepOrStrict(
+    new Map([[null, 1], [{}, 2]]),
+    new Map([[{}, 9], [{}, 9]])
+  );
+  assertNotDeepOrStrict(
+    new Map([[undefined, 1], [{}, 2]]),
+    new Map([[{}, 9], [{}, 9]])
+  );
 
   assertNotDeepOrStrict(new Set([1]), [1]);
   assertNotDeepOrStrict(new Set(), []);
diff --git a/test/parallel/test-benchmark-compare.js b/test/parallel/test-benchmark-compare.js
new file mode 100644
index 000000000000..29795d6b743a
--- /dev/null
+++ b/test/parallel/test-benchmark-compare.js
@@ -0,0 +1,46 @@
+'use strict';
+
+require('../common');
+
+const assert = require('node:assert');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
+const { readFileSync } = require('node:fs');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+
+const compare = path.resolve(__dirname, '../../benchmark/compare.js');
+
+tmpdir.refresh();
+
+const csv = tmpdir.resolve('compare.csv');
+spawnSyncAndExitWithoutError(process.execPath, [
+  compare,
+  '--old', process.execPath,
+  '--new', process.execPath,
+  '--runs', '1',
+  '--filter', 'buffer-compare-offset.js',
+  '--set', 'method=offset',
+  '--set', 'size=16',
+  '--set', 'n=1',
+  '--no-progress',
+  '--analyze',
+  '--csv', csv,
+  'buffers',
+], {
+  encoding: 'utf8',
+  timeout: 30_000,
+}, {
+  stderr: '',
+  stdout(stdout) {
+    assert.match(stdout, /confidence\s+improvement\s+accuracy/);
+    assert.doesNotMatch(stdout, /"binary","filename"/);
+  },
+});
+
+const lines = readFileSync(csv, 'utf8').trim().split('\n');
+const filename = path.join('buffers', 'buffer-compare-offset.js');
+assert.strictEqual(lines[0],
+                   '"binary","filename","configuration","rate","time"');
+assert.strictEqual(lines.length, 3);
+assert(lines[1].startsWith(`"old","${filename}",`));
+assert(lines[2].startsWith(`"new","${filename}",`));
diff --git a/test/parallel/test-blob-file-backed.js b/test/parallel/test-blob-file-backed.js
index f94eae6d6ed7..c5a5ce14807d 100644
--- a/test/parallel/test-blob-file-backed.js
+++ b/test/parallel/test-blob-file-backed.js
@@ -129,6 +129,19 @@ writeFileSync(testfile5, '');
   await unlink(testfile5);
 })().then(common.mustCall());
 
+(async () => {
+  // A path that cannot be stat'd reports the underlying libuv error rather
+  // than a generic argument error, so ENOENT can be told apart from any other
+  // reason the file could not be used.
+  // Refs: https://github.com/nodejs/node/issues/65514
+  const missing = tmpdir.resolve('does-not-exist.txt');
+  await assert.rejects(async () => openAsBlob(missing), {
+    code: 'ENOENT',
+    syscall: 'stat',
+    path: missing,
+  });
+})().then(common.mustCall());
+
 (async () => {
   // We currently do not allow File-backed blobs to be cloned or transferred
   // across worker threads. This is largely because the underlying FdEntry
diff --git a/test/parallel/test-blocklist.js b/test/parallel/test-blocklist.js
index 08a293bb6a81..f1fc42f6304e 100644
--- a/test/parallel/test-blocklist.js
+++ b/test/parallel/test-blocklist.js
@@ -339,6 +339,34 @@ const util = require('util');
   });
 }
 
+{
+  // addAddresses() and addCIDRs() must throw the same errors for non-array
+  // input regardless of how the checks are implemented internally.
+  const blockList = new BlockList();
+  for (const [value, received] of [
+    ['x', "type string ('x')"],
+    [123, 'type number (123)'],
+    [{}, 'an instance of Object'],
+    [null, 'null'],
+    [undefined, 'undefined'],
+    [1n, 'type bigint (1n)'],
+    [true, 'type boolean (true)'],
+  ]) {
+    assert.throws(() => blockList.addAddresses(value), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      name: 'TypeError',
+      message: 'The "addresses" argument must be an instance of Array. ' +
+               `Received ${received}`,
+    });
+    assert.throws(() => blockList.addCIDRs(value), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      name: 'TypeError',
+      message: 'The "cidrs" argument must be an instance of Array. ' +
+               `Received ${received}`,
+    });
+  }
+}
+
 {
   // Test addAddresses() batch insert.
   const blockList = new BlockList();
@@ -927,3 +955,40 @@ const util = require('util');
   assert(!blockList.check('10.2.0.1'));
   assert.strictEqual(blockList.rules.length, 1);
 }
+
+{
+  // IPv4-mapped / mixed-notation IPv6 rules must survive a toJSON/fromJSON
+  // round-trip. toJSON() emits these addresses in mixed dotted-quad form
+  // (e.g. "::ffff:192.0.2.128"), so the rule parser must accept the "." used
+  // in that notation.
+  const bl = new BlockList();
+  bl.addAddress('::ffff:192.0.2.128', 'ipv6');
+  bl.addSubnet('::ffff:10.0.0.0', 120, 'ipv6');
+  bl.addRange('::ffff:172.16.0.1', '::ffff:172.16.0.10', 'ipv6');
+
+  const expected = [
+    'Address: IPv6 ::ffff:192.0.2.128',
+    'Range: IPv6 ::ffff:172.16.0.1-::ffff:172.16.0.10',
+    'Subnet: IPv6 ::ffff:10.0.0.0/120',
+  ];
+  assert.deepStrictEqual(bl.toJSON().sort(), expected);
+
+  const restored = new BlockList();
+  restored.fromJSON(bl.toJSON());
+
+  // The restored rules must be identical (lossless round-trip).
+  assert.deepStrictEqual(restored.toJSON().sort(), expected);
+
+  // And it must still match the same addresses as the original.
+  [
+    ['::ffff:192.0.2.128', true],  // the single address
+    ['::ffff:192.0.2.129', false],
+    ['::ffff:10.0.0.50', true],    // inside the subnet
+    ['::ffff:10.0.1.0', false],
+    ['::ffff:172.16.0.5', true],   // inside the range
+    ['::ffff:172.16.0.20', false],
+  ].forEach(([address, result]) => {
+    assert.strictEqual(bl.check(address, 'ipv6'), result);
+    assert.strictEqual(restored.check(address, 'ipv6'), result);
+  });
+}
diff --git a/test/parallel/test-buffer-tostring-rangeerror.js b/test/parallel/test-buffer-tostring-rangeerror.js
index 52fd3ffa1d49..7a8e2258bd08 100644
--- a/test/parallel/test-buffer-tostring-rangeerror.js
+++ b/test/parallel/test-buffer-tostring-rangeerror.js
@@ -34,6 +34,12 @@ function test(getBuffer) {
       return;
     }
   }
+  // MAX_STRING_LENGTH counts UTF-16 units, not bytes. Uninitialized memory can
+  // hold multi-byte UTF-8 sequences, which decode to fewer units than they
+  // occupy bytes, and a single one of them is enough to bring the result down
+  // to MAX_STRING_LENGTH or less. ASCII bytes keep the decoded length equal to
+  // the buffer length.
+  buf.fill(0);
   assert.throws(() => { buf.toString('utf8'); }, message);
 }
 
diff --git a/test/parallel/test-buffer-tostring.js b/test/parallel/test-buffer-tostring.js
index a3dad0146d75..676d2f85f567 100644
--- a/test/parallel/test-buffer-tostring.js
+++ b/test/parallel/test-buffer-tostring.js
@@ -9,6 +9,13 @@ for (const encoding of ['utf8', 'utf-8', 'ucs2', 'ucs-2', 'ascii', 'latin1',
   assert.strictEqual(Buffer.from('foo', encoding).toString(encoding), 'foo');
 }
 
+// Ignore an incomplete trailing code unit when decoding unaligned UTF-16LE.
+for (const size of [514, 516]) {
+  const buffer = Buffer.alloc(size, 0x61);
+  assert.strictEqual(buffer.toString('utf16le', 1),
+                     '\u6161'.repeat((size - 1) >>> 1));
+}
+
 // base64
 ['base64', 'BASE64'].forEach((encoding) => {
   assert.strictEqual(Buffer.from('Zm9v', encoding).toString(encoding), 'Zm9v');
diff --git a/test/parallel/test-child-process-exec-abortcontroller-promisified.js b/test/parallel/test-child-process-exec-abortcontroller-promisified.js
index 04e7b70671b9..84f2cd1ef1f8 100644
--- a/test/parallel/test-child-process-exec-abortcontroller-promisified.js
+++ b/test/parallel/test-child-process-exec-abortcontroller-promisified.js
@@ -10,10 +10,9 @@ const invalidArgTypeError = {
   name: 'TypeError'
 };
 
-const waitCommand = common.isWindows ?
-  // `"` is forbidden for Windows paths, no need for escaping.
-  `"${process.execPath}" -e "setInterval(()=>{}, 99)"` :
-  'sleep 2m';
+// `pause` is a cmd.exe builtin, so killing the shell kills the whole tree.
+// Running an executable here would leave it orphaned.
+const waitCommand = common.isWindows ? 'pause' : 'sleep 2m';
 
 {
   const ac = new AbortController();
diff --git a/test/parallel/test-child-process-exec-encoding.js b/test/parallel/test-child-process-exec-encoding.js
index 21ab207fca8c..78a9b55b9dfc 100644
--- a/test/parallel/test-child-process-exec-encoding.js
+++ b/test/parallel/test-child-process-exec-encoding.js
@@ -41,7 +41,7 @@ if (process.argv[2] === 'child') {
   [undefined, null, 'buffer', 'invalid'].forEach((encoding) => {
     run({ encoding }, common.mustCall((stdout, stderr) => {
       assert(stdout instanceof Buffer);
-      assert(stdout instanceof Buffer);
+      assert(stderr instanceof Buffer);
       assert.strictEqual(stdout.toString(), expectedStdout);
       assert.strictEqual(stderr.toString(), expectedStderr);
     }));
diff --git a/test/parallel/test-child-process-fork-closed-channel-segfault.js b/test/parallel/test-child-process-fork-closed-channel-segfault.js
index 73bd118ddce3..779e02205e29 100644
--- a/test/parallel/test-child-process-fork-closed-channel-segfault.js
+++ b/test/parallel/test-child-process-fork-closed-channel-segfault.js
@@ -76,6 +76,7 @@ const server = net
           // Ignore errors when sending the second handle because the worker
           // may already have exited.
           if (err && err.code !== 'ERR_IPC_CHANNEL_CLOSED' &&
+                     err.code !== 'EPIPE' &&
                      err.code !== 'ECONNRESET' &&
                      err.code !== 'ECONNREFUSED' &&
                      err.code !== 'EMFILE') {
diff --git a/test/parallel/test-child-process-kill-spawn-error.js b/test/parallel/test-child-process-kill-spawn-error.js
new file mode 100644
index 000000000000..5889e169492f
--- /dev/null
+++ b/test/parallel/test-child-process-kill-spawn-error.js
@@ -0,0 +1,16 @@
+'use strict';
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const { spawn } = require('child_process');
+
+// Killing a child process that never spawned must not signal the process
+// group of the caller. The check runs in a detached child so that a
+// regression cannot take the test runner down with it.
+const childPath = fixtures.path('child-process-kill-spawn-error.js');
+const child = spawn(process.execPath, [childPath], { detached: true });
+
+child.on('exit', common.mustCall((code, signal) => {
+  assert.strictEqual(signal, null);
+  assert.strictEqual(code, 0);
+}));
diff --git a/test/parallel/test-child-process-send-boundsocket.js b/test/parallel/test-child-process-send-boundsocket.js
new file mode 100644
index 000000000000..fff38a108ec9
--- /dev/null
+++ b/test/parallel/test-child-process-send-boundsocket.js
@@ -0,0 +1,79 @@
+'use strict';
+
+// This test verifies that an un-adopted TCP net.BoundSocket can be sent to a
+// child process as the sendHandle argument of subprocess.send(). The parent
+// binds synchronously to reserve the port, then hands the bound socket off;
+// the child adopts it via server.listen() and accepts connections.
+
+const common = require('../common');
+
+const assert = require('assert');
+const net = require('net');
+const { fork } = require('child_process');
+
+if (process.argv[2] === 'child') {
+  process.on('message', common.mustCall((msg, bound) => {
+    assert.ok(bound instanceof net.BoundSocket);
+    // The bound address survives the send.
+    assert.strictEqual(bound.address().port, msg.port);
+
+    const server = net.createServer(common.mustCall((socket) => {
+      socket.end('from-child');
+      server.close();
+    }));
+    server.listen(bound, common.mustCall(() => {
+      assert.strictEqual(server.address().port, msg.port);
+      // Adoption consumed the bound socket.
+      assert.throws(() => bound.address(), {
+        code: 'ERR_SOCKET_HANDLE_ADOPTED',
+      });
+      process.send('listening');
+    }));
+  }));
+  return;
+}
+
+const tmpdir = require('../common/tmpdir');
+tmpdir.refresh();
+
+const child = fork(__filename, ['child']);
+
+// Guards throw synchronously while no handle send is in flight (queued sends
+// defer conversion).
+const pipeBound = new net.BoundSocket({ path: common.PIPE });
+assert.throws(() => child.send('x', pipeBound), {
+  code: 'ERR_INVALID_HANDLE_TYPE',
+});
+pipeBound.close();
+
+const closedBound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+closedBound.close();
+assert.throws(() => child.send('x', closedBound), {
+  code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+});
+
+const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+const { port } = bound.address();
+
+child.send({ port }, bound, common.mustSucceed());
+
+// The source is left in the adopted state; further use throws.
+assert.throws(() => bound.address(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.fd(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.close(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+
+child.on('message', common.mustCall((msg) => {
+  assert.strictEqual(msg, 'listening');
+  const client = net.connect(port, '127.0.0.1');
+  client.setEncoding('utf8');
+  let response = '';
+  client.on('data', (chunk) => { response += chunk; });
+  client.on('end', common.mustCall(() => {
+    assert.strictEqual(response, 'from-child');
+    child.disconnect();
+  }));
+}));
+
+child.on('exit', common.mustCall((code) => {
+  assert.strictEqual(code, 0);
+}));
diff --git a/test/parallel/test-child-process-spawn-timeout-clear-on-error.js b/test/parallel/test-child-process-spawn-timeout-clear-on-error.js
new file mode 100644
index 000000000000..f674e4ed55f0
--- /dev/null
+++ b/test/parallel/test-child-process-spawn-timeout-clear-on-error.js
@@ -0,0 +1,19 @@
+'use strict';
+
+// Measures the child's actual exit time, not just its 'error' event.
+// The outer spawnSync timeout catches a leaked inner timer.
+
+const common = require('../common');
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
+
+const bugStallMs = common.platformTimeout(10000);
+const outerTimeoutMs = common.platformTimeout(2000);
+
+spawnSyncAndExitWithoutError(process.execPath, ['-e', `
+  const { spawn } = require('child_process');
+  const cp = spawn(process.execPath, ['--version'], {
+    cwd: '/nonexistent/path/that/should/never/exist',
+    timeout: ${bugStallMs},
+  });
+  cp.on('error', () => {});
+`], { timeout: outerTimeoutMs });
diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js
index 90c399790f65..375c46c11ab7 100644
--- a/test/parallel/test-cli-node-options.js
+++ b/test/parallel/test-cli-node-options.js
@@ -12,7 +12,7 @@ const { Worker } = require('worker_threads');
 
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 tmpdir.refresh();
 
 const printA = path.relative(tmpdir.path, fixtures.path('printA.js'));
@@ -65,7 +65,7 @@ if (common.isLinux) {
 if (common.hasCrypto) {
   expectNoWorker('--use-openssl-ca', 'B\n');
   expectNoWorker('--use-bundled-ca', 'B\n');
-  if (!hasOpenSSL3)
+  if (!hasOpenSSL(3))
     expectNoWorker('--openssl-config=_ossl_cfg', 'B\n');
   if (common.isMacOS) {
     expect('--use-system-ca', 'B\n');
diff --git a/test/parallel/test-cli-node-print-help.js b/test/parallel/test-cli-node-print-help.js
index f42129eb1330..84704be2104a 100644
--- a/test/parallel/test-cli-node-print-help.js
+++ b/test/parallel/test-cli-node-print-help.js
@@ -27,7 +27,8 @@ function validateNodePrintHelp() {
     { compileConstant: HAVE_OPENSSL,
       flags: [ '--openssl-config=...', '--tls-cipher-list=...',
                '--use-bundled-ca', '--use-openssl-ca', '--use-system-ca',
-               '--enable-fips', '--force-fips' ] },
+               '--enable-fips', '--enable-fips-indicator-events',
+               '--force-fips' ] },
     { compileConstant: NODE_HAVE_I18N_SUPPORT,
       flags: [ '--icu-data-dir=...', 'NODE_ICU_DATA' ] },
     { compileConstant: HAVE_INSPECTOR,
diff --git a/test/parallel/test-common-wpt-script-modifier.js b/test/parallel/test-common-wpt-script-modifier.js
new file mode 100644
index 000000000000..c2a39b81194f
--- /dev/null
+++ b/test/parallel/test-common-wpt-script-modifier.js
@@ -0,0 +1,35 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const { spawnSync } = require('child_process');
+
+if (process.env.NODE_TEST_WPT_MODIFIER_PROBE === '1') {
+  const { WPTRunner } = require('../common/wpt');
+  const runner = new WPTRunner('html/webappapis/atob');
+  runner.setScriptModifier(common.mustCall((script) => {
+    assert.strictEqual(script.filename,
+                       fixtures.path('wpt', 'html/webappapis/atob', 'base64.any.js'));
+    script.filename += '.modified';
+    script.code = `test(() => {
+      assert_true(new Error().stack.includes(${JSON.stringify(`${script.filename}:`)}));
+    }, 'modified script retains its filename');`;
+  }));
+  runner.runJsTests();
+} else {
+  // eslint-disable-next-line no-unused-vars
+  const { WPT_REPORT, ...env } = { ...process.env, NODE_TEST_WPT_MODIFIER_PROBE: '1' };
+  const result = spawnSync(process.execPath, [__filename, 'base64.any.js'], {
+    env,
+    encoding: 'utf8',
+    timeout: common.platformTimeout(10_000),
+  });
+  const { error, status, stdout, stderr } = result;
+  assert.ifError(error);
+  assert.strictEqual(status, 0, stdout + stderr);
+  const results = stdout.split('\n').filter((line) => line.startsWith('[PASS]'));
+  assert.deepStrictEqual(results, [
+    '[PASS] modified script retains its filename',
+  ]);
+}
diff --git a/test/parallel/test-config-json-schema.js b/test/parallel/test-config-json-schema.js
index 82679660a30f..08973bd17ee2 100644
--- a/test/parallel/test-config-json-schema.js
+++ b/test/parallel/test-config-json-schema.js
@@ -10,9 +10,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('this test requires OpenSSL 3.x');
 }
 
diff --git a/test/parallel/test-crypto-aes-wrap.js b/test/parallel/test-crypto-aes-wrap.js
index 951e93d728e3..b6561524dc92 100644
--- a/test/parallel/test-crypto-aes-wrap.js
+++ b/test/parallel/test-crypto-aes-wrap.js
@@ -63,3 +63,146 @@ const key3 = Buffer.from('29c9eab5ed5ad44134a1437fe2e673b4d88a5b7c72e68454fea087
   const msg = decipher.update(cipher.update(text, 'utf8'), 'buffer', 'utf8');
   assert.strictEqual(msg, text, `${algorithm} test case failed`);
 });
+
+const kwIV = Buffer.alloc(8, 0xa6);
+const kwpIV = Buffer.from('a65959a6', 'hex');
+
+// NIST SP 800-38F known-answer vectors.
+[
+  {
+    algorithm: 'aes-128-wrap',
+    key: '000102030405060708090a0b0c0d0e0f',
+    plaintext: '00112233445566778899aabbccddeeff',
+    ciphertext: '1fa68b0a8112b447aef34bd8fb5a7b829d3e862371d2cfe5',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-192-wrap',
+    key: '000102030405060708090a0b0c0d0e0f1011121314151617',
+    plaintext: '00112233445566778899aabbccddeeff',
+    ciphertext: '96778b25ae6ca435f92b5b97c050aed2468ab8a17ad84e5d',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-256-wrap',
+    key: '000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f',
+    plaintext: '00112233445566778899aabbccddeeff',
+    ciphertext: '64e8c3f9ce0f5ba263e9777905818a2a93c8191e7d6e8ae7',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-128-wrap-pad',
+    key: '6decf10a1caf8e3b80c7a4be8c9c84e8',
+    plaintext: '49',
+    ciphertext: '01a7d657fc4a5b216f261cca4d052c2b',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-192-wrap-pad',
+    key: '9ca11078baebc1597a68ce2fe3fc79a201626575252b8860',
+    plaintext: '76',
+    ciphertext: '866bc0ae30e290bb20a0dab31a6e7165',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-256-wrap-pad',
+    key: '95da2700ca6fd9a52554ee2a8df1386f5b94a1a60ed8a4aef60a8d61ab5f225a',
+    plaintext: 'd1',
+    ciphertext: '06ba7ae6f3248cfdcf267507fa001bc4',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-128-wrap-inv',
+    key: 'e88ba734ea243480a6129366753b58eb',
+    plaintext: 'd140ac16a44c1c2b3f47037ea8898a3e',
+    ciphertext: '600861ee14320006f0ae55c46d5e1ebf3303751df7f038df',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-192-wrap-inv',
+    key: '370c715135b44eb3773b1aff833bcd28b59aee866d4a36b3',
+    plaintext: 'eae0f60f1cf33d5b75869e84c764a04e',
+    ciphertext: 'ea4ba4add8add19950ca491d109ffa08f90312693055677a',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-256-wrap-inv',
+    key: 'de982f7c871f78e37462e2f48a62eecb2da81a10799c6ebf2bee8c786b624b0e',
+    plaintext: 'ecafc437d9f1643c7645c2416c14c003',
+    ciphertext: 'aec02ddb3f6de1f99103c6042dfc9001eb3cf56d9c2a11f7',
+    iv: kwIV,
+  },
+  {
+    algorithm: 'aes-128-wrap-pad-inv',
+    key: '1c321a356b0ee25e30de2d618c1facbe',
+    plaintext: '42',
+    ciphertext: '3ddf22da3080a1a5252574c76f833790',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-192-wrap-pad-inv',
+    key: 'fe3fe235bb36dcf03f01cbf32cc98a3abf10ab3d608d3b30',
+    plaintext: '1d2b7fc29991bafaf7',
+    ciphertext: 'c11afb3c0de263dfb9b672a5f81fe0b9acfe9c407691f332',
+    iv: kwpIV,
+  },
+  {
+    algorithm: 'aes-256-wrap-pad-inv',
+    key: '148a3fa618a6998c30b9f0f67922354a3747f2fa2e4d2e0b7af9582d6f548fee',
+    plaintext: '441125592acf9e5208dcd558a7ac0034d15530dbad7a2913963da0cbf60aa3',
+    ciphertext: '23f26a9476829885055694062c89b86399e8d6125509c9e88bb0a5b5113f4bfc8d34a62cba3c9eee',
+    iv: kwpIV,
+  },
+].forEach(({ algorithm, key, plaintext, ciphertext, iv }) => {
+  if (!crypto.getCiphers().includes(algorithm)) {
+    common.printSkipMessage(`Skipping unsupported ${algorithm} test case`);
+    return;
+  }
+
+  const keyBuffer = Buffer.from(key, 'hex');
+  const plaintextBuffer = Buffer.from(plaintext, 'hex');
+  const expected = Buffer.from(ciphertext, 'hex');
+  const cipher = crypto.createCipheriv(algorithm, keyBuffer, iv);
+  const actual = Buffer.concat([
+    cipher.update(plaintextBuffer),
+    cipher.final(),
+  ]);
+  assert.deepStrictEqual(actual, expected, `${algorithm} wrap failed`);
+
+  const decipher = crypto.createDecipheriv(algorithm, keyBuffer, iv);
+  const unwrapped = Buffer.concat([
+    decipher.update(actual),
+    decipher.final(),
+  ]);
+  assert.deepStrictEqual(
+    unwrapped, plaintextBuffer, `${algorithm} unwrap failed`);
+});
+
+{
+  const algorithm = crypto.getCiphers().includes('aes-128-wrap-inv') ?
+    'aes-128-wrap-inv' : 'aes128-wrap';
+  if (!crypto.getCiphers().includes(algorithm)) {
+    common.printSkipMessage(`Skipping unsupported ${algorithm} state tests`);
+  } else {
+    const key = Buffer.from('e88ba734ea243480a6129366753b58eb', 'hex');
+    const iv = Buffer.alloc(8, 0xa6);
+    const plaintextParts = [Buffer.alloc(16), Buffer.alloc(16, 1)];
+    const wrappedParts = plaintextParts.map((plaintext) => {
+      const cipher = crypto.createCipheriv(algorithm, key, iv);
+      return Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    });
+
+    for (const [create, inputParts] of [
+      [crypto.createCipheriv, plaintextParts],
+      [crypto.createDecipheriv, wrappedParts],
+    ]) {
+      const withoutUpdate = create(algorithm, key, iv);
+      assert.throws(() => withoutUpdate.final(), /Unsupported state/);
+
+      const multipleUpdates = create(algorithm, key, iv);
+      multipleUpdates.update(inputParts[0]);
+      assert.throws(() => multipleUpdates.update(inputParts[1]),
+                    /Trying to add data in unsupported state/);
+    }
+  }
+}
diff --git a/test/parallel/test-crypto-argon2-job.js b/test/parallel/test-crypto-argon2-job.js
index 7c16f9d850af..b3c04e8927e5 100644
--- a/test/parallel/test-crypto-argon2-job.js
+++ b/test/parallel/test-crypto-argon2-job.js
@@ -4,10 +4,12 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 2))
   common.skip('requires OpenSSL >= 3.2');
+if (hasFIPS(3))
+  common.skip('Argon2 is not available in FIPS mode');
 
 // Exercises the native Argon2 job directly via internalBinding, bypassing
 // the JS validators, to ensure that if invalid parameters ever reach the
diff --git a/test/parallel/test-crypto-argon2.js b/test/parallel/test-crypto-argon2.js
index 1f238e61a61d..98367bab5471 100644
--- a/test/parallel/test-crypto-argon2.js
+++ b/test/parallel/test-crypto-argon2.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 2))
   common.skip('requires OpenSSL >= 3.2');
@@ -28,6 +28,19 @@ const secret = Buffer.alloc(8, 0x03);
 const associatedData = Buffer.alloc(12, 0x04);
 const defaults = { message, nonce, parallelism: 1, tagLength: 64, memory: 8, passes: 3 };
 
+if (hasFIPS(3)) {
+  assert.throws(() => crypto.argon2Sync('argon2id', defaults), {
+    name: 'Error',
+    message: /:digital envelope routines::unsupported$/,
+  });
+  crypto.argon2('argon2id', defaults, common.mustCall((err, result) => {
+    assert.strictEqual(err?.name, 'Error');
+    assert.match(err.message, /:digital envelope routines::unsupported$/);
+    assert.strictEqual(result, undefined);
+  }));
+  return;
+}
+
 const good = [
   // Test vectors from RFC 9106 https://www.rfc-editor.org/rfc/rfc9106.html#name-test-vectors
   // and OpenSSL 3.2 https://github.com/openssl/openssl/blob/6dfa998f7ea150f9c6d4e4727cf6d5c82a68a8da/test/recipes/30-test_evp_data/evpkdf_argon2.txt
diff --git a/test/parallel/test-crypto-async-sign-verify.js b/test/parallel/test-crypto-async-sign-verify.js
index 2fb17748324f..dbc69e20ff94 100644
--- a/test/parallel/test-crypto-async-sign-verify.js
+++ b/test/parallel/test-crypto-async-sign-verify.js
@@ -3,12 +3,14 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const util = require('util');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
 
+const fips3 = hasFIPS(3);
+
 function test(
   publicFixture,
   privateFixture,
@@ -65,6 +67,17 @@ function test(
   }
 }
 
+function testSignFailure(privateFixture, algorithm, options, code, message) {
+  const key = { key: fixtures.readKey(privateFixture), ...options };
+  const data = Buffer.from('Hello world');
+  assert.throws(() => crypto.sign(algorithm, data, key), { code });
+  crypto.sign(algorithm, data, key, common.mustCall((err) => {
+    // Async crypto jobs in v24 preserve the OpenSSL message without a code.
+    assert.strictEqual(err?.name, 'Error');
+    assert.strictEqual(err.message, message);
+  }));
+}
+
 // RSA w/ default padding
 test('rsa_public.pem', 'rsa_private.pem', 'sha256', true);
 test('rsa_public.pem', 'rsa_private.pem', 'sha256', true,
@@ -89,19 +102,25 @@ test('rsa_public.pem', 'rsa_private.pem', 'sha256', false,
 // ED25519
 test('ed25519_public.pem', 'ed25519_private.pem', undefined, true);
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // ED448
   test('ed448_public.pem', 'ed448_private.pem', undefined, true);
 
   // ECDSA w/ der signature encoding
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
-       false);
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
-       false, { dsaEncoding: 'der' });
-
-  // ECDSA w/ ieee-p1363 signature encoding
-  test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384', false,
-       { dsaEncoding: 'ieee-p1363' });
+  if (fips3) {
+    testSignFailure('ec_secp256k1_private.pem', 'sha384', {},
+                    'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE',
+                    'error:03000096:digital envelope routines::operation not supported for this keytype');
+  } else {
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
+         false);
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384',
+         false, { dsaEncoding: 'der' });
+
+    // ECDSA w/ ieee-p1363 signature encoding
+    test('ec_secp256k1_public.pem', 'ec_secp256k1_private.pem', 'sha384', false,
+         { dsaEncoding: 'ieee-p1363' });
+  }
 
   // DSA w/ der signature encoding
   test('dsa_public.pem', 'dsa_private.pem', 'sha256',
@@ -156,7 +175,7 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
   const signature = crypto.randomBytes(16);
 
   let expected = /no default digest/;
-  if (hasOpenSSL3 || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3) || isBoringSSL) {
     expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
   }
 
@@ -167,11 +186,21 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
 }
 
 {
-  const { privateKey } = crypto.generateKeyPairSync('rsa', {
-    modulusLength: 512
-  });
-  crypto.sign('sha512', 'message', privateKey, common.mustCall((err) => {
-    assert.ok(err);
-    assert.match(err.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
-  }));
+  if (fips3) {
+    crypto.generateKeyPair('rsa', { modulusLength: 512 },
+                           common.mustCall((err) => {
+                             assert.strictEqual(err?.name, 'Error');
+                             assert.strictEqual(
+                               err.message, 'error:020000AE:rsa routines::invalid modulus');
+                           }));
+  } else {
+    const { privateKey } = crypto.generateKeyPairSync('rsa', {
+      modulusLength: 512
+    });
+    crypto.sign('sha512', 'message', privateKey, common.mustCall((err) => {
+      assert.ok(err);
+      assert.match(
+        err.message, /digest[\s_]too[\s_]big[\s_]for[\s_]rsa[\s_]key/i);
+    }));
+  }
 }
diff --git a/test/parallel/test-crypto-authenticated-stream.js b/test/parallel/test-crypto-authenticated-stream.js
index 51b928ec36be..45736d3303dc 100644
--- a/test/parallel/test-crypto-authenticated-stream.js
+++ b/test/parallel/test-crypto-authenticated-stream.js
@@ -6,6 +6,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const fs = require('fs');
 const stream = require('stream');
 const tmpdir = require('../common/tmpdir');
@@ -120,6 +121,16 @@ function test(config) {
     return;
   }
 
+  if (hasFIPS(3)) {
+    assert.throws(() => crypto.createDecipheriv(
+      config.cipher, config.key, config.iv, {
+        authTagLength: config.authTagLength,
+      }), {
+      code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    });
+    return;
+  }
+
   direct(config);
   mstream(config);
   fstream(config);
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index 082e86a669b0..f321bb0105f3 100644
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -29,9 +29,10 @@ const assert = require('assert');
 const crypto = require('crypto');
 const { inspect } = require('util');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
-const isFipsEnabled = crypto.getFips();
+const isFipsEnabled = crypto.getFips() === 1;
+const fips3 = hasFIPS(3);
 
 //
 // Test authenticated encryption modes.
@@ -43,6 +44,10 @@ const TEST_CASES = require(fixtures.path('aead-vectors.js'));
 
 const errMessages = {
   auth: / auth/,
+  // OpenSSL 4.1 adds a provider error for AEAD tag mismatches.
+  // https://github.com/openssl/openssl/pull/32587
+  badDecrypt: hasOpenSSL(4, 1) ?
+    { code: 'ERR_OSSL_BAD_DECRYPT' } : /Unsupported state or unable to authenticate data/,
   state: / state/,
   FIPS: /not supported in FIPS mode/,
   length: /Invalid initialization vector/,
@@ -62,8 +67,9 @@ for (const test of TEST_CASES) {
     continue;
   }
 
-  const isCCM = /^aes-(128|192|256)-ccm$/.test(test.algo);
+  const isCCM = /^(?:aes-(?:128|192|256)|sm4)-ccm$/.test(test.algo);
   const isOCB = /^aes-(128|192|256)-ocb$/.test(test.algo);
+  const isSIV = /^aes-(128|192|256)-siv$/.test(test.algo);
 
   let options;
   if (isCCM || isOCB)
@@ -77,6 +83,7 @@ for (const test of TEST_CASES) {
       plaintextLength: Buffer.from(test.plain, inputEncoding).length
     };
   }
+  const aads = test.aads ?? (test.aad === undefined ? [] : [test.aad]);
 
   {
     const encrypt = crypto.createCipheriv(test.algo,
@@ -84,8 +91,9 @@ for (const test of TEST_CASES) {
                                           Buffer.from(test.iv, 'hex'),
                                           options);
 
-    if (test.aad)
-      encrypt.setAAD(Buffer.from(test.aad, 'hex'), aadOptions);
+    for (const aad of aads) {
+      encrypt.setAAD(Buffer.from(aad, 'hex'), aadOptions);
+    }
 
     let hex = encrypt.update(test.plain, inputEncoding, 'hex');
     hex += encrypt.final('hex');
@@ -112,8 +120,9 @@ for (const test of TEST_CASES) {
                                               Buffer.from(test.iv, 'hex'),
                                               options);
       decrypt.setAuthTag(Buffer.from(test.tag, 'hex'));
-      if (test.aad)
-        decrypt.setAAD(Buffer.from(test.aad, 'hex'), aadOptions);
+      for (const aad of aads) {
+        decrypt.setAAD(Buffer.from(aad, 'hex'), aadOptions);
+      }
 
       const outputEncoding = test.plainIsHex ? 'hex' : 'ascii';
 
@@ -123,7 +132,8 @@ for (const test of TEST_CASES) {
         assert.strictEqual(msg, test.plain);
       } else {
         // Assert that final throws if input data could not be verified!
-        assert.throws(function() { decrypt.final('hex'); }, errMessages.auth);
+        assert.throws(function() { decrypt.final('hex'); },
+                      isCCM || isSIV ? errMessages.auth : errMessages.badDecrypt);
       }
     }
   }
@@ -144,7 +154,7 @@ for (const test of TEST_CASES) {
       crypto.createCipheriv(
         test.algo,
         Buffer.from(test.key, 'hex'),
-        Buffer.alloc(0)
+        isSIV ? Buffer.alloc(1) : Buffer.alloc(0)
       );
     }, errMessages.length);
   }
@@ -203,6 +213,162 @@ for (const test of TEST_CASES) {
   }
 }
 
+// SIV and GCM-SIV use fixed 16-byte authentication tags.
+{
+  for (const { algo, key, iv } of [
+    {
+      algo: 'aes-128-siv',
+      key: Buffer.alloc(32),
+      iv: null
+    },
+    {
+      algo: 'aes-128-gcm-siv',
+      key: Buffer.alloc(16),
+      iv: Buffer.alloc(12)
+    },
+  ]) {
+    if (!ciphers.includes(algo)) {
+      common.printSkipMessage(`unsupported ${algo} test`);
+      continue;
+    }
+
+    // OpenSSL 3.5 added support for zero-length SIV messages.
+    const supportsEmptyPlaintext = hasOpenSSL(3, 5);
+
+    for (const authTagLength of [1, 15, 17]) {
+      assert.throws(() => {
+        crypto.createCipheriv(algo, key, iv, { authTagLength });
+      }, errMessages.authTagLength);
+
+      assert.throws(() => {
+        crypto.createDecipheriv(algo, key, iv, { authTagLength });
+      }, errMessages.authTagLength);
+    }
+
+    if (algo === 'aes-128-siv') {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      for (let i = 0; i < 126; i++) {
+        cipher.setAAD(Buffer.alloc(0));
+      }
+      assert.throws(() => {
+        cipher.setAAD(Buffer.alloc(0));
+      }, errMessages.state);
+      cipher.update(Buffer.alloc(1));
+      cipher.final();
+    }
+
+    {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      cipher.update('a');
+      assert.throws(() => {
+        cipher.update('b');
+      }, /Trying to add data in unsupported state/);
+    }
+
+    {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      const ciphertext = cipher.update('authenticated plaintext');
+      assert.throws(() => {
+        cipher.setAAD(Buffer.from('too late'));
+      }, errMessages.state);
+      cipher.final();
+
+      const decipher = crypto.createDecipheriv(algo, key, iv);
+      decipher.setAuthTag(cipher.getAuthTag());
+      const plaintext = decipher.update(ciphertext);
+      assert.throws(() => {
+        decipher.setAAD(Buffer.from('too late'));
+      }, errMessages.state);
+      assert.strictEqual(
+        Buffer.concat([plaintext, decipher.final()]).toString(),
+        'authenticated plaintext');
+    }
+
+    {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      const ciphertext = cipher.update('authenticated plaintext');
+      cipher.final();
+
+      const decipher = crypto.createDecipheriv(algo, key, iv);
+      decipher.update(ciphertext);
+      assert.throws(() => {
+        decipher.setAuthTag(cipher.getAuthTag());
+      }, errMessages.state);
+      assert.throws(() => {
+        decipher.final();
+      }, errMessages.auth);
+    }
+
+    {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      assert.throws(() => {
+        cipher.final();
+      }, errMessages.auth);
+      assert.throws(() => {
+        cipher.update('too late');
+      }, errMessages.state);
+      assert.throws(() => {
+        cipher.final();
+      }, errMessages.state);
+    }
+
+    if (supportsEmptyPlaintext) {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      const ciphertext = Buffer.concat([
+        cipher.update(Buffer.alloc(0)),
+        cipher.final(),
+      ]);
+      assert.strictEqual(ciphertext.length, 0);
+
+      const decipher = crypto.createDecipheriv(algo, key, iv);
+      decipher.setAuthTag(cipher.getAuthTag());
+      assert.throws(() => {
+        decipher.final();
+      }, errMessages.auth);
+      assert.throws(() => {
+        decipher.update(Buffer.alloc(0));
+      }, errMessages.state);
+      assert.throws(() => {
+        decipher.final();
+      }, errMessages.state);
+    }
+
+    if (supportsEmptyPlaintext) {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      const ciphertext = Buffer.concat([
+        cipher.update(Buffer.alloc(0)),
+        cipher.final(),
+      ]);
+
+      const decipher = crypto.createDecipheriv(algo, key, iv);
+      decipher.setAuthTag(cipher.getAuthTag());
+      const plaintext = Buffer.concat([
+        decipher.update(ciphertext),
+        decipher.final(),
+      ]);
+      assert.strictEqual(plaintext.length, 0);
+    }
+
+    {
+      const cipher = crypto.createCipheriv(algo, key, iv);
+      const ciphertext = Buffer.concat([
+        cipher.update('authenticated plaintext'),
+        cipher.final(),
+      ]);
+      const authTag = cipher.getAuthTag();
+      authTag[0] ^= 1;
+
+      const decipher = crypto.createDecipheriv(algo, key, iv);
+      decipher.setAuthTag(authTag);
+      decipher.update(ciphertext);
+      assert.throws(() => {
+        decipher.final();
+      }, algo === 'aes-128-siv' ?
+        /Unsupported state or unable to authenticate data/ : errMessages.badDecrypt);
+    }
+  }
+}
+
 // Test that GCM can produce shorter authentication tags than 16 bytes.
 {
   const fullTag = '1debb47b2c91ba2cea16fad021703070';
@@ -559,6 +725,14 @@ for (const test of TEST_CASES) {
     const ciphertext = Buffer.concat([cipher.update(plain), cipher.final()]);
     const tag = cipher.getAuthTag();
 
+    if (fips3 && mode === 'ccm') {
+      assert.throws(() => crypto.createDecipheriv(
+        `aes-128-${mode}`, key, iv, opts), {
+        code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+      });
+      continue;
+    }
+
     const decipher = crypto.createDecipheriv(`aes-128-${mode}`, key, iv, opts);
     decipher.setAuthTag(tag);
     assert.throws(() => {
@@ -645,7 +819,7 @@ for (const test of TEST_CASES) {
     } catch (err) {
       // OpenSSL without https://github.com/openssl/openssl/pull/32427
       // cannot finalize an empty CCM message unless update() was called.
-      if (hasOpenSSL3) {
+      if (hasOpenSSL(3)) {
         assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
       } else {
         assert.match(err.message, /Unsupported state/);
@@ -659,7 +833,14 @@ for (const test of TEST_CASES) {
   }
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (fips3) {
+  assert.throws(() => crypto.createCipheriv(
+    'chacha20-poly1305', Buffer.alloc(32), Buffer.alloc(12), {
+      authTagLength: 16,
+    }), {
+    code: 'ERR_OSSL_EVP_UNSUPPORTED',
+  });
+} else if (!isBoringSSL) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -677,7 +858,7 @@ if (!process.features.openssl_is_boringssl) {
 
 // ChaCha20-Poly1305 should respect the authTagLength option and should not
 // require the authentication tag before calls to update() during decryption.
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !isBoringSSL) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -728,7 +909,7 @@ if (!process.features.openssl_is_boringssl) {
 // shorter tags as long as their length was valid according to NIST SP 800-38D.
 // For ChaCha20-Poly1305, we intentionally deviate from that because there are
 // no recommended or approved authentication tag lengths below 16 bytes.
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !isBoringSSL) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
@@ -767,7 +948,7 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 // https://github.com/nodejs/node/issues/45874
-if (!process.features.openssl_is_boringssl) {
+if (!fips3 && !isBoringSSL) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
@@ -794,7 +975,7 @@ if (!process.features.openssl_is_boringssl) {
 
   assert.throws(() => {
     decipher.final();
-  }, /Unsupported state or unable to authenticate data/);
+  }, errMessages.badDecrypt);
 } else {
   common.printSkipMessage('Skipping unsupported chacha20-poly1305 test');
 }
@@ -803,6 +984,7 @@ if (!process.features.openssl_is_boringssl) {
 if (ciphers.includes('aes-128-ccm')) {
   const key = crypto.randomBytes(16);
   const nonce = crypto.randomBytes(13);
+  const authError = /Unsupported state or unable to authenticate data/;
 
   const cipher = crypto.createCipheriv('aes-128-ccm', key, nonce, {
     authTagLength: 16,
@@ -813,13 +995,61 @@ if (ciphers.includes('aes-128-ccm')) {
   const tag = cipher.getAuthTag();
   assert.strictEqual(tag.length, 16);
 
-  const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
-    authTagLength: 16,
-  });
-  decipher.setAuthTag(tag);
-  decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
-  decipher.update(new DataView(new ArrayBuffer(0)));
-  decipher.final();
+  if (fips3) {
+    assert.throws(() => crypto.createDecipheriv(
+      'aes-128-ccm', key, nonce, { authTagLength: 16 }), {
+      code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    });
+  } else {
+    const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+      authTagLength: 16,
+    });
+    decipher.setAuthTag(tag);
+    decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+    decipher.update(new DataView(new ArrayBuffer(0)));
+    decipher.final();
+
+    const invalidTag = Buffer.from(tag);
+    invalidTag[0] ^= 0xff;
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAuthTag(tag);
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      assert.throws(() => decipher.final(), authError);
+    }
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      assert.throws(() => decipher.final(), authError);
+    }
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAuthTag(invalidTag);
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      decipher.update(Buffer.alloc(0));
+      assert.throws(() => decipher.final(), authError);
+    }
+
+    {
+      const decipher = crypto.createDecipheriv('aes-128-ccm', key, nonce, {
+        authTagLength: 16,
+      });
+      decipher.setAuthTag(tag);
+      decipher.setAAD(Buffer.alloc(0), { plaintextLength: 0 });
+      decipher.update(Buffer.alloc(0));
+      assert.throws(() => decipher.update(Buffer.alloc(0)), errMessages.state);
+      decipher.final();
+    }
+  }
 } else {
   common.printSkipMessage('Skipping unsupported aes-128-ccm test');
 }
diff --git a/test/parallel/test-crypto-boringssl-evp-list.js b/test/parallel/test-crypto-boringssl-evp-list.js
index 3f142c24f28a..f2d8fd4796c0 100644
--- a/test/parallel/test-crypto-boringssl-evp-list.js
+++ b/test/parallel/test-crypto-boringssl-evp-list.js
@@ -1,10 +1,12 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (!process.features.openssl_is_boringssl)
+if (!isBoringSSL)
   common.skip('BoringSSL-only test');
 
 const assert = require('assert');
diff --git a/test/parallel/test-crypto-certificate.js b/test/parallel/test-crypto-certificate.js
index 28d20ba61c75..54f61d8a3f6e 100644
--- a/test/parallel/test-crypto-certificate.js
+++ b/test/parallel/test-crypto-certificate.js
@@ -26,6 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { Certificate } = crypto;
 const fixtures = require('../common/fixtures');
 
@@ -41,8 +42,8 @@ function copyArrayBuffer(buf) {
 
 function checkMethods(certificate) {
 
-  if (!process.features.openssl_is_boringssl)
-    assert.strictEqual(certificate.verifySpkac(spkacValid), true);
+  if (!isBoringSSL)
+    assert.strictEqual(certificate.verifySpkac(spkacValid), !hasFIPS(3));
   assert.strictEqual(certificate.verifySpkac(spkacFail), false);
 
   assert.strictEqual(
@@ -57,11 +58,12 @@ function checkMethods(certificate) {
   );
   assert.strictEqual(certificate.exportChallenge(spkacFail), '');
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     const ab = copyArrayBuffer(spkacValid);
-    assert.strictEqual(certificate.verifySpkac(ab), true);
-    assert.strictEqual(certificate.verifySpkac(new Uint8Array(ab)), true);
-    assert.strictEqual(certificate.verifySpkac(new DataView(ab)), true);
+    const expected = !hasFIPS(3);
+    assert.strictEqual(certificate.verifySpkac(ab), expected);
+    assert.strictEqual(certificate.verifySpkac(new Uint8Array(ab)), expected);
+    assert.strictEqual(certificate.verifySpkac(new DataView(ab)), expected);
   }
 }
 
diff --git a/test/parallel/test-crypto-cipherbase-options-fast-path.js b/test/parallel/test-crypto-cipherbase-options-fast-path.js
new file mode 100644
index 000000000000..9649b61fa7c5
--- /dev/null
+++ b/test/parallel/test-crypto-cipherbase-options-fast-path.js
@@ -0,0 +1,130 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+} = require('crypto');
+
+const key = Buffer.alloc(16);
+const gcmIv = Buffer.alloc(12);
+const cbcIv = Buffer.alloc(16);
+
+for (const create of [createCipheriv, createDecipheriv]) {
+  // None of these supply either of the extended cipher options.
+  create('aes-128-gcm', key, gcmIv);
+  create('aes-128-gcm', key, gcmIv, null);
+  create('aes-128-gcm', key, gcmIv, {});
+  create('aes-128-gcm', key, gcmIv, undefined);
+  create('aes-128-gcm', key, gcmIv, { authTagLength: 16 });
+
+  for (const options of [
+    { ctsMode: null },
+    { ctsMode: undefined },
+    { xtsStandard: null },
+    { xtsStandard: undefined },
+    { ctsMode: null, xtsStandard: undefined },
+  ]) {
+    create('aes-128-gcm', key, gcmIv, options);
+  }
+
+  const accesses = [];
+  create('aes-128-gcm', key, gcmIv, {
+    get authTagLength() {
+      accesses.push('authTagLength');
+      return 16;
+    },
+    get ctsMode() {
+      accesses.push('ctsMode');
+      return null;
+    },
+    get xtsStandard() {
+      accesses.push('xtsStandard');
+      return undefined;
+    },
+  });
+  assert.deepStrictEqual(
+    accesses,
+    ['authTagLength', 'ctsMode', 'xtsStandard']);
+
+  const extendedAccesses = [];
+  assert.throws(
+    () => create('aes-128-cbc', key, cbcIv, {
+      get authTagLength() {
+        extendedAccesses.push('authTagLength');
+        return null;
+      },
+      get ctsMode() {
+        extendedAccesses.push('ctsMode');
+        return 'CS1';
+      },
+      get xtsStandard() {
+        extendedAccesses.push('xtsStandard');
+        return null;
+      },
+    }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+  assert.deepStrictEqual(
+    extendedAccesses,
+    ['authTagLength', 'ctsMode', 'xtsStandard']);
+
+  const invalidAuthTagAccesses = [];
+  assert.throws(() => create('aes-128-cbc', key, cbcIv, {
+    get authTagLength() {
+      invalidAuthTagAccesses.push('authTagLength');
+      return -2;
+    },
+    get ctsMode() {
+      invalidAuthTagAccesses.push('ctsMode');
+      return undefined;
+    },
+  }), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.deepStrictEqual(invalidAuthTagAccesses, ['authTagLength']);
+
+  const invalidCtsTypeAccesses = [];
+  assert.throws(() => create('aes-128-cbc', key, cbcIv, {
+    get ctsMode() {
+      invalidCtsTypeAccesses.push('ctsMode');
+      return 1;
+    },
+    get xtsStandard() {
+      invalidCtsTypeAccesses.push('xtsStandard');
+      return undefined;
+    },
+  }), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.deepStrictEqual(invalidCtsTypeAccesses, ['ctsMode']);
+
+  const invalidCtsValueAccesses = [];
+  assert.throws(() => create('aes-128-cbc', key, cbcIv, {
+    get ctsMode() {
+      invalidCtsValueAccesses.push('ctsMode');
+      return 'CS4';
+    },
+    get xtsStandard() {
+      invalidCtsValueAccesses.push('xtsStandard');
+      return undefined;
+    },
+  }), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.deepStrictEqual(
+    invalidCtsValueAccesses,
+    ['ctsMode', 'xtsStandard']);
+
+  assert.throws(
+    () => create('aes-128-cbc', key, cbcIv, { xtsStandard: 'GB' }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+
+  for (const ctsMode of ['', 'CS4']) {
+    assert.throws(
+      () => create('aes-128-cbc', key, cbcIv, { ctsMode }),
+      { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+  for (const xtsStandard of ['', 'IEEE-1619']) {
+    assert.throws(
+      () => create('aes-128-cbc', key, cbcIv, { xtsStandard }),
+      { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+}
diff --git a/test/parallel/test-crypto-cipheriv-cbc-cts.js b/test/parallel/test-crypto-cipheriv-cbc-cts.js
new file mode 100644
index 000000000000..c3447b2908b3
--- /dev/null
+++ b/test/parallel/test-crypto-cipheriv-cbc-cts.js
@@ -0,0 +1,123 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+  getCiphers,
+} = require('crypto');
+
+const algorithm = 'aes-128-cbc-cts';
+const key = Buffer.from('636869636b656e207465726979616b69', 'hex');
+const iv = Buffer.alloc(16);
+
+for (const create of [createCipheriv, createDecipheriv]) {
+  for (const ctsMode of ['cs1', 'CS4', '']) {
+    assert.throws(
+      () => create('aes-128-cbc', key, iv, { ctsMode }),
+      { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+  for (const ctsMode of [1, true, {}]) {
+    assert.throws(
+      () => create('aes-128-cbc', key, iv, { ctsMode }),
+      { code: 'ERR_INVALID_ARG_TYPE' });
+  }
+  assert.throws(
+    () => create('aes-128-cbc', key, iv, { ctsMode: 'CS1' }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+}
+
+if (!getCiphers().includes(algorithm)) {
+  common.printSkipMessage(`unsupported ${algorithm}`);
+  return;
+}
+
+// OpenSSL AES-128-CBC-CTS CS1 test vector.
+const plaintext = Buffer.from('4920776f756c64206c696b652074686520',
+                              'hex');
+const expected = Buffer.from('97c6353568f2bf8cb4d8a580362da7ff7f',
+                             'hex');
+
+const cipher = createCipheriv(algorithm, key, iv);
+const ciphertext = Buffer.concat([
+  cipher.update(plaintext),
+  cipher.final(),
+]);
+assert.deepStrictEqual(ciphertext, expected);
+
+const decipher = createDecipheriv(algorithm, key, iv);
+const decrypted = Buffer.concat([
+  decipher.update(ciphertext),
+  decipher.final(),
+]);
+assert.deepStrictEqual(decrypted, plaintext);
+
+const vectors = [
+  {
+    plaintext,
+    ciphertext: {
+      CS1: expected,
+      CS2: Buffer.from('c6353568f2bf8cb4d8a580362da7ff7f97', 'hex'),
+      CS3: Buffer.from('c6353568f2bf8cb4d8a580362da7ff7f97', 'hex'),
+    },
+  },
+  {
+    plaintext: Buffer.from(
+      '4920776f756c64206c696b6520746865' +
+      '2047656e6572616c2047617527732043', 'hex'),
+    ciphertext: {
+      CS1: Buffer.from(
+        '97687268d6ecccc0c07b25e25ecfe584' +
+        '39312523a78662d5be7fcbcc98ebf5a8', 'hex'),
+      CS2: Buffer.from(
+        '97687268d6ecccc0c07b25e25ecfe584' +
+        '39312523a78662d5be7fcbcc98ebf5a8', 'hex'),
+      CS3: Buffer.from(
+        '39312523a78662d5be7fcbcc98ebf5a8' +
+        '97687268d6ecccc0c07b25e25ecfe584', 'hex'),
+    },
+  },
+];
+
+for (const { plaintext, ciphertext } of vectors) {
+  for (const ctsMode of ['CS1', 'CS2', 'CS3']) {
+    const cipher = createCipheriv(algorithm, key, iv, { ctsMode });
+    const encrypted = Buffer.concat([
+      cipher.update(plaintext),
+      cipher.final(),
+    ]);
+    assert.deepStrictEqual(encrypted, ciphertext[ctsMode]);
+
+    const decipher = createDecipheriv(algorithm, key, iv, { ctsMode });
+    const decrypted = Buffer.concat([
+      decipher.update(encrypted),
+      decipher.final(),
+    ]);
+    assert.deepStrictEqual(decrypted, plaintext);
+  }
+}
+
+const tooShort = createCipheriv(algorithm, key, iv);
+assert.throws(() => tooShort.update(Buffer.alloc(15)),
+              /Trying to add data in unsupported state/);
+assert.deepStrictEqual(Buffer.concat([
+  tooShort.update(plaintext),
+  tooShort.final(),
+]), expected);
+
+for (const [create, input] of [
+  [createCipheriv, plaintext],
+  [createDecipheriv, expected],
+]) {
+  const withoutUpdate = create(algorithm, key, iv);
+  assert.throws(() => withoutUpdate.final(), /Unsupported state/);
+
+  const multipleUpdates = create(algorithm, key, iv);
+  multipleUpdates.update(input.subarray(0, 16));
+  assert.throws(() => multipleUpdates.update(input.subarray(16)),
+                /Trying to add data in unsupported state/);
+}
diff --git a/test/parallel/test-crypto-cipheriv-decipheriv.js b/test/parallel/test-crypto-cipheriv-decipheriv.js
index 8801ddfe7023..4c2a0c1fd1cd 100644
--- a/test/parallel/test-crypto-cipheriv-decipheriv.js
+++ b/test/parallel/test-crypto-cipheriv-decipheriv.js
@@ -5,8 +5,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
-const isFipsEnabled = crypto.getFips();
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const isFipsEnabled = crypto.getFips() === 1;
+const fips3 = hasFIPS(3);
 
 function testCipher1(key, iv) {
   // Test encryption and decryption with explicit key and iv
@@ -84,12 +85,92 @@ function testCipher3(key, iv) {
          `encryption/decryption with key ${key} and iv ${iv}`);
 }
 
+function testSm4Xts() {
+  const aesKey = Buffer.alloc(16);
+  const aesIv = Buffer.alloc(16);
+  for (const create of [crypto.createCipheriv, crypto.createDecipheriv]) {
+    for (const xtsStandard of ['gb', 'IEEE-1619', '']) {
+      assert.throws(
+        () => create('aes-128-cbc', aesKey, aesIv, { xtsStandard }),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+    }
+    for (const xtsStandard of [1, true, {}]) {
+      assert.throws(
+        () => create('aes-128-cbc', aesKey, aesIv, { xtsStandard }),
+        { code: 'ERR_INVALID_ARG_TYPE' });
+    }
+    assert.throws(
+      () => create('aes-128-cbc', aesKey, aesIv, { xtsStandard: 'GB' }),
+      { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+  }
+
+  if (!crypto.getCiphers().includes('sm4-xts')) {
+    common.printSkipMessage('unsupported sm4-xts test');
+    return;
+  }
+
+  // GB/T 17964-2021
+  const key = Buffer.from(
+    '2B7E151628AED2A6ABF7158809CF4F3C' +
+    '000102030405060708090A0B0C0D0E0F', 'hex');
+  const iv = Buffer.from('F0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF', 'hex');
+  const plaintext = Buffer.from(
+    '6BC1BEE22E409F96E93D7E117393172A' +
+    'AE2D8A571E03AC9C9EB76FAC45AF8E51' +
+    '30C81C46A35CE411E5FBC1191A0A52EF' +
+    'F69F2445DF4F9B17', 'hex');
+  const vectors = [
+    {
+      options: undefined,
+      ciphertext: Buffer.from(
+        'E9538251C71D7B80BBE4483FEF497BD1' +
+        '2C5C581BD6242FC51E08964FB4F60FDB' +
+        '0BA42F63499279213D318D2C11F6886E' +
+        '903BE7F93A1B3479', 'hex'),
+    },
+    {
+      options: { xtsStandard: 'GB' },
+      ciphertext: Buffer.from(
+        'E9538251C71D7B80BBE4483FEF497BD1' +
+        '2C5C581BD6242FC51E08964FB4F60FDB' +
+        '0BA42F63499279213D318D2C11F6886E' +
+        '903BE7F93A1B3479', 'hex'),
+    },
+    {
+      options: { xtsStandard: 'IEEE' },
+      ciphertext: Buffer.from(
+        'E9538251C71D7B80BBE4483FEF497BD1' +
+        'B3DB1A3E60408C575D63FF7DB39F8326' +
+        '0869F9E2585FEC9F0B863BF8FD784B86' +
+        '27D16C0DB6D2CFC7', 'hex'),
+    },
+  ];
+
+  for (const { options, ciphertext } of vectors) {
+    const cipher = crypto.createCipheriv('sm4-xts', key, iv, options);
+    const encrypted = Buffer.concat([
+      cipher.update(plaintext),
+      cipher.final(),
+    ]);
+    assert.deepStrictEqual(encrypted, ciphertext);
+
+    const decipher = crypto.createDecipheriv('sm4-xts', key, iv, options);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final(),
+    ]);
+    assert.deepStrictEqual(decrypted, plaintext);
+  }
+}
+
 {
   const Cipheriv = crypto.Cipheriv;
-  const key = '123456789012345678901234';
-  const iv = '12345678';
+  const algorithm = fips3 ? 'aes-128-cbc' : 'des-ede3-cbc';
+  const key = fips3 ?
+    '1234567890123456' : '123456789012345678901234';
+  const iv = fips3 ? '1234567890123456' : '12345678';
 
-  const instance = Cipheriv('des-ede3-cbc', key, iv);
+  const instance = Cipheriv(algorithm, key, iv);
   assert(instance instanceof Cipheriv, 'Cipheriv is expected to return a new ' +
                                        'instance when called without `new`');
 
@@ -119,10 +200,12 @@ function testCipher3(key, iv) {
 
 {
   const Decipheriv = crypto.Decipheriv;
-  const key = '123456789012345678901234';
-  const iv = '12345678';
+  const algorithm = fips3 ? 'aes-128-cbc' : 'des-ede3-cbc';
+  const key = fips3 ?
+    '1234567890123456' : '123456789012345678901234';
+  const iv = fips3 ? '1234567890123456' : '12345678';
 
-  const instance = Decipheriv('des-ede3-cbc', key, iv);
+  const instance = Decipheriv(algorithm, key, iv);
   assert(instance instanceof Decipheriv, 'Decipheriv expected to return a new' +
                                          ' instance when called without `new`');
 
@@ -153,13 +236,16 @@ function testCipher3(key, iv) {
 testCipher1('0123456789abcd0123456789', '12345678');
 testCipher1('0123456789abcd0123456789', Buffer.from('12345678'));
 testCipher1(Buffer.from('0123456789abcd0123456789'), '12345678');
-testCipher1(Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
-testCipher2(Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
+testCipher1(
+  Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
+testCipher2(
+  Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
 
 if (!isFipsEnabled) {
   testCipher3(Buffer.from('000102030405060708090A0B0C0D0E0F', 'hex'),
               Buffer.from('A6A6A6A6A6A6A6A6', 'hex'));
 }
+testSm4Xts();
 
 // Zero-sized IV or null should be accepted in ECB mode.
 crypto.createCipheriv('aes-128-ecb', Buffer.alloc(16), Buffer.alloc(0));
@@ -207,8 +293,8 @@ assert.throws(
   errMessage);
 
 // But all other IV lengths should be accepted.
-const minIvLength = hasOpenSSL3 ? 8 : 1;
-const maxIvLength = hasOpenSSL3 ? 64 : 256;
+const minIvLength = hasOpenSSL(3) ? 8 : 1;
+const maxIvLength = hasOpenSSL(3) ? 64 : 256;
 for (let n = minIvLength; n < maxIvLength; n += 1) {
   if (isFipsEnabled && n < 12) continue;
   crypto.createCipheriv('aes-128-gcm', Buffer.alloc(16), Buffer.alloc(n));
diff --git a/test/parallel/test-crypto-cipheriv-xts.js b/test/parallel/test-crypto-cipheriv-xts.js
new file mode 100644
index 000000000000..236ff578f8f8
--- /dev/null
+++ b/test/parallel/test-crypto-cipheriv-xts.js
@@ -0,0 +1,71 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createCipheriv,
+  createDecipheriv,
+  getCiphers,
+} = require('crypto');
+
+const iv = Buffer.from('f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff', 'hex');
+const plaintext = Buffer.from(
+  '000102030405060708090a0b0c0d0e0f10', 'hex');
+const cases = [
+  {
+    algorithm: 'aes-128-xts',
+    key: Buffer.from(
+      '000102030405060708090a0b0c0d0e0f' +
+      '101112131415161718191a1b1c1d1e1f', 'hex'),
+  },
+  {
+    algorithm: 'sm4-xts',
+    key: Buffer.from(
+      '2b7e151628aed2a6abf7158809cf4f3c' +
+      '000102030405060708090a0b0c0d0e0f', 'hex'),
+  },
+];
+
+for (const { algorithm, key } of cases) {
+  if (!getCiphers().includes(algorithm)) {
+    common.printSkipMessage(`unsupported ${algorithm} test`);
+    continue;
+  }
+
+  const cipher = createCipheriv(algorithm, key, iv);
+  const ciphertext = cipher.update(plaintext);
+  assert.strictEqual(ciphertext.length, plaintext.length);
+  assert.deepStrictEqual(cipher.final(), Buffer.alloc(0));
+
+  const decipher = createDecipheriv(algorithm, key, iv);
+  assert.deepStrictEqual(decipher.update(ciphertext), plaintext);
+  assert.deepStrictEqual(decipher.final(), Buffer.alloc(0));
+
+  for (const [create, input, expected] of [
+    [createCipheriv, plaintext, ciphertext],
+    [createDecipheriv, ciphertext, plaintext],
+  ]) {
+    const withoutUpdate = create(algorithm, key, iv);
+    assert.throws(() => withoutUpdate.final(), /Unsupported state/);
+
+    const failedUpdate = create(algorithm, key, iv);
+    assert.throws(() => failedUpdate.update(Buffer.alloc(15)),
+                  /Trying to add data in unsupported state/);
+    assert.throws(() => failedUpdate.final(), /Unsupported state/);
+
+    const retry = create(algorithm, key, iv);
+    assert.throws(() => retry.update(Buffer.alloc(15)),
+                  /Trying to add data in unsupported state/);
+    assert.deepStrictEqual(retry.update(input), expected);
+    assert.deepStrictEqual(retry.final(), Buffer.alloc(0));
+
+    const oneUpdate = create(algorithm, key, iv);
+    assert.deepStrictEqual(oneUpdate.update(input), expected);
+    assert.throws(() => oneUpdate.update(Buffer.alloc(16)),
+                  /Trying to add data in unsupported state/);
+    assert.deepStrictEqual(oneUpdate.final(), Buffer.alloc(0));
+  }
+}
diff --git a/test/parallel/test-crypto-classes.js b/test/parallel/test-crypto-classes.js
index 429bc91d4412..48d68c93fb62 100644
--- a/test/parallel/test-crypto-classes.js
+++ b/test/parallel/test-crypto-classes.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 // 'ClassName' : ['args', 'for', 'constructor']
 const TEST_CASES = {
@@ -21,8 +21,17 @@ const TEST_CASES = {
   'ECDH': ['prime256v1'],
 };
 
-if (!crypto.getFips()) {
-  TEST_CASES.DiffieHellman = [hasOpenSSL3 ? 1024 : 256];
+if (hasFIPS(3)) {
+  TEST_CASES.Hmac = ['sha1', '0123456789abcdef'];
+  TEST_CASES.Cipheriv = [
+    'aes-128-cbc', '0123456789abcdef', '1234567890abcdef'];
+  TEST_CASES.Decipheriv = TEST_CASES.Cipheriv;
+  TEST_CASES.Sign = ['RSA-SHA256'];
+  TEST_CASES.Verify = ['RSA-SHA256'];
+  TEST_CASES.DiffieHellman = [2048];
+  TEST_CASES.DiffieHellmanGroup = ['modp14'];
+} else if (crypto.getFips() !== 1) {
+  TEST_CASES.DiffieHellman = [hasOpenSSL(3) ? 1024 : 256];
 }
 
 for (const [clazz, args] of Object.entries(TEST_CASES)) {
diff --git a/test/parallel/test-crypto-dh-constructor.js b/test/parallel/test-crypto-dh-constructor.js
index eb8674932484..edf7ab08e44c 100644
--- a/test/parallel/test-crypto-dh-constructor.js
+++ b/test/parallel/test-crypto-dh-constructor.js
@@ -5,23 +5,21 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasFIPS } = require('../common/crypto');
 
-const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
-const dh1 = crypto.createDiffieHellman(size);
-const p1 = dh1.getPrime('buffer');
+const prime = crypto.getDiffieHellman('modp14').getPrime('buffer');
 
 {
   const DiffieHellman = crypto.DiffieHellman;
 
-  const dh = DiffieHellman(p1, 'buffer');
+  const dh = DiffieHellman(prime, 'buffer');
   assert(dh instanceof DiffieHellman, 'DiffieHellman is expected to return a ' +
                                       'new instance when called without `new`');
 }
 
 {
   const DiffieHellmanGroup = crypto.DiffieHellmanGroup;
-  const dhg = DiffieHellmanGroup('modp5');
+  const dhg = DiffieHellmanGroup(hasFIPS(3) ? 'modp14' : 'modp5');
   assert(dhg instanceof DiffieHellmanGroup, 'DiffieHellmanGroup is expected ' +
                                             'to return a new instance when ' +
                                             'called without `new`');
diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js
index c0d9f1b5c425..f965aa53d86c 100644
--- a/test/parallel/test-crypto-dh-curves.js
+++ b/test/parallel/test-crypto-dh-curves.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const {
   DH_CHECK_P_NOT_PRIME,
   DH_CHECK_P_NOT_SAFE_PRIME,
@@ -21,7 +21,7 @@ const p = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' +
           'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF';
 crypto.createDiffieHellman(p, 'hex');
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const notPrime = Buffer.from(p, 'hex');
   notPrime[notPrime.length - 1] = 0xfd;
   assert.strictEqual(
@@ -63,7 +63,7 @@ assert.throws(
   });
 
 // Confirm DH_check() results are exposed for optional examination.
-const bad_dh = process.features.openssl_is_boringssl ?
+const bad_dh = isBoringSSL ?
   crypto.createDiffieHellman('abcd', 'hex', 0) :
   crypto.createDiffieHellman('02', 'hex');
 assert.notStrictEqual(bad_dh.verifyError, 0);
@@ -77,7 +77,7 @@ if (hasOpenSSL(3)) {
     () => crypto.createDiffieHellman(Buffer.from(p, 'hex'),
                                      Buffer.from(p, 'hex')),
     { code: 'ERR_OSSL_DH_BAD_GENERATOR' });
-} else if (!process.features.openssl_is_boringssl) {
+} else if (!isBoringSSL) {
   assert.strictEqual(
     crypto.createDiffieHellman(Buffer.from(p, 'hex'),
                                Buffer.from(p, 'hex')).verifyError,
@@ -123,112 +123,126 @@ if (availableCurves.has('prime256v1') && availableCurves.has('secp256k1')) {
 
   // ECDH should check that point is on curve
   const ecdh3 = crypto.createECDH('secp256k1');
-  const key3 = ecdh3.generateKeys();
-
-  assert.throws(
-    () => ecdh2.computeSecret(key3, 'latin1', 'buffer'),
-    {
-      code: 'ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY',
-      name: 'Error',
-      message: 'Public key is not valid for specified curve'
+  if (hasFIPS(3)) {
+    assert.throws(() => ecdh3.generateKeys(), {
+      code: 'ERR_CRYPTO_OPERATION_FAILED',
     });
+  } else {
+    const key3 = ecdh3.generateKeys();
 
-  // ECDH should allow .setPrivateKey()/.setPublicKey()
-  const ecdh4 = crypto.createECDH('prime256v1');
+    assert.throws(
+      () => ecdh2.computeSecret(key3, 'latin1', 'buffer'),
+      {
+        code: 'ERR_CRYPTO_ECDH_INVALID_PUBLIC_KEY',
+        name: 'Error',
+        message: 'Public key is not valid for specified curve'
+      });
 
-  ecdh4.setPrivateKey(ecdh1.getPrivateKey());
-  ecdh4.setPublicKey(ecdh1.getPublicKey());
+    // ECDH should allow .setPrivateKey()/.setPublicKey()
+    const ecdh4 = crypto.createECDH('prime256v1');
 
-  assert.throws(() => {
-    ecdh4.setPublicKey(ecdh3.getPublicKey());
-  }, { message: 'Failed to convert Buffer to EC_POINT' });
+    ecdh4.setPrivateKey(ecdh1.getPrivateKey());
+    ecdh4.setPublicKey(ecdh1.getPublicKey());
 
-  // Verify that we can use ECDH without having to use newly generated keys.
-  const ecdh5 = crypto.createECDH('secp256k1');
+    const ecdh4Secret = ecdh4.computeSecret(ecdh2.getPublicKey());
+    assert.deepStrictEqual(ecdh4.computeSecret(ecdh2.getPublicKey()),
+                           ecdh4Secret);
 
-  // Verify errors are thrown when retrieving keys from an uninitialized object.
-  assert.throws(() => {
-    ecdh5.getPublicKey();
-  }, /^Error: Failed to get ECDH public key$/);
+    assert.throws(() => {
+      ecdh4.setPublicKey(ecdh3.getPublicKey());
+    }, { message: 'Failed to convert Buffer to EC_POINT' });
+    assert.deepStrictEqual(ecdh4.computeSecret(ecdh2.getPublicKey()),
+                           ecdh4Secret);
 
-  assert.throws(() => {
-    ecdh5.getPrivateKey();
-  }, /^Error: Failed to get ECDH private key$/);
+    // Verify that we can use ECDH without having to use newly generated keys.
+    const ecdh5 = crypto.createECDH('secp256k1');
 
-  // A valid private key for the secp256k1 curve.
-  const cafebabeKey = 'cafebabe'.repeat(8);
-  // Associated compressed and uncompressed public keys (points).
-  const cafebabePubPtComp =
+    // Verify errors are thrown when retrieving keys from an uninitialized object.
+    assert.throws(() => {
+      ecdh5.getPublicKey();
+    }, /^Error: Failed to get ECDH public key$/);
+
+    assert.throws(() => {
+      ecdh5.getPrivateKey();
+    }, /^Error: Failed to get ECDH private key$/);
+
+    // A valid private key for the secp256k1 curve.
+    const cafebabeKey = 'cafebabe'.repeat(8);
+    // Associated compressed and uncompressed public keys (points).
+    const cafebabePubPtComp =
   '03672a31bfc59d3f04548ec9b7daeeba2f61814e8ccc40448045007f5479f693a3';
-  const cafebabePubPtUnComp =
+    const cafebabePubPtUnComp =
   '04672a31bfc59d3f04548ec9b7daeeba2f61814e8ccc40448045007f5479f693a3' +
   '2e02c7f93d13dc2732b760ca377a5897b9dd41a1c1b29dc0442fdce6d0a04d1d';
-  ecdh5.setPrivateKey(cafebabeKey, 'hex');
-  assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
-  // Show that the public point (key) is generated while setting the
-  // private key.
-  assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
-
-  // Compressed and uncompressed public points/keys for other party's
-  // private key.
-  // 0xDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF
-  const peerPubPtComp =
+    ecdh5.setPrivateKey(cafebabeKey, 'hex');
+    assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
+    // Show that the public point (key) is generated while setting the
+    // private key.
+    assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
+
+    // Compressed and uncompressed public points/keys for other party's
+    // private key.
+    // 0xDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF
+    const peerPubPtComp =
   '02c6b754b20826eb925e052ee2c25285b162b51fdca732bcf67e39d647fb6830ae';
-  const peerPubPtUnComp =
+    const peerPubPtUnComp =
   '04c6b754b20826eb925e052ee2c25285b162b51fdca732bcf67e39d647fb6830ae' +
   'b651944a574a362082a77e3f2b5d9223eb54d7f2f76846522bf75f3bedb8178e';
 
-  const sharedSecret =
+    const sharedSecret =
   '1da220b5329bbe8bfd19ceef5a5898593f411a6f12ea40f2a8eead9a5cf59970';
 
-  assert.strictEqual(ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex'),
-                     sharedSecret);
-  assert.strictEqual(ecdh5.computeSecret(peerPubPtUnComp, 'hex', 'hex'),
-                     sharedSecret);
-
-  // Verify that we still have the same key pair as before the computation.
-  assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
-  assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
+    assert.strictEqual(ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex'),
+                       sharedSecret);
+    assert.strictEqual(ecdh5.computeSecret(peerPubPtUnComp, 'hex', 'hex'),
+                       sharedSecret);
+    assert.strictEqual(ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex'),
+                       sharedSecret);
 
-  // Verify setting and getting compressed and non-compressed serializations.
-  ecdh5.setPublicKey(cafebabePubPtComp, 'hex');
-  assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
-  assert.strictEqual(
-    ecdh5.getPublicKey('hex', 'compressed'),
-    cafebabePubPtComp
-  );
-  ecdh5.setPublicKey(cafebabePubPtUnComp, 'hex');
-  assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
-  assert.strictEqual(
-    ecdh5.getPublicKey('hex', 'compressed'),
-    cafebabePubPtComp
-  );
-
-  // Show why allowing the public key to be set on this type
-  // does not make sense.
-  ecdh5.setPublicKey(peerPubPtComp, 'hex');
-  assert.strictEqual(ecdh5.getPublicKey('hex'), peerPubPtUnComp);
-  assert.throws(() => {
-    // Error because the public key does not match the private key anymore.
-    ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex');
-  }, /Invalid key pair/);
-
-  // Set to a valid key to show that later attempts to set an invalid key are
-  // rejected.
-  ecdh5.setPrivateKey(cafebabeKey, 'hex');
-
-  // Some invalid private keys for the secp256k1 curve.
-  const errMessage = /Private key is not valid for specified curve/;
-  ['0000000000000000000000000000000000000000000000000000000000000000',
-   'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141',
-   'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF',
-  ].forEach((element) => {
-    assert.throws(() => {
-      ecdh5.setPrivateKey(element, 'hex');
-    }, errMessage);
-    // Verify object state did not change.
+    // Verify that we still have the same key pair as before the computation.
     assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
-  });
+    assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
+
+    // Verify setting and getting compressed and non-compressed serializations.
+    ecdh5.setPublicKey(cafebabePubPtComp, 'hex');
+    assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
+    assert.strictEqual(
+      ecdh5.getPublicKey('hex', 'compressed'),
+      cafebabePubPtComp
+    );
+    ecdh5.setPublicKey(cafebabePubPtUnComp, 'hex');
+    assert.strictEqual(ecdh5.getPublicKey('hex'), cafebabePubPtUnComp);
+    assert.strictEqual(
+      ecdh5.getPublicKey('hex', 'compressed'),
+      cafebabePubPtComp
+    );
+
+    // Show why allowing the public key to be set on this type
+    // does not make sense.
+    ecdh5.setPublicKey(peerPubPtComp, 'hex');
+    assert.strictEqual(ecdh5.getPublicKey('hex'), peerPubPtUnComp);
+    assert.throws(() => {
+    // Error because the public key does not match the private key anymore.
+      ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex');
+    }, /Invalid key pair/);
+
+    // Set to a valid key to show that later attempts to set an invalid key are
+    // rejected.
+    ecdh5.setPrivateKey(cafebabeKey, 'hex');
+
+    // Some invalid private keys for the secp256k1 curve.
+    const errMessage = /Private key is not valid for specified curve/;
+    ['0000000000000000000000000000000000000000000000000000000000000000',
+     'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141',
+     'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF',
+    ].forEach((element) => {
+      assert.throws(() => {
+        ecdh5.setPrivateKey(element, 'hex');
+      }, errMessage);
+      // Verify object state did not change.
+      assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
+    });
+  }
 }
 
 // Use of invalid keys was not cleaning up ERR stack, and was causing
@@ -254,3 +268,31 @@ if (availableCurves.has('prime256v1') && availableHashes.has('sha256')) {
     '-----END EC PRIVATE KEY-----';
   crypto.createSign('SHA256').sign(ecPrivateKey);
 }
+
+if (crypto.getFips() && hasOpenSSL(3) && availableCurves.has('secp256k1')) {
+  const originalFips = crypto.getFips();
+
+  try {
+    crypto.setFips(0);
+    const local = crypto.createECDH('secp256k1');
+    const peer = crypto.createECDH('secp256k1');
+    local.generateKeys();
+    const peerPublicKey = peer.generateKeys();
+
+    local.computeSecret(peerPublicKey);
+    crypto.setFips(1);
+    assert.throws(() => local.computeSecret(peerPublicKey), {
+      code: 'ERR_CRYPTO_INVALID_KEYPAIR',
+      name: 'RangeError',
+    });
+
+    const installed = crypto.createECDH('secp256k1');
+    installed.setPrivateKey(Buffer.from('cafebabe'.repeat(8), 'hex'));
+    assert.throws(() => installed.computeSecret(peerPublicKey), {
+      code: 'ERR_CRYPTO_INVALID_KEYPAIR',
+      name: 'RangeError',
+    });
+  } finally {
+    crypto.setFips(originalFips);
+  }
+}
diff --git a/test/parallel/test-crypto-dh-errors.js b/test/parallel/test-crypto-dh-errors.js
index d7527d82617e..398d2e2c0f72 100644
--- a/test/parallel/test-crypto-dh-errors.js
+++ b/test/parallel/test-crypto-dh-errors.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 // https://github.com/nodejs/node/issues/32738
 // XXX(bnoordhuis) validateInt32() throwing ERR_OUT_OF_RANGE and RangeError
@@ -25,7 +25,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), {
 });
 
 for (const bits of [-1, 0, 1]) {
-  if (hasOpenSSL3) {
+  if (hasOpenSSL(3)) {
     assert.throws(() => crypto.createDiffieHellman(bits), {
       code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL',
       name: 'Error',
diff --git a/test/parallel/test-crypto-dh-generate-keys.js b/test/parallel/test-crypto-dh-generate-keys.js
index acf7e2d09b2b..65efb369c08e 100644
--- a/test/parallel/test-crypto-dh-generate-keys.js
+++ b/test/parallel/test-crypto-dh-generate-keys.js
@@ -6,10 +6,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
 
 {
-  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
+  const prime = crypto.getDiffieHellman('modp14').getPrime();
 
   function unlessInvalidState(f) {
     try {
@@ -22,7 +21,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
   }
 
   function testGenerateKeysChangesKeys(setup, expected) {
-    const dh = crypto.createDiffieHellman(size);
+    const dh = crypto.createDiffieHellman(prime);
     setup(dh);
     const firstPublicKey = unlessInvalidState(() => dh.getPublicKey());
     const firstPrivateKey = unlessInvalidState(() => dh.getPrivateKey());
diff --git a/test/parallel/test-crypto-dh-group-setters.js b/test/parallel/test-crypto-dh-group-setters.js
index 37d0a44d0e1e..ccc370e2352d 100644
--- a/test/parallel/test-crypto-dh-group-setters.js
+++ b/test/parallel/test-crypto-dh-group-setters.js
@@ -1,12 +1,14 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
 const crypto = require('crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
diff --git a/test/parallel/test-crypto-dh-leak.js b/test/parallel/test-crypto-dh-leak.js
index df1ba89737c6..f58a5a152b78 100644
--- a/test/parallel/test-crypto-dh-leak.js
+++ b/test/parallel/test-crypto-dh-leak.js
@@ -9,12 +9,11 @@ if (common.isASan)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
 
 const before = process.memoryUsage.rss();
 {
-  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
-  const dh = crypto.createDiffieHellman(size);
+  const prime = crypto.getDiffieHellman('modp14').getPrime();
+  const dh = crypto.createDiffieHellman(prime);
   const publicKey = dh.generateKeys();
   const privateKey = dh.getPrivateKey();
   for (let i = 0; i < 5e4; i += 1) {
diff --git a/test/parallel/test-crypto-dh-modp2-views.js b/test/parallel/test-crypto-dh-modp2-views.js
index a28e615b7f35..ce2d8823beec 100644
--- a/test/parallel/test-crypto-dh-modp2-views.js
+++ b/test/parallel/test-crypto-dh-modp2-views.js
@@ -5,24 +5,30 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { modp2buf } = require('../common/crypto');
+const { hasFIPS, modp2buf, isBoringSSL } = require('../common/crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
-const modp2 = crypto.createDiffieHellmanGroup('modp2');
+if (hasFIPS(3)) {
+  assert.throws(() => crypto.createDiffieHellman(1024), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+} else {
+  const modp2 = crypto.createDiffieHellmanGroup('modp2');
 
-const views = common.getArrayBufferViews(modp2buf);
-for (const buf of [modp2buf, ...views]) {
-  // Ensure specific generator (string with encoding) works as expected with
-  // any ArrayBufferViews as the first argument to createDiffieHellman().
-  const exmodp2 = crypto.createDiffieHellman(buf, '02', 'hex');
-  modp2.generateKeys();
-  exmodp2.generateKeys();
-  const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
-      .toString('hex');
-  const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
-      .toString('hex');
-  assert.strictEqual(modp2Secret, exmodp2Secret);
+  const views = common.getArrayBufferViews(modp2buf);
+  for (const buf of [modp2buf, ...views]) {
+    // Ensure specific generator (string with encoding) works as expected with
+    // any ArrayBufferViews as the first argument to createDiffieHellman().
+    const exmodp2 = crypto.createDiffieHellman(buf, '02', 'hex');
+    modp2.generateKeys();
+    exmodp2.generateKeys();
+    const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
+        .toString('hex');
+    const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
+        .toString('hex');
+    assert.strictEqual(modp2Secret, exmodp2Secret);
+  }
 }
diff --git a/test/parallel/test-crypto-dh-modp2.js b/test/parallel/test-crypto-dh-modp2.js
index eb262f235ff3..a0ec31a1eb4f 100644
--- a/test/parallel/test-crypto-dh-modp2.js
+++ b/test/parallel/test-crypto-dh-modp2.js
@@ -5,44 +5,51 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { modp2buf } = require('../common/crypto');
+const { hasFIPS, modp2buf, isBoringSSL } = require('../common/crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
-const modp2 = crypto.createDiffieHellmanGroup('modp2');
+if (hasFIPS(3)) {
+  assert.throws(() => crypto.createDiffieHellman(1024), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+} else {
+  const modp2 = crypto.createDiffieHellmanGroup('modp2');
 
-{
+  {
   // Ensure specific generator (buffer) works as expected.
-  const exmodp2 = crypto.createDiffieHellman(modp2buf, Buffer.from([2]));
-  modp2.generateKeys();
-  exmodp2.generateKeys();
-  const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
+    const exmodp2 = crypto.createDiffieHellman(modp2buf, Buffer.from([2]));
+    modp2.generateKeys();
+    exmodp2.generateKeys();
+    const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
       .toString('hex');
-  const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
+    const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
       .toString('hex');
-  assert.strictEqual(modp2Secret, exmodp2Secret);
-}
+    assert.strictEqual(modp2Secret, exmodp2Secret);
+  }
 
-{
+  {
   // Ensure specific generator (string without encoding) works as expected.
-  const exmodp2 = crypto.createDiffieHellman(modp2buf, '\x02');
-  exmodp2.generateKeys();
-  const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
+    const exmodp2 = crypto.createDiffieHellman(modp2buf, '\x02');
+    exmodp2.generateKeys();
+    const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
       .toString('hex');
-  const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
+    const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
       .toString('hex');
-  assert.strictEqual(modp2Secret, exmodp2Secret);
-}
+    assert.strictEqual(modp2Secret, exmodp2Secret);
+  }
 
-{
+  {
   // Ensure specific generator (numeric) works as expected.
-  const exmodp2 = crypto.createDiffieHellman(modp2buf, 2);
-  exmodp2.generateKeys();
-  const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
+    const exmodp2 = crypto.createDiffieHellman(modp2buf, 2);
+    exmodp2.generateKeys();
+    const modp2Secret = modp2.computeSecret(exmodp2.getPublicKey())
       .toString('hex');
-  const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
+    const exmodp2Secret = exmodp2.computeSecret(modp2.getPublicKey())
       .toString('hex');
-  assert.strictEqual(modp2Secret, exmodp2Secret);
+    assert.strictEqual(modp2Secret, exmodp2Secret);
+  }
+
 }
diff --git a/test/parallel/test-crypto-dh-odd-key.js b/test/parallel/test-crypto-dh-odd-key.js
index fbe42be425ed..c96227770e3d 100644
--- a/test/parallel/test-crypto-dh-odd-key.js
+++ b/test/parallel/test-crypto-dh-odd-key.js
@@ -27,19 +27,24 @@ if (!common.hasCrypto) {
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 function test() {
   const odd = Buffer.alloc(39, 'A');
 
-  const c = crypto.createDiffieHellman(hasOpenSSL3 ? 1024 : 32);
+  const size = hasFIPS(3) ? 2048 : (hasOpenSSL(3) ? 1024 : 32);
+  const c = crypto.createDiffieHellman(size);
   c.setPrivateKey(odd);
   c.generateKeys();
 }
 
-// FIPS requires a length of at least 1024
-if (!crypto.getFips()) {
+if (hasFIPS(3)) {
+  test();
+  assert.throws(() => crypto.createDiffieHellman(1024), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+} else if (crypto.getFips() !== 1) {
   test();
 } else {
-  assert.throws(function() { test(); }, /key size too small/);
+  assert.throws(test, /key size too small/);
 }
diff --git a/test/parallel/test-crypto-dh-shared.js b/test/parallel/test-crypto-dh-shared.js
index 515405034d76..5e6db278324d 100644
--- a/test/parallel/test-crypto-dh-shared.js
+++ b/test/parallel/test-crypto-dh-shared.js
@@ -5,9 +5,11 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
-const alice = crypto.createDiffieHellmanGroup('modp5');
-const bob = crypto.createDiffieHellmanGroup('modp5');
+const group = hasFIPS(3) ? 'modp14' : 'modp5';
+const alice = crypto.createDiffieHellmanGroup(group);
+const bob = crypto.createDiffieHellmanGroup(group);
 alice.generateKeys();
 bob.generateKeys();
 const aSecret = alice.computeSecret(bob.getPublicKey()).toString('hex');
diff --git a/test/parallel/test-crypto-dh-stateless.js b/test/parallel/test-crypto-dh-stateless.js
index 2fddaddd2f44..a86b6934f6cf 100644
--- a/test/parallel/test-crypto-dh-stateless.js
+++ b/test/parallel/test-crypto-dh-stateless.js
@@ -5,8 +5,11 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
-const isBoringSSL = process.features.openssl_is_boringssl;
+const {
+  hasOpenSSL,
+  isBoringSSL: commonIsBoringSSL,
+} = require('../common/crypto');
+const isBoringSSL = commonIsBoringSSL;
 
 // Error code for a key-type mismatch during (EC)DH. The underlying OpenSSL
 // error code varies by version, and in OpenSSL 4.0 by platform: some builds
diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
index 01a7f0f3ddd8..7b9a9d50d890 100644
--- a/test/parallel/test-crypto-dh.js
+++ b/test/parallel/test-crypto-dh.js
@@ -7,11 +7,14 @@ if (!common.hasCrypto) {
 const assert = require('assert');
 const crypto = require('crypto');
 const {
-  hasOpenSSL3,
+  hasOpenSSL,
+  hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 
 {
-  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
+  const size = hasFIPS(3) ?
+    2048 : (crypto.getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
   const dh1 = crypto.createDiffieHellman(size);
   const p1 = dh1.getPrime('buffer');
   const dh2 = crypto.createDiffieHellman(p1, 'buffer');
@@ -57,7 +60,7 @@ const {
   assert.strictEqual(secret1, secret4);
 
   let wrongBlockLength;
-  if (hasOpenSSL3) {
+  if (hasOpenSSL(3)) {
     wrongBlockLength = {
       message: /wrong[\s_]final[\s_]block[\s_]length/i,
       code: /ERR_OSSL_(EVP_)?WRONG_FINAL_BLOCK_LENGTH/,
@@ -98,7 +101,7 @@ const {
 // Through a fluke of history, g=0 defaults to DH_GENERATOR (2).
 {
   const g = 0;
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     assert.throws(() => crypto.createDiffieHellman('abcdef', g), {
       code: 'ERR_CRYPTO_OPERATION_FAILED',
       name: 'Error'
@@ -110,7 +113,7 @@ const {
 }
 
 {
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     assert.throws(() => crypto.createDiffieHellman('abcdef', Buffer.from([2])), {
       code: 'ERR_CRYPTO_OPERATION_FAILED',
       name: 'Error'
diff --git a/test/parallel/test-crypto-ecb.js b/test/parallel/test-crypto-ecb.js
index 06c88272438a..65c373d35d25 100644
--- a/test/parallel/test-crypto-ecb.js
+++ b/test/parallel/test-crypto-ecb.js
@@ -25,14 +25,14 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 const crypto = require('crypto');
 
 if (crypto.getFips()) {
   common.skip('BF-ECB is not FIPS 140-2 compatible');
 }
 
-if (hasOpenSSL3) {
+if (hasOpenSSL(3)) {
   common.skip('Blowfish is only available with the legacy provider in ' +
     'OpenSSl 3.x');
 }
diff --git a/test/parallel/test-crypto-ecdh-convert-key.js b/test/parallel/test-crypto-ecdh-convert-key.js
index c0046099df9e..8c910b1b6052 100644
--- a/test/parallel/test-crypto-ecdh-convert-key.js
+++ b/test/parallel/test-crypto-ecdh-convert-key.js
@@ -6,6 +6,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 
 const { ECDH, createSign, getCurves } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // A valid private key for the secp256k1 curve.
 const cafebabeKey = 'cafebabe'.repeat(8);
@@ -93,11 +94,17 @@ if (getCurves().includes('secp256k1')) {
 
   // Compare to getPublicKey.
   const ecdh1 = ECDH('secp256k1');
-  ecdh1.generateKeys();
-  ecdh1.setPrivateKey(cafebabeKey, 'hex');
-  assert.strictEqual(ecdh1.getPublicKey('hex', 'uncompressed'), uncompressed);
-  assert.strictEqual(ecdh1.getPublicKey('hex', 'compressed'), compressed);
-  assert.strictEqual(ecdh1.getPublicKey('hex', 'hybrid'), hybrid);
+  if (hasFIPS(3)) {
+    assert.throws(() => ecdh1.generateKeys(), {
+      code: 'ERR_CRYPTO_OPERATION_FAILED',
+    });
+  } else {
+    ecdh1.generateKeys();
+    ecdh1.setPrivateKey(cafebabeKey, 'hex');
+    assert.strictEqual(ecdh1.getPublicKey('hex', 'uncompressed'), uncompressed);
+    assert.strictEqual(ecdh1.getPublicKey('hex', 'compressed'), compressed);
+    assert.strictEqual(ecdh1.getPublicKey('hex', 'hybrid'), hybrid);
+  }
 }
 
 // See https://github.com/nodejs/node/issues/26133, failed ConvertKey
diff --git a/test/parallel/test-crypto-eddsa-variants.js b/test/parallel/test-crypto-eddsa-variants.js
index 691534f13f5b..10e9fba7e52c 100644
--- a/test/parallel/test-crypto-eddsa-variants.js
+++ b/test/parallel/test-crypto-eddsa-variants.js
@@ -7,6 +7,8 @@ const assert = require('assert');
 const crypto = require('crypto');
 const {
   hasOpenSSL,
+  hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 
 // RFC 8032 Section 7 test vectors for Ed25519, Ed25519ctx, and Ed448.
@@ -179,7 +181,7 @@ function createKeyPair(algorithm, secretKeyHex, publicKeyHex) {
 }
 
 for (const v of vectors) {
-  if (v.algorithm.startsWith('Ed448') && process.features.openssl_is_boringssl) continue;
+  if (v.algorithm.startsWith('Ed448') && isBoringSSL) continue;
   if (v.algorithm.endsWith('ctx') || v.context) {
     if (!hasOpenSSL(3, 2)) continue;
   }
@@ -191,7 +193,18 @@ for (const v of vectors) {
   const signKey = context ? { key: privateKey, context } : privateKey;
   const verifyKey = context ? { key: publicKey, context } : publicKey;
 
-  const sig = crypto.sign(null, message, signKey);
+  let sig;
+  try {
+    sig = crypto.sign(null, message, signKey);
+  } catch (err) {
+    if (!hasFIPS(3) ||
+        (!v.algorithm.endsWith('ctx') && !v.context)) {
+      throw err;
+    }
+    assert.strictEqual(
+      err.code, 'ERR_OSSL_INVALID_EDDSA_INSTANCE_FOR_ATTEMPTED_OPERATION');
+    continue;
+  }
   assert.deepStrictEqual(sig, expectedSig);
   assert.strictEqual(
     crypto.verify(null, message, verifyKey, expectedSig), true);
diff --git a/test/parallel/test-crypto-encap-decap.js b/test/parallel/test-crypto-encap-decap.js
index 4b19d7179440..db93fab32cb0 100644
--- a/test/parallel/test-crypto-encap-decap.js
+++ b/test/parallel/test-crypto-encap-decap.js
@@ -6,10 +6,15 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+  isBoringSSL: commonIsBoringSSL,
+} = require('../common/crypto');
 const { promisify } = require('util');
 
-const isBoringSSL = process.features.openssl_is_boringssl;
+const isBoringSSL = commonIsBoringSSL;
+const isFips = hasFIPS(3);
 
 if (!hasOpenSSL(3) && !isBoringSSL) {
   assert.throws(() => crypto.encapsulate(), { code: 'ERR_CRYPTO_KEM_NOT_SUPPORTED' });
@@ -36,7 +41,7 @@ const keys = {
     privateKey: fixtures.readKey('rsa_pss_private_2048.pem', 'ascii'),
   },
   'p-256': {
-    supported: hasOpenSSL(3, 2), // DHKEM was added in 3.2
+    supported: hasOpenSSL(3, 2) && !isFips, // DHKEM was added in 3.2
     publicKey: fixtures.readKey('ec_p256_public.pem', 'ascii'),
     privateKey: fixtures.readKey('ec_p256_private.pem', 'ascii'),
     sharedSecretLength: 32,
@@ -44,7 +49,7 @@ const keys = {
     raw: true,
   },
   'p-384': {
-    supported: hasOpenSSL(3, 2), // DHKEM was added in 3.2
+    supported: hasOpenSSL(3, 2) && !isFips, // DHKEM was added in 3.2
     publicKey: fixtures.readKey('ec_p384_public.pem', 'ascii'),
     privateKey: fixtures.readKey('ec_p384_private.pem', 'ascii'),
     sharedSecretLength: 48,
@@ -52,7 +57,7 @@ const keys = {
     raw: true,
   },
   'p-521': {
-    supported: hasOpenSSL(3, 2), // DHKEM was added in 3.2
+    supported: hasOpenSSL(3, 2) && !isFips, // DHKEM was added in 3.2
     publicKey: fixtures.readKey('ec_p521_public.pem', 'ascii'),
     privateKey: fixtures.readKey('ec_p521_private.pem', 'ascii'),
     sharedSecretLength: 64,
@@ -65,7 +70,7 @@ const keys = {
     privateKey: fixtures.readKey('ec_secp256k1_private.pem', 'ascii'),
   },
   'x25519': {
-    supported: hasOpenSSL(3, 2), // DHKEM was added in 3.2
+    supported: hasOpenSSL(3, 2) && !isFips, // DHKEM was added in 3.2
     publicKey: fixtures.readKey('x25519_public.pem', 'ascii'),
     privateKey: fixtures.readKey('x25519_private.pem', 'ascii'),
     sharedSecretLength: 32,
@@ -73,7 +78,7 @@ const keys = {
     raw: true,
   },
   'x448': {
-    supported: hasOpenSSL(3, 2), // DHKEM was added in 3.2
+    supported: hasOpenSSL(3, 2) && !isFips, // DHKEM was added in 3.2
     publicKey: fixtures.readKey('x448_public.pem', 'ascii'),
     privateKey: fixtures.readKey('x448_private.pem', 'ascii'),
     sharedSecretLength: 64,
diff --git a/test/parallel/test-crypto-fips-indicator-strict.js b/test/parallel/test-crypto-fips-indicator-strict.js
new file mode 100644
index 000000000000..5e003d7015b2
--- /dev/null
+++ b/test/parallel/test-crypto-fips-indicator-strict.js
@@ -0,0 +1,158 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const {
+  isBoringSSL,
+  hasFIPS,
+  hasOpenSSL,
+} = require('../common/crypto');
+
+if (isBoringSSL) {
+  common.skip('BoringSSL does not support FIPS');
+}
+
+const assert = require('node:assert');
+const diagnosticsChannel = require('node:diagnostics_channel');
+const { once } = require('node:events');
+const { createHmac, subtle } = require('node:crypto');
+const { Worker } = require('node:worker_threads');
+const {
+  spawnSyncAndExitWithoutError,
+} = require('../common/child_process');
+
+const channelName = 'crypto.fips.indicator';
+const mode = process.env.NODE_TEST_FIPS_FORCE_MODE;
+
+if (!hasOpenSSL(3, 4)) {
+  common.skip('OpenSSL 3.4 or later is required');
+} else if (!hasFIPS(3, 4)) {
+  common.skip('an active OpenSSL 3.4+ FIPS provider is required');
+} else if (mode === 'provider') {
+  assertSerializedMode(mode);
+  assert.strictEqual(
+    createHmac('sha256', Buffer.alloc(13)).digest().byteLength, 32);
+} else if (mode === 'strict') {
+  assertSerializedMode(mode);
+  const subscriber = common.mustNotCall();
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  assert.throws(
+    () => createHmac('sha256', Buffer.alloc(13)).digest(),
+    { code: /^ERR_OSSL_/ });
+  setImmediate(common.mustCall(() => {
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+  }));
+} else if (mode === 'strict-events') {
+  assertSerializedMode('strict');
+  testStrictEvents().then(common.mustCall());
+} else {
+  runParent();
+}
+
+function assertSerializedMode(expected) {
+  const { getOptionsAsFlagsFromBinding } = require('internal/options');
+  assert.ok(getOptionsAsFlagsFromBinding().includes(`--force-fips=${expected}`));
+}
+
+function nextIndicator() {
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve } = Promise.withResolvers();
+  const subscriber = common.mustCall((event, name) => {
+    assert.strictEqual(name, channelName);
+    clearInterval(keepAlive);
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+    resolve(event);
+  });
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  return promise;
+}
+
+function runParent() {
+  try {
+    createHmac('sha256', Buffer.alloc(13)).digest();
+  } catch (error) {
+    assert.match(error.code, /^ERR_OSSL_/);
+    common.printSkipMessage(
+      'the FIPS provider rejects unapproved operations before signaling');
+    return;
+  }
+
+  for (const [args, childMode] of [
+    [['--force-fips'], 'provider'],
+    [['--force-fips=provider'], 'provider'],
+    [['--force-fips=strict'], 'strict'],
+    [[
+      '--force-fips=strict',
+      '--enable-fips-indicator-events',
+    ], 'strict-events'],
+  ]) {
+    spawnSyncAndExitWithoutError(
+      process.execPath, [...args, '--expose-internals', __filename], {
+        env: { ...process.env, NODE_TEST_FIPS_FORCE_MODE: childMode },
+      });
+  }
+}
+
+async function testStrictEvents() {
+  const key = Buffer.alloc(13);
+
+  assert.throws(
+    () => createHmac('sha256', key).digest(),
+    { code: /^ERR_OSSL_/ });
+
+  let eventPromise = nextIndicator();
+  assert.throws(
+    () => createHmac('sha256', key).digest(),
+    { code: /^ERR_OSSL_/ });
+  assert.deepStrictEqual(await eventPromise, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: true,
+    count: 1,
+    dropped: 0,
+  });
+
+  const hmacKey = await subtle.importKey(
+    'raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  eventPromise = nextIndicator();
+  await assert.rejects(
+    subtle.sign('HMAC', hmacKey, Buffer.alloc(0)),
+    { name: 'OperationError' });
+  const webCryptoEvent = await eventPromise;
+  assert.strictEqual(webCryptoEvent.operation, 'HMAC');
+  assert.strictEqual(webCryptoEvent.reason, 'keysize');
+  assert.strictEqual(webCryptoEvent.blocked, true);
+
+  eventPromise = nextIndicator();
+  const worker = new Worker(`
+    'use strict';
+    const { createHmac } = require('node:crypto');
+    const { workerData } = require('node:worker_threads');
+    createHmac('sha256', workerData.key).digest();
+  `, {
+    eval: true,
+    workerData: { key },
+  });
+  const errorPromise = once(worker, 'error');
+  const exitPromise = new Promise((resolve) => worker.on('exit', resolve));
+  const [[error], workerEvent] = await Promise.all([
+    errorPromise,
+    eventPromise,
+  ]);
+  assert.match(error.code, /^ERR_OSSL_/);
+  assert.deepStrictEqual(workerEvent, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: true,
+    count: 1,
+    dropped: 0,
+  });
+  const exitCode = await exitPromise;
+  assert.strictEqual(exitCode, 1);
+}
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index 8b2e1c9a3649..ad67ec181c7e 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -4,16 +4,18 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support FIPS');
 
 const assert = require('assert');
 const spawnSync = require('child_process').spawnSync;
 const path = require('path');
+const { spawnSyncAndAssert } = require('../common/child_process');
 const fixtures = require('../common/fixtures');
 const { internalBinding } = require('internal/test/binding');
 const { testFipsCrypto } = internalBinding('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
 
 const FIPS_ENABLED = 1;
 const FIPS_DISABLED = 0;
@@ -22,11 +24,11 @@ const FIPS_ERROR_STRING2 =
   '--force-fips at startup.';
 const FIPS_UNSUPPORTED_ERROR_STRING = 'fips mode not supported';
 const FIPS_ENABLE_ERROR_STRING =
-  hasOpenSSL3 ?
+  hasOpenSSL(3) ?
     '--enable-fips requires an active OpenSSL provider named "fips"' :
     'OpenSSL error when trying to enable FIPS:';
 const FIPS_FORCE_ERROR_STRING =
-  hasOpenSSL3 ?
+  hasOpenSSL(3) ?
     '--force-fips requires an active OpenSSL provider named "fips"' :
     'OpenSSL error when trying to enable FIPS:';
 
@@ -94,6 +96,45 @@ testHelper(
   'require("crypto").getFips()',
   process.env);
 
+// Explicit provider mode should preserve the behavior of bare --force-fips.
+testHelper(
+  testFipsCrypto() ? 'stdout' : 'stderr',
+  ['--force-fips=provider'],
+  testFipsCrypto() ? kNoFailure : kGenericUserError,
+  testFipsCrypto() ? FIPS_ENABLED : FIPS_FORCE_ERROR_STRING,
+  'require("crypto").getFips()',
+  process.env);
+
+{
+  spawnSyncAndAssert(
+    process.execPath, ['--force-fips=invalid', '-e', '0'], {
+      status: 9,
+      stderr: /invalid value for --force-fips; expected 'provider' or 'strict'/,
+    });
+}
+
+if (hasOpenSSL(3, 4)) {
+  testHelper(
+    testFipsCrypto() ? 'stdout' : 'stderr',
+    ['--force-fips=strict'],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
+    testFipsCrypto() ? FIPS_ENABLED : FIPS_FORCE_ERROR_STRING,
+    'require("crypto").getFips()',
+    process.env);
+} else {
+  spawnSyncAndAssert(
+    process.execPath, ['--enable-fips-indicator-events', '-e', '0'], {
+      status: 9,
+      stderr: /--enable-fips-indicator-events requires OpenSSL 3\.4 or later/,
+    });
+
+  spawnSyncAndAssert(
+    process.execPath, ['--force-fips=strict', '-e', '0'], {
+      status: 9,
+      stderr: /--force-fips=strict requires OpenSSL 3\.4 or later/,
+    });
+}
+
 // By default FIPS should be off in both FIPS and non-FIPS builds
 // unless Node.js was configured using --shared-openssl in
 // which case it may be enabled by the system.
@@ -106,7 +147,7 @@ if (!sharedOpenSSL()) {
     'require("crypto").getFips()',
     { ...process.env, 'OPENSSL_CONF': ' ' });
 
-  if (hasOpenSSL3) {
+  if (hasOpenSSL(3)) {
     // Disabling FIPS mode should not throw after OpenSSL updates the default
     // property query.
     testHelper(
@@ -151,7 +192,7 @@ assert.ok(test_result === 1 || test_result === 0);
 // ("Error: Cannot set FIPS mode in a non-FIPS build.").
 // Due to this uncertainty the following tests are skipped when configured
 // with --shared-openssl.
-if (!sharedOpenSSL() && !hasOpenSSL3) {
+if (!sharedOpenSSL() && !hasOpenSSL(3)) {
   // OpenSSL config file should be able to turn on FIPS mode
   testHelper(
     'stdout',
@@ -184,7 +225,7 @@ if (!sharedOpenSSL() && !hasOpenSSL3) {
 // will not work as expected with that version.
 // TODO(danbev) Revisit these test once FIPS support is available in
 // OpenSSL 3.x.
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   testHelper(
     'stdout',
     [`--openssl-config=${CNF_FIPS_OFF}`],
diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js
index d55985aa3c7f..faf45c766c5c 100644
--- a/test/parallel/test-crypto-getcipherinfo.js
+++ b/test/parallel/test-crypto-getcipherinfo.js
@@ -5,9 +5,12 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const {
+  createCipheriv,
+  createHash,
   getCiphers,
-  getCipherInfo
+  getCipherInfo,
 } = require('crypto');
+const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 
@@ -15,18 +18,62 @@ const ciphers = getCiphers();
 
 assert.strictEqual(getCipherInfo(-1), undefined);
 assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined);
+if (hasOpenSSL(3)) {
+  assert.deepStrictEqual(
+    ciphers.filter((cipher) => cipher.includes('cbc-hmac')), []);
+  for (const cipher of [
+    'null',
+    'aes-128-cbc-hmac-sha1',
+    'aes-256-cbc-hmac-sha1',
+    'aes-128-cbc-hmac-sha256',
+    'aes-256-cbc-hmac-sha256',
+    'aes-128-cbc-hmac-sha1-etm',
+    'aes-192-cbc-hmac-sha1-etm',
+    'aes-256-cbc-hmac-sha1-etm',
+    'aes-128-cbc-hmac-sha256-etm',
+    'aes-192-cbc-hmac-sha256-etm',
+    'aes-256-cbc-hmac-sha256-etm',
+    'aes-128-cbc-hmac-sha512-etm',
+    'aes-192-cbc-hmac-sha512-etm',
+    'aes-256-cbc-hmac-sha512-etm',
+  ]) {
+    assert(!ciphers.includes(cipher));
+    assert.strictEqual(getCipherInfo(cipher), undefined);
+    assert.throws(
+      () => createCipheriv(cipher, Buffer.alloc(16), Buffer.alloc(16)), {
+        code: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+      });
+  }
+}
+
+if (ciphers.includes('aes-128-wrap-inv')) {
+  const alias = 'aes128-wrap-inv';
+  assert(ciphers.includes(alias));
+  assert.deepStrictEqual(getCipherInfo(alias),
+                         getCipherInfo('aes-128-wrap-inv'));
+}
+assert(!ciphers.some((cipher) => /^\d+(?:\.\d+)+$/.test(cipher)));
+
+if (!isBoringSSL) {
+  // A failed provider fetch must not contaminate the OpenSSL error queue.
+  assert.throws(() => createHash('sha256', { outputLength: 28 }), {
+    code: 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH',
+  });
+}
 
 for (const cipher of ciphers) {
   const info = getCipherInfo(cipher);
-  if (process.features.openssl_is_boringssl && !info) {
+  if (isBoringSSL && !info) {
     // BoringSSL reports some legacy ciphers in getCiphers() but returns no
     // info for them (e.g. des-ede3, des-ede3-ecb, rc2-40-cbc).
     common.printSkipMessage(`Skipping unsupported ${cipher} test case`);
     continue;
   }
   assert(info);
-  const info2 = getCipherInfo(info.nid);
-  assert.deepStrictEqual(info, info2);
+  if (info.nid !== undefined) {
+    const info2 = getCipherInfo(info.nid);
+    assert.deepStrictEqual(info, info2);
+  }
 }
 
 const info = getCipherInfo('aes-128-cbc');
@@ -68,7 +115,7 @@ assert(getCipherInfo('aes-128-cbc', { ivLength: 16 }));
 
 assert(!getCipherInfo('aes-128-ccm', { ivLength: 1 }));
 assert(!getCipherInfo('aes-128-ccm', { ivLength: 14 }));
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   for (let n = 7; n <= 13; n++)
     assert(getCipherInfo('aes-128-ccm', { ivLength: n }));
 } else {
@@ -76,9 +123,66 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 assert(!getCipherInfo('aes-128-ocb', { ivLength: 16 }));
-if (!process.features.openssl_is_boringssl) {
+if (hasFIPS(3)) {
+  assert.strictEqual(
+    getCipherInfo('aes-128-ocb', { ivLength: 12 }), undefined);
+} else if (!isBoringSSL) {
   for (let n = 1; n < 16; n++)
     assert(getCipherInfo('aes-128-ocb', { ivLength: n }));
 } else {
   common.printSkipMessage('Skipping unsupported aes-128-ocb test cases');
 }
+
+if (ciphers.includes('aes-128-cbc-cts')) {
+  const info = getCipherInfo('aes-128-cbc-cts');
+  assert.strictEqual(info.name, 'aes-128-cbc-cts');
+  assert.strictEqual(info.mode, 'cbc');
+  assert.strictEqual(info.keyLength, 16);
+  assert.strictEqual(info.blockSize, 16);
+  assert.strictEqual(info.ivLength, 16);
+  assert(getCipherInfo('aes-128-cbc-cts', { ivLength: 16 }));
+  assert(!getCipherInfo('aes-128-cbc-cts', { ivLength: 15 }));
+} else {
+  common.printSkipMessage('Skipping unsupported aes-128-cbc-cts test cases');
+}
+
+if (ciphers.includes('aes-128-siv')) {
+  const info = getCipherInfo('aes-128-siv');
+  assert.strictEqual(info.name, 'aes-128-siv');
+  assert.strictEqual(info.mode, 'siv');
+  assert.strictEqual(info.keyLength, 32);
+  assert.strictEqual(info.ivLength, undefined);
+  assert(getCipherInfo('aes-128-siv', { ivLength: 0 }));
+  assert(!getCipherInfo('aes-128-siv', { ivLength: 1 }));
+} else {
+  common.printSkipMessage('Skipping unsupported aes-128-siv test cases');
+}
+
+if (ciphers.includes('aes-128-gcm-siv')) {
+  const info = getCipherInfo('aes-128-gcm-siv');
+  assert.strictEqual(info.name, 'aes-128-gcm-siv');
+  assert.strictEqual(info.mode, 'gcm-siv');
+  assert.strictEqual(info.keyLength, 16);
+  assert.strictEqual(info.ivLength, 12);
+  assert(getCipherInfo('aes-128-gcm-siv', { ivLength: 12 }));
+  assert(!getCipherInfo('aes-128-gcm-siv', { ivLength: 11 }));
+} else {
+  common.printSkipMessage('Skipping unsupported aes-128-gcm-siv test cases');
+}
+
+for (const [name, mode, keyLength, ivLength] of [
+  ['sm4-gcm', 'gcm', 16, 12],
+  ['sm4-ccm', 'ccm', 16, 12],
+  ['sm4-xts', 'xts', 32, 16],
+]) {
+  if (ciphers.includes(name)) {
+    const info = getCipherInfo(name);
+    assert.strictEqual(info.name, name);
+    assert.strictEqual(info.mode, mode);
+    assert.strictEqual(info.nid, undefined);
+    assert.strictEqual(info.keyLength, keyLength);
+    assert.strictEqual(info.ivLength, ivLength);
+  } else {
+    common.printSkipMessage(`Skipping unsupported ${name} test cases`);
+  }
+}
diff --git a/test/parallel/test-crypto-hash-stream-pipe.js b/test/parallel/test-crypto-hash-stream-pipe.js
index ac851646a918..c6b9433456ea 100644
--- a/test/parallel/test-crypto-hash-stream-pipe.js
+++ b/test/parallel/test-crypto-hash-stream-pipe.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
@@ -30,10 +32,10 @@ const crypto = require('crypto');
 
 const stream = require('stream');
 const s = new stream.PassThrough();
-const h = process.features.openssl_is_boringssl ?
+const h = isBoringSSL ?
   crypto.createHash('sha512') :
   crypto.createHash('sha3-512');
-const expect = process.features.openssl_is_boringssl ?
+const expect = isBoringSSL ?
   'fba055c6fd0c5b6645407749ed7a8b41' +
   'b8f629f2163c3ca3701d864adabda1f8' +
   '93c37bf82b22fdd151ba8e357f611da4' +
diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
index 00f2240c8764..94b735256784 100644
--- a/test/parallel/test-crypto-hash.js
+++ b/test/parallel/test-crypto-hash.js
@@ -1,5 +1,7 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
@@ -189,7 +191,7 @@ assert.throws(
 }
 
 // Test XOF hash functions and the outputLength option.
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // Default outputLengths.
   assert.strictEqual(crypto.createHash('shake128').digest('hex'),
                      '7f9c2ba4e88f827d616045507605853e');
diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js
index 242e278707d7..7051c2fae07c 100644
--- a/test/parallel/test-crypto-hkdf.js
+++ b/test/parallel/test-crypto-hkdf.js
@@ -13,7 +13,7 @@ const {
   hkdfSync,
   getHashes
 } = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 {
   assert.throws(() => hkdf(), {
@@ -108,6 +108,23 @@ const { hasOpenSSL3 } = require('../common/crypto');
     code: 'ERR_OUT_OF_RANGE'
   });
 
+  {
+    const info = new Uint8Array(2048);
+    Object.defineProperty(info, 'byteLength', {
+      __proto__: null,
+      get() {
+        return 1;
+      },
+    });
+
+    const calls = [
+      () => hkdf('sha256', 'a', '', info, 10, common.mustNotCall()),
+      () => hkdfSync('sha256', 'a', '', info, 10),
+    ];
+    for (const call of calls)
+      assert.throws(call, { code: 'ERR_OUT_OF_RANGE' });
+  }
+
   assert.throws(
     () => hkdf('sha512', 'a', '', '', 64 * 255 + 1, common.mustNotCall()), {
       code: 'ERR_CRYPTO_INVALID_KEYLEN'
@@ -120,12 +137,12 @@ const { hasOpenSSL3 } = require('../common/crypto');
 }
 
 const algorithms = [
-  ['sha256', 'secret', 'salt', 'info', 10],
+  ['sha256', '0123456789abcdef', '0123456789abcdef', 'info', 10],
   ['sha256', '', '', '', 10],
   ['sha256', '', 'salt', '', 10],
   ['sha512', 'secret', 'salt', '', 15],
 ];
-if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3) && !isBoringSSL)
   algorithms.push(['whirlpool', 'secret', '', 'info', 20]);
 
 algorithms.forEach(([ hash, secret, salt, info, length ]) => {
@@ -216,7 +233,7 @@ algorithms.forEach(([ hash, secret, salt, info, length ]) => {
 });
 
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   const kKnownUnsupported = ['shake128', 'shake256'];
   for (const hash of getHashes()) {
     if (kKnownUnsupported.includes(hash)) continue;
diff --git a/test/parallel/test-crypto-hmac.js b/test/parallel/test-crypto-hmac.js
index 48857c7cf027..ca6a424c5293 100644
--- a/test/parallel/test-crypto-hmac.js
+++ b/test/parallel/test-crypto-hmac.js
@@ -6,6 +6,9 @@ if (!common.hasCrypto) {
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS } = require('../common/crypto');
+
+const fips3 = hasFIPS(3);
 
 {
   const Hmac = crypto.Hmac;
@@ -24,7 +27,7 @@ assert.throws(
 
 // This used to segfault. See: https://github.com/nodejs/node/issues/9819
 assert.throws(
-  () => crypto.createHmac('sha256', 'key').digest({
+  () => crypto.createHmac('sha256', '0123456789abcdef').digest({
     toString: () => { throw new Error('boom'); },
   }),
   {
@@ -40,9 +43,14 @@ assert.throws(
   });
 
 function testHmac(algo, key, data, expected) {
-  // FIPS does not support MD5.
-  if (crypto.getFips() && algo === 'md5')
+  if (crypto.getFips() === 1 && algo === 'md5') {
+    if (fips3) {
+      assert.throws(() => crypto.createHmac(algo, Buffer.alloc(32)), {
+        code: 'ERR_OSSL_EVP_UNSUPPORTED',
+      });
+    }
     return;
+  }
 
   if (!Array.isArray(data))
     data = [data];
@@ -70,12 +78,13 @@ function testHmac(algo, key, data, expected) {
 
 {
   // Historically, dss1 and DSS1 are SHA-1 aliases.
+  const key = '0123456789abcdef';
   const expected =
-    crypto.createHmac('sha1', 'key').update('data').digest('hex');
+    crypto.createHmac('sha1', key).update('data').digest('hex');
 
   for (const algo of ['dss1', 'DSS1']) {
     assert.strictEqual(
-      crypto.createHmac(algo, 'key').update('data').digest('hex'),
+      crypto.createHmac(algo, key).update('data').digest('hex'),
       expected);
   }
 }
@@ -303,6 +312,26 @@ for (let i = 0, l = rfc4231.length; i < l; i++) {
   }
 }
 
+// Calling digest() after the Hmac has already been used as a stream must
+// return an empty buffer (the DEP0206 repeat-digest guard), not uninitialized
+// stack memory. The stream itself must still produce the correct digest.
+// See: https://github.com/nodejs/node/issues/28245
+{
+  const key = 'key';
+  const data = 'some data to hash';
+
+  const streamHmac = crypto.createHmac('sha256', key);
+  streamHmac.end(data);
+  const streamDigest = streamHmac.read();
+
+  // digest() after the stream already finalized must not return garbage.
+  assert.deepStrictEqual(streamHmac.digest(), Buffer.alloc(0));
+
+  // Sanity check: the stream itself produced the correct digest.
+  const expected = crypto.createHmac('sha256', key).update(data).digest();
+  assert.deepStrictEqual(streamDigest, expected);
+}
+
 // Test HMAC-MD5/SHA1 (rfc 2202 Test Cases)
 const rfc2202_md5 = [
   {
@@ -419,9 +448,12 @@ const rfc2202_sha1 = [
 for (const { key, data, hmac } of rfc2202_sha1)
   testHmac('sha1', key, data, hmac);
 
-assert.strictEqual(
-  crypto.createHmac('sha256', 'w00t').digest('ucs2'),
-  crypto.createHmac('sha256', 'w00t').digest().toString('ucs2'));
+{
+  const key = '0123456789abcdef';
+  assert.strictEqual(
+    crypto.createHmac('sha256', key).digest('ucs2'),
+    crypto.createHmac('sha256', key).digest().toString('ucs2'));
+}
 
 // Check initialized -> uninitialized state transition after calling digest().
 {
@@ -460,7 +492,7 @@ assert.strictEqual(
 
 {
   assert.throws(
-    () => crypto.createHmac('sha7', 'key'),
+    () => crypto.createHmac('sha7', '0123456789abcdef'),
     /Invalid digest/);
 }
 
diff --git a/test/parallel/test-crypto-jwk-raw-validation.js b/test/parallel/test-crypto-jwk-raw-validation.js
new file mode 100644
index 000000000000..d2085b43529a
--- /dev/null
+++ b/test/parallel/test-crypto-jwk-raw-validation.js
@@ -0,0 +1,43 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const { createPrivateKey } = require('node:crypto');
+const fixtures = require('../common/fixtures');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+
+const cases = [
+  ['ed25519_private.pem', 'OKP', 'crv', 'x', 'd'],
+];
+if (hasOpenSSL(3, 5) || isBoringSSL) {
+  cases.push(['ml_dsa_44_private_seed_only.pem', 'AKP', 'alg', 'pub', 'priv']);
+}
+
+for (const [file, kty, name, pub, priv] of cases) {
+  const jwk = createPrivateKey(fixtures.readKey(file)).export({ format: 'jwk' });
+  const invalid = { code: 'ERR_CRYPTO_INVALID_JWK', message: `Invalid JWK ${kty} key` };
+  const invalidName = kty === 'AKP' ? {
+    code: 'ERR_CRYPTO_INVALID_JWK', message: 'Unsupported JWK AKP "alg"',
+  } : invalid;
+  const importKey = (key) => createPrivateKey({ format: 'jwk', key });
+
+  assert.throws(() => importKey({ ...jwk, [name]: 'unknown' }), invalidName);
+  assert.throws(() => importKey({ ...jwk, [name]: jwk[name].toLowerCase() }), invalidName);
+  assert.throws(() => importKey({ ...jwk, [pub]: undefined }), invalid);
+  assert.throws(() => importKey({ ...jwk, [priv]: 1 }), invalid);
+  assert.throws(() => importKey({ ...jwk, [name]: 'unknown', [pub]: undefined }), invalidName);
+
+  // A recognized algorithm from the other schema remains invalid.
+  const otherName = kty === 'AKP' ? 'Ed25519' : 'ML-DSA-44';
+  assert.throws(() => importKey({ ...jwk, [name]: otherName }), invalidName);
+
+  for (const field of [name, pub, priv]) {
+    const error = new Error(`getter for ${field}`);
+    const key = { ...jwk };
+    Object.defineProperty(key, field, { get() { throw error; } });
+    assert.throws(() => importKey(key), (actual) => actual === error);
+  }
+}
diff --git a/test/parallel/test-crypto-key-encoding-provider-cipher.js b/test/parallel/test-crypto-key-encoding-provider-cipher.js
new file mode 100644
index 000000000000..3ded8ed0a627
--- /dev/null
+++ b/test/parallel/test-crypto-key-encoding-provider-cipher.js
@@ -0,0 +1,113 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
+if (isBoringSSL || !hasOpenSSL(3))
+  common.skip('OpenSSL providers are required');
+
+const assert = require('assert');
+const {
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPair,
+  generateKeyPairSync,
+  getCiphers,
+  sign,
+  verify,
+} = require('crypto');
+
+// Resolve an AES-256-CBC provider alias and retain the fetched cipher while
+// encoding private keys and running asynchronous key generation jobs.
+const cipher = '2.16.840.1.101.3.4.1.42';
+const passphrase = 'provider cipher passphrase';
+const keyOptions = { namedCurve: 'prime256v1' };
+const { publicKey, privateKey } = generateKeyPairSync('ec', keyOptions);
+const data = Buffer.from('encrypted private key');
+
+function checkPrivateKey(encoded, format, type, expectedPublicKey) {
+  const decrypted = createPrivateKey({
+    key: encoded,
+    format,
+    type,
+    passphrase,
+  });
+  assert(createPublicKey(decrypted).equals(expectedPublicKey));
+  const signature = sign('sha256', data, decrypted);
+  assert(verify('sha256', data, expectedPublicKey, signature));
+}
+
+for (const format of ['pem', 'der']) {
+  const privateKeyEncoding = {
+    format,
+    type: 'pkcs8',
+    cipher,
+    passphrase,
+  };
+
+  const exported = privateKey.export(privateKeyEncoding);
+  if (format === 'pem')
+    assert.match(exported, /^-----BEGIN ENCRYPTED PRIVATE KEY-----/);
+  checkPrivateKey(exported, format, 'pkcs8', publicKey);
+
+  const generated = generateKeyPairSync('ec', {
+    ...keyOptions,
+    privateKeyEncoding,
+  });
+  checkPrivateKey(generated.privateKey, format, 'pkcs8', generated.publicKey);
+
+  // Async jobs copy the encoding configuration. Its fetched cipher must remain
+  // valid after the configuration used to create the job has been destroyed.
+  generateKeyPair('ec', {
+    ...keyOptions,
+    privateKeyEncoding,
+  }, common.mustSucceed((generatedPublicKey, generatedPrivateKey) => {
+    checkPrivateKey(generatedPrivateKey, format, 'pkcs8', generatedPublicKey);
+  }));
+}
+
+// Provider lookup must preserve the restrictions of each key format.
+const sec1 = { format: 'pem', type: 'sec1', cipher, passphrase };
+// Traditional PEM encryption uses MD5 to derive its key.
+if (!hasFIPS())
+  checkPrivateKey(privateKey.export(sec1), 'pem', 'sec1', publicKey);
+assert.throws(() => privateKey.export({ ...sec1, format: 'der' }), {
+  code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS',
+});
+
+const unknownCipher = {
+  format: 'pem',
+  type: 'pkcs8',
+  cipher: 'unknown-private-key-cipher',
+  passphrase,
+};
+const unknownCipherError = {
+  code: 'ERR_CRYPTO_UNKNOWN_CIPHER',
+  message: 'Unknown cipher',
+};
+assert.throws(() => privateKey.export(unknownCipher), unknownCipherError);
+assert.throws(() => generateKeyPairSync('ec', {
+  ...keyOptions,
+  privateKeyEncoding: unknownCipher,
+}), unknownCipherError);
+assert.throws(() => generateKeyPair('ec', {
+  ...keyOptions,
+  privateKeyEncoding: unknownCipher,
+}, common.mustNotCall()), unknownCipherError);
+
+// Provider-only ciphers must reach the serializer, which still rejects ciphers
+// without an ASN.1 identifier when writing PKCS8.
+if (getCiphers().includes('aes-128-cbc-cts')) {
+  for (const format of ['pem', 'der']) {
+    assert.throws(() => privateKey.export({
+      format,
+      type: 'pkcs8',
+      cipher: 'aes-128-cbc-cts',
+      passphrase,
+    }), {
+      code: 'ERR_OSSL_ASN1_CIPHER_HAS_NO_OBJECT_IDENTIFIER',
+    });
+  }
+}
diff --git a/test/parallel/test-crypto-key-objects-ec-jwk-private.js b/test/parallel/test-crypto-key-objects-ec-jwk-private.js
new file mode 100644
index 000000000000..bede4e2f31c0
--- /dev/null
+++ b/test/parallel/test-crypto-key-objects-ec-jwk-private.js
@@ -0,0 +1,79 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createECDH,
+  createPrivateKey,
+  createPublicKey,
+  getCurves,
+  getFips,
+  sign,
+  verify,
+} = require('crypto');
+
+const curves = [
+  ['prime256v1', 'P-256', 32,
+   'ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'],
+  ['secp384r1', 'P-384', 48,
+   'ffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf' +
+   '581a0db248b0a77aecec196accc52973'],
+  ['secp521r1', 'P-521', 66,
+   '01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' +
+   'fa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'],
+];
+if (!getFips() && getCurves().includes('secp256k1')) {
+  curves.push(['secp256k1', 'secp256k1', 32,
+               'fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141']);
+}
+
+for (const [namedCurve, crv, width, orderHex] of curves) {
+  const order = BigInt(`0x${orderHex}`);
+  const encode = (scalar) => Buffer.from(
+    scalar.toString(16).padStart(width * 2, '0'), 'hex');
+  const makeJwk = (scalar) => {
+    const ecdh = createECDH(namedCurve);
+    ecdh.setPrivateKey(encode(scalar));
+    const point = ecdh.getPublicKey();
+    return {
+      kty: 'EC',
+      crv,
+      x: point.subarray(1, 1 + width).toString('base64url'),
+      y: point.subarray(1 + width).toString('base64url'),
+      d: encode(scalar).toString('base64url'),
+    };
+  };
+  const generator = makeJwk(1n);
+  const other = makeJwk(2n);
+  const message = Buffer.from('EC JWK private key consistency');
+
+  for (const jwk of [generator, other, makeJwk(order - 1n)]) {
+    const key = createPrivateKey({ format: 'jwk', key: jwk });
+    assert.deepStrictEqual(key.export({ format: 'jwk' }), jwk);
+    const publicJwk = { kty: jwk.kty, crv, x: jwk.x, y: jwk.y };
+    const publicKey = createPublicKey({ format: 'jwk', key: publicJwk });
+    assert(verify('sha256', message, publicKey, sign('sha256', message, key)));
+  }
+
+  const invalid = [
+    { ...generator, d: other.d },
+    { ...generator, x: other.x, y: other.y },
+    ...[0n, order, order + 1n].map((scalar) => ({
+      ...generator, d: encode(scalar).toString('base64url'),
+    })),
+    { ...generator, d: '' },
+    {
+      ...generator,
+      x: Buffer.alloc(width).toString('base64url'),
+      y: Buffer.alloc(width).toString('base64url'),
+    },
+  ];
+  for (const jwk of invalid) {
+    assert.throws(() => createPrivateKey({ format: 'jwk', key: jwk }), {
+      code: 'ERR_CRYPTO_INVALID_JWK',
+    });
+  }
+}
diff --git a/test/parallel/test-crypto-key-objects-messageport.js b/test/parallel/test-crypto-key-objects-messageport.js
index d23fde0d00d7..a379b84185ce 100644
--- a/test/parallel/test-crypto-key-objects-messageport.js
+++ b/test/parallel/test-crypto-key-objects-messageport.js
@@ -9,6 +9,7 @@ const {
   generateKeyPairSync,
   KeyObject,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const { createContext } = require('vm');
 const {
@@ -45,7 +46,7 @@ process.env.HAS_STARTED_WORKER = 1;
   // The main thread generates keys and passes them to worker threads.
   const secretKey = generateKeySync('aes', { length: 128 });
   const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-    modulusLength: 1024
+    modulusLength: hasFIPS(3) ? 2048 : 1024
   });
   const cryptoKey = await subtle.generateKey(
     { name: 'AES-CBC', length: 128 }, false, ['encrypt']);
diff --git a/test/parallel/test-crypto-key-objects-raw.js b/test/parallel/test-crypto-key-objects-raw.js
index e8d5aced4e22..5fee248e1485 100644
--- a/test/parallel/test-crypto-key-objects-raw.js
+++ b/test/parallel/test-crypto-key-objects-raw.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 // EC: NIST and OpenSSL curve names are both recognized for raw-public and raw-private
 {
@@ -67,7 +67,7 @@ const { hasOpenSSL } = require('../common/crypto');
     ['x25519', 'x25519_public.pem'],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     rawPublicKeys.push(
       ['ed448', 'ed448_public.pem'],
       ['x448', 'x448_public.pem'],
@@ -76,7 +76,7 @@ const { hasOpenSSL } = require('../common/crypto');
     common.printSkipMessage('Skipping unsupported ed448/x448 test cases');
   }
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     rawPublicKeys.push(
       ['ml-dsa-44', 'ml_dsa_44_public.pem'],
       ['ml-kem-768', 'ml_kem_768_public.pem'],
@@ -122,7 +122,7 @@ if (hasOpenSSL(3, 5)) {
   const unsupportedKeyTypes = [
     ['rsa', 'rsa_public_2048.pem', 'rsa_private_2048.pem'],
   ];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     unsupportedKeyTypes.push(['dsa', 'dsa_public.pem', 'dsa_private.pem']);
   } else {
     common.printSkipMessage('Skipping unsupported dsa test case');
@@ -148,7 +148,7 @@ if (hasOpenSSL(3, 5)) {
   }
 
   // DH keys also don't support raw formats
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     const privKeyObj = crypto.createPrivateKey(
       fixtures.readKey('dh_private.pem', 'ascii'));
     assert.throws(() => privKeyObj.export({ format: 'raw-private' }),
@@ -174,7 +174,7 @@ if (hasOpenSSL(3, 5)) {
 
 // PQC import throws when PQC is not supported
 if (!hasOpenSSL(3, 5)) {
-  const unsupported = process.features.openssl_is_boringssl ?
+  const unsupported = isBoringSSL ?
     // BoringSSL supports ML-DSA and ML-KEM-{768,1024}, but not ML-KEM-512 or SLH-DSA.
     ['ml-kem-512', 'slh-dsa-sha2-128f', 'slh-dsa-shake-128f'] :
     [
@@ -236,7 +236,7 @@ if (!hasOpenSSL(3, 5)) {
 }
 
 // ML-KEM: public keys of different type cannot be imported as the other type
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   const mlKem768Pub = crypto.createPublicKey(
     fixtures.readKey('ml_kem_768_public.pem', 'ascii'));
   const mlKem1024Pub = crypto.createPublicKey(
@@ -255,7 +255,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 }
 
 // ML-DSA: -44 and -65 public keys cannot be imported as the other type
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   const mlDsa44Pub = crypto.createPublicKey(
     fixtures.readKey('ml_dsa_44_public.pem', 'ascii'));
   const mlDsa65Pub = crypto.createPublicKey(
@@ -337,10 +337,10 @@ if (hasOpenSSL(3, 5)) {
     namedCurve: 'P-256',
   }), { code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS' });
 
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     common.printSkipMessage('Skipping unsupported ed448/x448 test cases');
   }
-  for (const type of process.features.openssl_is_boringssl ?
+  for (const type of isBoringSSL ?
     ['ed25519', 'x25519'] :
     ['ed25519', 'ed448', 'x25519', 'x448']) {
     const priv = crypto.createPrivateKey(
@@ -368,7 +368,7 @@ if (hasOpenSSL(3, 5)) {
 }
 
 // raw-private cannot be used for ml-kem and ml-dsa
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   for (const type of ['ml-kem-768', 'ml-dsa-44']) {
     const priv = crypto.createPrivateKey(
       fixtures.readKey(`${type.replaceAll('-', '_')}_private_seed_only.pem`, 'ascii'));
@@ -476,7 +476,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
                 { code: 'ERR_INVALID_ARG_VALUE' });
 
   // PQC raw-seed -> createPublicKey
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     const mlDsaPriv = crypto.createPrivateKey(
       fixtures.readKey('ml_dsa_44_private_seed_only.pem', 'ascii'));
     const mlDsaPub = crypto.createPublicKey(
@@ -525,10 +525,10 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 
 // x25519, ed25519, x448, and ed448 cannot be used as 'ec' namedCurve values
 {
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     common.printSkipMessage('Skipping unsupported ed448/x448 test cases');
   }
-  for (const type of process.features.openssl_is_boringssl ?
+  for (const type of isBoringSSL ?
     ['ed25519', 'x25519'] :
     ['ed25519', 'x25519', 'ed448', 'x448']) {
     const priv = crypto.createPrivateKey(
diff --git a/test/parallel/test-crypto-key-objects-to-crypto-key.js b/test/parallel/test-crypto-key-objects-to-crypto-key.js
index a498df144f33..a8fe94f1dd43 100644
--- a/test/parallel/test-crypto-key-objects-to-crypto-key.js
+++ b/test/parallel/test-crypto-key-objects-to-crypto-key.js
@@ -12,7 +12,10 @@ const {
   randomBytes,
   generateKeyPairSync,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { kSupportedAlgorithms } = require('internal/crypto/util');
+const fips = hasFIPS();
+const rejectsXCurves = hasFIPS(3, 5);
 
 const hashes = Object.keys(kSupportedAlgorithms.digest).filter((name) => {
   return name.startsWith('SHA-') || name.startsWith('SHA3-');
@@ -133,7 +136,7 @@ function macInvalid(algorithm, invalidLengthMessage, allowZeroKey = false) {
   const key = createSecretKey(randomBytes(32));
   const usages = ['sign', 'verify'];
 
-  if (allowZeroKey) {
+  if (allowZeroKey && !fips) {
     const zeroKey = createSecretKey(Buffer.alloc(0))
       .toCryptoKey(algorithm, true, usages);
     assert.strictEqual(zeroKey.algorithm.length, 0);
@@ -141,6 +144,16 @@ function macInvalid(algorithm, invalidLengthMessage, allowZeroKey = false) {
     const explicitZeroKey = createSecretKey(Buffer.alloc(0))
       .toCryptoKey({ ...algorithm, length: 0 }, true, usages);
     assert.strictEqual(explicitZeroKey.algorithm.length, 0);
+  } else if (allowZeroKey) {
+    for (const zeroAlgorithm of [algorithm, { ...algorithm, length: 0 }]) {
+      assert.throws(() => {
+        createSecretKey(Buffer.alloc(0))
+          .toCryptoKey(zeroAlgorithm, true, usages);
+      }, {
+        name: 'NotSupportedError',
+        message: 'Invalid key length',
+      });
+    }
   } else {
     assert.throws(() => {
       createSecretKey(Buffer.alloc(0)).toCryptoKey(algorithm, true, usages);
@@ -155,12 +168,15 @@ function macInvalid(algorithm, invalidLengthMessage, allowZeroKey = false) {
     message: 'Usages cannot be empty when importing a secret key.'
   });
 
-  assert.throws(() => {
-    key.toCryptoKey({ ...algorithm, length: 0 }, true, usages);
-  }, {
-    name: 'DataError',
-    message: invalidLengthMessage,
-  });
+  assert.throws(
+    () => key.toCryptoKey({ ...algorithm, length: 0 }, true, usages),
+    allowZeroKey && fips ? {
+      name: 'NotSupportedError',
+      message: 'Invalid key length',
+    } : {
+      name: 'DataError',
+      message: invalidLengthMessage,
+    });
 }
 
 function hmacVectors() {
@@ -232,6 +248,14 @@ function ecVectors(name, usagesByType) {
 }
 
 function cfrgVectors(name, usagesByType) {
+  if (rejectsXCurves && name.startsWith('X')) {
+    assert.throws(() => generateKeyPairSync(name.toLowerCase()), {
+      name: 'Error',
+      message: /:digital envelope routines::unsupported$/,
+    });
+    return [];
+  }
+
   const keyPair = generateKeyPairSync(name.toLowerCase());
   return asymmetricVectors(keyPair, name, usagesByType);
 }
@@ -317,9 +341,11 @@ const invalid = {
   'HMAC': () => macInvalid(
     { name: 'HMAC', hash: 'SHA-256' },
     'HmacImportParams.length cannot be 0'),
-  'X25519': () => invalidAsymmetricKeyType('X25519', 'Ed25519'),
 };
 
+if (!rejectsXCurves)
+  invalid.X25519 = () => invalidAsymmetricKeyType('X25519', 'Ed25519');
+
 for (const name of ['AES-CBC', 'AES-CTR', 'AES-GCM', 'AES-OCB']) {
   if (name in kSupportedAlgorithms.importKey)
     tests[name] = symmetricVectors(name, ['encrypt', 'decrypt']);
@@ -350,9 +376,11 @@ for (const [name, usages, invalidAlgorithm] of [
 ]) {
   if (name in kSupportedAlgorithms.importKey) {
     tests[name] = cfrgVectors(name, usages);
-    invalid[name] = () => {
-      invalidAsymmetricKeyType(name, invalidAlgorithm);
-    };
+    if (!rejectsXCurves) {
+      invalid[name] = () => {
+        invalidAsymmetricKeyType(name, invalidAlgorithm);
+      };
+    }
   }
 }
 
@@ -370,7 +398,11 @@ for (const name of ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024']) {
   }
 }
 
-const unsupportedToCryptoKeyAlgorithms = new Set();
+const unsupportedToCryptoKeyAlgorithms = new Set([
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]);
 
 for (const name of Object.keys(kSupportedAlgorithms.importKey)) {
   const vectors = tests[name];
diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
index cfcd50f12a3e..f4af79e31b5e 100644
--- a/test/parallel/test-crypto-key-objects.js
+++ b/test/parallel/test-crypto-key-objects.js
@@ -24,7 +24,18 @@ const {
   generateKeyPairSync,
 } = require('crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+  isBoringSSL,
+} = require('../common/crypto');
+
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+const fips30 = fips3 && !fips35;
+const fips4 = hasFIPS(4);
+const rejectsXCurves = fips35;
+const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED';
 
 const fixtures = require('../common/fixtures');
 
@@ -201,15 +212,26 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
 
   // It should also be possible to import an encrypted private key as a public
   // key.
+  const passphrase = 'password';
+  if (fips4) {
+    assert.throws(() => privateKey.export({
+      type: 'pkcs8',
+      format: 'pem',
+      passphrase: '123',
+      cipher: 'aes-128-cbc'
+    }), {
+      code: 'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK',
+    });
+  }
   const decryptedKey = createPublicKey({
     key: privateKey.export({
       type: 'pkcs8',
       format: 'pem',
-      passphrase: '123',
+      passphrase,
       cipher: 'aes-128-cbc'
     }),
     format: 'pem',
-    passphrase: '123'
+    passphrase
   });
   assert.strictEqual(decryptedKey.type, 'public');
   assert.strictEqual(decryptedKey.asymmetricKeyType, 'rsa');
@@ -322,9 +344,9 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
   // This should not cause a crash: https://github.com/nodejs/node/issues/25247
   assert.throws(() => {
     createPrivateKey({ key: '' });
-  }, hasOpenSSL3 ? {
+  }, hasOpenSSL(3) ? {
     message: 'error:1E08010C:DECODER routines::unsupported',
-  } : process.features.openssl_is_boringssl ? {
+  } : isBoringSSL ? {
     message: 'error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE',
     code: 'ERR_OSSL_PEM_NO_START_LINE',
     reason: 'NO_START_LINE',
@@ -354,10 +376,10 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
       type: 'pkcs1'
     });
     createPrivateKey({ key, format: 'der', type: 'pkcs1' });
-  }, hasOpenSSL3 ? {
+  }, hasOpenSSL(3) ? {
     message: /error:1E08010C:DECODER routines::unsupported/,
     library: 'DECODER routines'
-  } : process.features.openssl_is_boringssl ? {
+  } : isBoringSSL ? {
     library: 'public key routines',
     message: 'error:06000066:public key routines:OPENSSL_internal:DECODE_ERROR'
   } : {
@@ -444,8 +466,10 @@ for (const info of [
     } },
 ]) {
   const keyType = info.keyType;
+  const fipsUnsupported =
+    rejectsXCurves && keyType.startsWith('x');
 
-  if (process.features.openssl_is_boringssl && keyType.endsWith('448')) {
+  if (isBoringSSL && keyType.endsWith('448')) {
     common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
     continue;
   }
@@ -462,19 +486,32 @@ for (const info of [
   }
 
   {
-    const key = createPrivateKey({ key: info.jwk, format: 'jwk' });
-    assert.strictEqual(key.type, 'private');
-    assert.strictEqual(key.asymmetricKeyType, keyType);
-    assert.strictEqual(key.symmetricKeySize, undefined);
-    assert.strictEqual(
-      key.export({ type: 'pkcs8', format: 'pem' }), info.private);
-    assert.deepStrictEqual(
-      key.export({ format: 'jwk' }), info.jwk);
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPrivateKey({ key: info.jwk, format: 'jwk' }),
+        { code: 'ERR_CRYPTO_INVALID_JWK' });
+    } else {
+      const key = createPrivateKey({ key: info.jwk, format: 'jwk' });
+      assert.strictEqual(key.type, 'private');
+      assert.strictEqual(key.asymmetricKeyType, keyType);
+      assert.strictEqual(key.symmetricKeySize, undefined);
+      assert.strictEqual(
+        key.export({ type: 'pkcs8', format: 'pem' }), info.private);
+      assert.deepStrictEqual(
+        key.export({ format: 'jwk' }), info.jwk);
+    }
   }
 
   {
-    for (const input of [
-      info.private, info.public, { key: info.jwk, format: 'jwk' }]) {
+    const inputs = [info.private, info.public];
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPublicKey({ key: info.jwk, format: 'jwk' }),
+        { code: 'ERR_CRYPTO_INVALID_JWK' });
+    } else {
+      inputs.push({ key: info.jwk, format: 'jwk' });
+    }
+    for (const input of inputs) {
       const key = createPublicKey(input);
       assert.strictEqual(key.type, 'public');
       assert.strictEqual(key.asymmetricKeyType, keyType);
@@ -498,21 +535,32 @@ for (const info of [
     assert(Buffer.isBuffer(rawPriv));
     assert(Buffer.isBuffer(rawPub));
 
-    const importedPriv = createPrivateKey({
+    const privateOptions = {
       key: rawPriv, format: 'raw-private', asymmetricKeyType: keyType,
-    });
-    assert.strictEqual(importedPriv.type, 'private');
-    assert.strictEqual(importedPriv.asymmetricKeyType, keyType);
-    assert.deepStrictEqual(
-      importedPriv.export({ format: 'raw-private' }), rawPriv);
-
-    const importedPub = createPublicKey({
+    };
+    const publicOptions = {
       key: rawPub, format: 'raw-public', asymmetricKeyType: keyType,
-    });
-    assert.strictEqual(importedPub.type, 'public');
-    assert.strictEqual(importedPub.asymmetricKeyType, keyType);
-    assert.deepStrictEqual(
-      importedPub.export({ format: 'raw-public' }), rawPub);
+    };
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPrivateKey(privateOptions),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(
+        () => createPublicKey(publicOptions),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+    } else {
+      const importedPriv = createPrivateKey(privateOptions);
+      assert.strictEqual(importedPriv.type, 'private');
+      assert.strictEqual(importedPriv.asymmetricKeyType, keyType);
+      assert.deepStrictEqual(
+        importedPriv.export({ format: 'raw-private' }), rawPriv);
+
+      const importedPub = createPublicKey(publicOptions);
+      assert.strictEqual(importedPub.type, 'public');
+      assert.strictEqual(importedPub.asymmetricKeyType, keyType);
+      assert.deepStrictEqual(
+        importedPub.export({ format: 'raw-public' }), rawPub);
+    }
   }
 }
 
@@ -602,8 +650,9 @@ for (const info of [
     } },
 ]) {
   const { keyType, namedCurve } = info;
+  const fipsUnsupported = fips3 && namedCurve === 'secp256k1';
 
-  if (process.features.openssl_is_boringssl && !getCurves().includes(namedCurve)) {
+  if (isBoringSSL && !getCurves().includes(namedCurve)) {
     common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
     continue;
   }
@@ -621,20 +670,33 @@ for (const info of [
   }
 
   {
-    const key = createPrivateKey({ key: info.jwk, format: 'jwk' });
-    assert.strictEqual(key.type, 'private');
-    assert.strictEqual(key.asymmetricKeyType, keyType);
-    assert.deepStrictEqual(key.asymmetricKeyDetails, { namedCurve });
-    assert.strictEqual(key.symmetricKeySize, undefined);
-    assert.strictEqual(
-      key.export({ type: 'pkcs8', format: 'pem' }), info.private);
-    assert.deepStrictEqual(
-      key.export({ format: 'jwk' }), info.jwk);
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPrivateKey({ key: info.jwk, format: 'jwk' }),
+        { code: 'ERR_CRYPTO_INVALID_JWK' });
+    } else {
+      const key = createPrivateKey({ key: info.jwk, format: 'jwk' });
+      assert.strictEqual(key.type, 'private');
+      assert.strictEqual(key.asymmetricKeyType, keyType);
+      assert.deepStrictEqual(key.asymmetricKeyDetails, { namedCurve });
+      assert.strictEqual(key.symmetricKeySize, undefined);
+      assert.strictEqual(
+        key.export({ type: 'pkcs8', format: 'pem' }), info.private);
+      assert.deepStrictEqual(
+        key.export({ format: 'jwk' }), info.jwk);
+    }
   }
 
   {
-    for (const input of [
-      info.private, info.public, { key: info.jwk, format: 'jwk' }]) {
+    const inputs = [info.private, info.public];
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPublicKey({ key: info.jwk, format: 'jwk' }),
+        { code: 'ERR_CRYPTO_INVALID_JWK' });
+    } else {
+      inputs.push({ key: info.jwk, format: 'jwk' });
+    }
+    for (const input of inputs) {
       const key = createPublicKey(input);
       assert.strictEqual(key.type, 'public');
       assert.strictEqual(key.asymmetricKeyType, keyType);
@@ -669,23 +731,35 @@ for (const info of [
     assert(Buffer.isBuffer(rawPriv));
     assert(Buffer.isBuffer(rawPub));
 
-    const importedPriv = createPrivateKey({
+    const privateOptions = {
       key: rawPriv, format: 'raw-private',
       asymmetricKeyType: keyType, namedCurve,
-    });
-    assert.strictEqual(importedPriv.type, 'private');
-    assert.strictEqual(importedPriv.asymmetricKeyType, keyType);
-    assert.deepStrictEqual(
-      importedPriv.export({ format: 'raw-private' }), rawPriv);
+    };
 
-    const importedPub = createPublicKey({
+    const publicOptions = {
       key: rawPub, format: 'raw-public',
       asymmetricKeyType: keyType, namedCurve,
-    });
-    assert.strictEqual(importedPub.type, 'public');
-    assert.strictEqual(importedPub.asymmetricKeyType, keyType);
-    assert.deepStrictEqual(
-      importedPub.export({ format: 'raw-public' }), rawPub);
+    };
+    if (fipsUnsupported) {
+      assert.throws(
+        () => createPrivateKey(privateOptions),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(
+        () => createPublicKey(publicOptions),
+        { code: 'ERR_INVALID_ARG_VALUE' });
+    } else {
+      const importedPriv = createPrivateKey(privateOptions);
+      assert.strictEqual(importedPriv.type, 'private');
+      assert.strictEqual(importedPriv.asymmetricKeyType, keyType);
+      assert.deepStrictEqual(
+        importedPriv.export({ format: 'raw-private' }), rawPriv);
+
+      const importedPub = createPublicKey(publicOptions);
+      assert.strictEqual(importedPub.type, 'public');
+      assert.strictEqual(importedPub.asymmetricKeyType, keyType);
+      assert.deepStrictEqual(
+        importedPub.export({ format: 'raw-public' }), rawPub);
+    }
   }
 }
 
@@ -728,7 +802,7 @@ for (const info of [
 
 {
   // Reading an encrypted key without a passphrase should fail.
-  assert.throws(() => createPrivateKey(privateDsa), hasOpenSSL3 ? {
+  assert.throws(() => createPrivateKey(privateDsa), hasOpenSSL(3) ? {
     name: 'Error',
     message: 'error:07880109:common libcrypto routines::interrupted or ' +
              'cancelled',
@@ -744,7 +818,7 @@ for (const info of [
     key: privateDsa,
     format: 'pem',
     passphrase: Buffer.alloc(1025, 'a')
-  }), hasOpenSSL3 ? { name: 'Error' } : {
+  }), hasOpenSSL(3) ? { name: 'Error' } : {
     code: 'ERR_OSSL_PEM_BAD_PASSWORD_READ',
     name: 'Error'
   });
@@ -755,8 +829,10 @@ for (const info of [
     key: privateDsa,
     format: 'pem',
     passphrase: Buffer.alloc(1024, 'a')
-  }), {
-    message: /bad decrypt|BAD_DECRYPT/
+  }), fips4 ? {
+    code: 'ERR_OSSL_INVALID_SALT_LENGTH',
+  } : {
+    message: /bad decrypt|BAD_DECRYPT/,
   });
 
   const publicKey = createPublicKey(publicDsa);
@@ -767,11 +843,28 @@ for (const info of [
     () => publicKey.export({ format: 'jwk' }),
     { code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE' });
 
-  const privateKey = createPrivateKey({
-    key: privateDsa,
+  const privateKeyData =
+    createPrivateKey(fixtures.readKey('dsa_private.pem')).export({
+      type: 'pkcs8',
+      format: 'pem',
+      cipher: 'aes-256-cbc',
+      passphrase: 'password',
+    });
+  const privateKeyOptions = {
+    key: privateKeyData,
     format: 'pem',
-    passphrase: 'secret'
-  });
+    passphrase: 'password',
+  };
+  if (fips4) {
+    assert.throws(() => createPrivateKey({
+      key: privateDsa,
+      format: 'pem',
+      passphrase: 'secret',
+    }), {
+      code: 'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK',
+    });
+  }
+  const privateKey = createPrivateKey(privateKeyOptions);
   assert.strictEqual(privateKey.type, 'private');
   assert.strictEqual(privateKey.asymmetricKeyType, 'dsa');
   assert.strictEqual(privateKey.symmetricKeySize, undefined);
@@ -780,7 +873,7 @@ for (const info of [
     { code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE' });
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // Test RSA-PSS.
   {
     // This key pair does not restrict the message digest algorithm or salt
@@ -815,20 +908,27 @@ if (!process.features.openssl_is_boringssl) {
       { code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE' });
 
     for (const key of [privatePem, privateKey]) {
-      // Any algorithm should work.
-      for (const algo of ['sha1', 'sha256']) {
-        // Any salt length should work.
-        for (const saltLength of [undefined, 8, 10, 12, 16, 18, 20]) {
-          const signature = createSign(algo)
-                            .update('foo')
-                            .sign({ key, saltLength });
-
-          for (const pkey of [key, publicKey, publicPem]) {
-            const okay = createVerify(algo)
-                         .update('foo')
-                         .verify({ key: pkey, saltLength }, signature);
-
-            assert.ok(okay);
+      if (fips30) {
+        // With no explicit parameters, this key defaults to SHA-1 for PSS.
+        assert.throws(() => createSign('sha256').update('foo').sign(key), {
+          code: fipsDigestErrorCode,
+        });
+      } else {
+        // Any algorithm should work.
+        for (const algo of ['sha1', 'sha256']) {
+          // Any salt length should work.
+          for (const saltLength of [undefined, 8, 10, 12, 16, 18, 20]) {
+            const signature = createSign(algo)
+                              .update('foo')
+                              .sign({ key, saltLength });
+
+            for (const pkey of [key, publicKey, publicPem]) {
+              const okay = createVerify(algo)
+                           .update('foo')
+                           .verify({ key: pkey, saltLength }, signature);
+
+              assert.ok(okay);
+            }
           }
         }
       }
@@ -896,12 +996,15 @@ if (!process.features.openssl_is_boringssl) {
       // Signing with anything other than sha256 should fail.
       assert.throws(() => {
         createSign('sha1').sign(key);
-      }, /digest not allowed/);
+      }, fips30 ? {
+        code: fipsDigestErrorCode,
+      } : /digest not allowed/);
 
       // Signing with salt lengths less than 16 bytes should fail.
       for (const saltLength of [8, 10, 12]) {
         assert.throws(() => {
-          createSign('sha1').sign({ key, saltLength });
+          createSign(fips3 ? 'sha256' : 'sha1')
+            .sign({ key, saltLength });
         }, /pss saltlen too small/);
       }
 
@@ -994,7 +1097,9 @@ if (!process.features.openssl_is_boringssl) {
       for (const algo of ['sha1', 'sha256']) {
         assert.throws(() => {
           createSign(algo).sign(key);
-        }, /digest not allowed/);
+        }, fips30 && algo === 'sha1' ? {
+          code: fipsDigestErrorCode,
+        } : /digest not allowed/);
       }
 
       // sha512 should produce a valid signature.
@@ -1053,24 +1158,32 @@ if (!process.features.openssl_is_boringssl) {
 {
   // Exporting a JWK unsupported curve EC key
   const supported = ['prime256v1', 'secp256k1', 'secp384r1', 'secp521r1'];
-  // Find an unsupported curve regardless of whether a FIPS compliant crypto
-  // provider is currently in use.
-  const namedCurve = getCurves().find((curve) => !supported.includes(curve));
+  // FIPS-disallowed curves are omitted from getCurves(). Select one explicitly
+  // to keep checking their rejection; otherwise find a curve JWK cannot encode.
+  const namedCurve = fips3 ? 'secp256k1' :
+    getCurves().find((curve) => !supported.includes(curve));
   assert(namedCurve);
-  const keyPair = generateKeyPairSync('ec', { namedCurve });
-  const { publicKey, privateKey } = keyPair;
-  assert.throws(
-    () => publicKey.export({ format: 'jwk' }),
-    {
-      code: 'ERR_CRYPTO_JWK_UNSUPPORTED_CURVE',
-      message: `Unsupported JWK EC curve: ${namedCurve}.`
-    });
-  assert.throws(
-    () => privateKey.export({ format: 'jwk' }),
-    {
-      code: 'ERR_CRYPTO_JWK_UNSUPPORTED_CURVE',
-      message: `Unsupported JWK EC curve: ${namedCurve}.`
+  if (fips3) {
+    assert.throws(() => generateKeyPairSync('ec', { namedCurve }), {
+      name: 'Error',
+      message: 'error:08000081:elliptic curve routines::unknown group',
     });
+  } else {
+    const keyPair = generateKeyPairSync('ec', { namedCurve });
+    const { publicKey, privateKey } = keyPair;
+    assert.throws(
+      () => publicKey.export({ format: 'jwk' }),
+      {
+        code: 'ERR_CRYPTO_JWK_UNSUPPORTED_CURVE',
+        message: `Unsupported JWK EC curve: ${namedCurve}.`
+      });
+    assert.throws(
+      () => privateKey.export({ format: 'jwk' }),
+      {
+        code: 'ERR_CRYPTO_JWK_UNSUPPORTED_CURVE',
+        message: `Unsupported JWK EC curve: ${namedCurve}.`
+      });
+  }
 }
 
 {
@@ -1113,12 +1226,19 @@ if (!process.features.openssl_is_boringssl) {
 
 {
   const first = generateKeyPairSync('ed25519');
-  const second = generateKeyPairSync('x25519');
+  if (rejectsXCurves) {
+    assert.throws(() => generateKeyPairSync('x25519'), {
+      name: 'Error',
+      message: /:digital envelope routines::unsupported$/,
+    });
+  } else {
+    const second = generateKeyPairSync('x25519');
 
-  assert(!first.publicKey.equals(second.publicKey));
-  assert(!first.publicKey.equals(second.privateKey));
-  assert(!first.privateKey.equals(second.privateKey));
-  assert(!first.privateKey.equals(second.publicKey));
+    assert(!first.publicKey.equals(second.publicKey));
+    assert(!first.publicKey.equals(second.privateKey));
+    assert(!first.privateKey.equals(second.privateKey));
+    assert(!first.privateKey.equals(second.publicKey));
+  }
 }
 
 {
diff --git a/test/parallel/test-crypto-key-store.js b/test/parallel/test-crypto-key-store.js
index b6f012416673..e777440f2c0d 100644
--- a/test/parallel/test-crypto-key-store.js
+++ b/test/parallel/test-crypto-key-store.js
@@ -2,7 +2,7 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 if (!hasOpenSSL(3))
   common.skip('requires OpenSSL 3.x');
 
@@ -84,26 +84,33 @@ const data = Buffer.from('hello store');
 }
 
 {
-  const alice = generateKeyPairSync('x25519');
-  const bob = generateKeyPairSync('x25519');
-  const file = path.join(tmpdir.path, 'x25519.pem');
-  fs.writeFileSync(file, alice.privateKey.export({
-    format: 'pem',
-    type: 'pkcs8',
-  }));
-  const url = pathToFileURL(file);
+  if (hasFIPS(3, 5)) {
+    assert.throws(() => generateKeyPairSync('x25519'), {
+      name: 'Error',
+      message: /:digital envelope routines::unsupported$/,
+    });
+  } else {
+    const alice = generateKeyPairSync('x25519');
+    const bob = generateKeyPairSync('x25519');
+    const file = path.join(tmpdir.path, 'x25519.pem');
+    fs.writeFileSync(file, alice.privateKey.export({
+      format: 'pem',
+      type: 'pkcs8',
+    }));
+    const url = pathToFileURL(file);
 
-  const expected = diffieHellman({
-    privateKey: alice.privateKey,
-    publicKey: bob.publicKey,
-  });
-  assert.deepStrictEqual(
-    diffieHellman({ privateKey: url, publicKey: bob.publicKey }),
-    expected);
+    const expected = diffieHellman({
+      privateKey: alice.privateKey,
+      publicKey: bob.publicKey,
+    });
+    assert.deepStrictEqual(
+      diffieHellman({ privateKey: url, publicKey: bob.publicKey }),
+      expected);
 
-  if (hasOpenSSL(3, 2)) {
-    const { sharedKey, ciphertext } = encapsulate(alice.publicKey);
-    assert.deepStrictEqual(decapsulate(url, ciphertext), sharedKey);
+    if (hasOpenSSL(3, 2)) {
+      const { sharedKey, ciphertext } = encapsulate(alice.publicKey);
+      assert.deepStrictEqual(decapsulate(url, ciphertext), sharedKey);
+    }
   }
 }
 
diff --git a/test/parallel/test-crypto-keygen-async-dsa-key-object.js b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
index ea35facbdc7e..52c82ea5725c 100644
--- a/test/parallel/test-crypto-keygen-async-dsa-key-object.js
+++ b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('not supported by BoringSSL');
 
 const assert = require('assert');
@@ -12,25 +14,23 @@ const {
   generateKeyPair,
 } = require('crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-
 // Test async DSA key object generation.
 {
   generateKeyPair('dsa', {
-    modulusLength: hasOpenSSL3 ? 2048 : 512,
+    modulusLength: hasOpenSSL(3) ? 2048 : 512,
     divisorLength: 256
   }, common.mustSucceed((publicKey, privateKey) => {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-      modulusLength: hasOpenSSL3 ? 2048 : 512,
+      modulusLength: hasOpenSSL(3) ? 2048 : 512,
       divisorLength: 256
     });
 
     assert.strictEqual(privateKey.type, 'private');
     assert.strictEqual(privateKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-      modulusLength: hasOpenSSL3 ? 2048 : 512,
+      modulusLength: hasOpenSSL(3) ? 2048 : 512,
       divisorLength: 256
     });
   }));
diff --git a/test/parallel/test-crypto-keygen-async-dsa.js b/test/parallel/test-crypto-keygen-async-dsa.js
index d7c857d35e21..5d0254491cd2 100644
--- a/test/parallel/test-crypto-keygen-async-dsa.js
+++ b/test/parallel/test-crypto-keygen-async-dsa.js
@@ -4,20 +4,21 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
-  common.skip('not supported by BoringSSL');
-
-const assert = require('assert');
-const {
-  generateKeyPair,
-} = require('crypto');
 const {
+  isBoringSSL,
   assertApproximateSize,
   testSignVerify,
   spkiExp,
+  hasOpenSSL,
 } = require('../common/crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('not supported by BoringSSL');
+
+const assert = require('assert');
+const {
+  generateKeyPair,
+} = require('crypto');
 
 // Test async DSA key generation.
 {
@@ -27,7 +28,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
   };
 
   generateKeyPair('dsa', {
-    modulusLength: hasOpenSSL3 ? 2048 : 512,
+    modulusLength: hasOpenSSL(3) ? 2048 : 512,
     divisorLength: 256,
     publicKeyEncoding: {
       type: 'spki',
@@ -35,7 +36,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
     },
     privateKeyEncoding: {
       cipher: 'aes-128-cbc',
-      passphrase: 'secret',
+      passphrase: 'password',
       ...privateKeyEncoding
     }
   }, common.mustSucceed((publicKey, privateKeyDER) => {
@@ -44,8 +45,8 @@ const { hasOpenSSL3 } = require('../common/crypto');
     // The private key is DER-encoded.
     assert(Buffer.isBuffer(privateKeyDER));
 
-    assertApproximateSize(publicKey, hasOpenSSL3 ? 1194 : 440);
-    assertApproximateSize(privateKeyDER, hasOpenSSL3 ? 721 : 336);
+    assertApproximateSize(publicKey, hasOpenSSL(3) ? 1194 : 440);
+    assertApproximateSize(privateKeyDER, hasOpenSSL(3) ? 721 : 336);
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => {
@@ -63,7 +64,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
     testSignVerify(publicKey, {
       key: privateKeyDER,
       ...privateKeyEncoding,
-      passphrase: 'secret'
+      passphrase: 'password'
     });
   }));
 }
diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
index b0945dcc83a2..2aaab36d3762 100644
--- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
+++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
@@ -8,11 +8,12 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // Test async elliptic curve key generation with 'jwk' encoding and named
 // curve.
 for (const curve of ['P-384', 'P-256', 'P-521', 'secp256k1']) {
-  if (process.features.openssl_is_boringssl && curve === 'secp256k1') {
+  if (isBoringSSL && curve === 'secp256k1') {
     common.printSkipMessage(`Skipping unsupported ${curve} test case`);
     continue;
   }
@@ -24,7 +25,12 @@ for (const curve of ['P-384', 'P-256', 'P-521', 'secp256k1']) {
     privateKeyEncoding: {
       format: 'jwk'
     }
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (hasFIPS(3) && curve === 'secp256k1') {
+      assert.strictEqual(err?.message, 'error:08000081:elliptic curve routines::unknown group');
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(typeof publicKey, 'object');
     assert.strictEqual(typeof privateKey, 'object');
     assert.strictEqual(publicKey.x, privateKey.x);
diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-rsa.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-rsa.js
index 449d1a97f9f6..f1a1bdf8322f 100644
--- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-rsa.js
+++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-rsa.js
@@ -8,11 +8,12 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // Test async elliptic curve key generation with 'jwk' encoding and RSA.
 {
   generateKeyPair('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
     publicKeyEncoding: {
       format: 'jwk'
     },
diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
index 731960b0d56a..84ecccd55eee 100644
--- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
+++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
@@ -8,11 +8,13 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
+const rejectsXCurves = hasFIPS(3, 5);
 
 // Test async elliptic curve key generation with 'jwk' encoding.
 {
   for (const type of ['ed25519', 'ed448', 'x25519', 'x448']) {
-    if (process.features.openssl_is_boringssl && type.endsWith('448')) {
+    if (isBoringSSL && type.endsWith('448')) {
       common.printSkipMessage(`Skipping unsupported ${type} test case`);
       continue;
     }
@@ -23,7 +25,12 @@ const {
       privateKeyEncoding: {
         format: 'jwk'
       }
-    }, common.mustSucceed((publicKey, privateKey) => {
+    }, common.mustCall((err, publicKey, privateKey) => {
+      if (rejectsXCurves && type.startsWith('x')) {
+        assert.strictEqual(err?.message, 'error:0308010C:digital envelope routines::unsupported');
+        return;
+      }
+      assert.ifError(err);
       assert.strictEqual(typeof publicKey, 'object');
       assert.strictEqual(typeof privateKey, 'object');
       assert.strictEqual(publicKey.x, privateKey.x);
diff --git a/test/parallel/test-crypto-keygen-async-encrypted-private-key-der.js b/test/parallel/test-crypto-keygen-async-encrypted-private-key-der.js
index 3203dfe16eb6..c1bc6fc95ea0 100644
--- a/test/parallel/test-crypto-keygen-async-encrypted-private-key-der.js
+++ b/test/parallel/test-crypto-keygen-async-encrypted-private-key-der.js
@@ -10,15 +10,17 @@ const {
 } = require('crypto');
 const {
   assertApproximateSize,
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
 } = require('../common/crypto');
 
 // Test async RSA key generation with an encrypted private key, but encoded as DER.
 {
+  const isFips = hasFIPS(3);
   generateKeyPair('rsa', {
     publicExponent: 0x10001,
-    modulusLength: 512,
+    modulusLength: isFips ? 2048 : 512,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'der'
@@ -29,7 +31,7 @@ const {
     }
   }, common.mustSucceed((publicKeyDER, privateKeyDER) => {
     assert(Buffer.isBuffer(publicKeyDER));
-    assertApproximateSize(publicKeyDER, 74);
+    assertApproximateSize(publicKeyDER, isFips ? 270 : 74);
 
     assert(Buffer.isBuffer(privateKeyDER));
 
diff --git a/test/parallel/test-crypto-keygen-async-encrypted-private-key.js b/test/parallel/test-crypto-keygen-async-encrypted-private-key.js
index 727cccc6f3ef..37a0121742df 100644
--- a/test/parallel/test-crypto-keygen-async-encrypted-private-key.js
+++ b/test/parallel/test-crypto-keygen-async-encrypted-private-key.js
@@ -10,15 +10,18 @@ const {
 } = require('crypto');
 const {
   assertApproximateSize,
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
 } = require('../common/crypto');
 
 // Test async RSA key generation with an encrypted private key, but encoded as DER.
 {
+  const isFips = hasFIPS(3);
+  const passphrase = 'password';
   generateKeyPair('rsa', {
     publicExponent: 0x10001,
-    modulusLength: 512,
+    modulusLength: isFips ? 2048 : 512,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'der'
@@ -27,11 +30,11 @@ const {
       type: 'pkcs8',
       format: 'der',
       cipher: 'aes-256-cbc',
-      passphrase: 'secret'
+      passphrase
     }
   }, common.mustSucceed((publicKeyDER, privateKeyDER) => {
     assert(Buffer.isBuffer(publicKeyDER));
-    assertApproximateSize(publicKeyDER, 74);
+    assertApproximateSize(publicKeyDER, isFips ? 270 : 74);
 
     assert(Buffer.isBuffer(privateKeyDER));
 
@@ -59,7 +62,7 @@ const {
       key: privateKeyDER,
       format: 'der',
       type: 'pkcs8',
-      passphrase: 'secret'
+      passphrase
     };
     testEncryptDecrypt(publicKey, privateKey);
     testSignVerify(publicKey, privateKey);
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
index 246cbe5dd1ac..cd7e59be97fa 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
@@ -4,20 +4,21 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
-  common.skip('BoringSSL does not support paramEncoding: explicit');
-
-const assert = require('assert');
-const {
-  generateKeyPair,
-} = require('crypto');
 const {
+  isBoringSSL,
   testSignVerify,
   spkiExp,
   pkcs8EncExp,
+  hasOpenSSL,
 } = require('../common/crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('BoringSSL does not support paramEncoding: explicit');
+
+const assert = require('assert');
+const {
+  generateKeyPair,
+} = require('crypto');
 
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
 // private key with paramEncoding explicit.
@@ -43,7 +44,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL3 ? {
+                  hasOpenSSL(3) ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
index c3b8ab6e8f50..5c0878fc634f 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
@@ -4,19 +4,22 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const {
+  isBoringSSL,
+  hasFIPS,
+  testSignVerify,
+  spkiExp,
+  sec1EncExp,
+  hasOpenSSL,
+} = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support paramEncoding: explicit');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const {
-  testSignVerify,
-  spkiExp,
-  sec1EncExp,
-  hasOpenSSL3,
-} = require('../common/crypto');
 
 {
   // Test async explicit elliptic curve key generation with an encrypted
@@ -34,7 +37,12 @@ const {
       cipher: 'aes-128-cbc',
       passphrase: 'secret'
     }
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (hasFIPS(3)) {
+      assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(typeof publicKey, 'string');
     assert.match(publicKey, spkiExp);
     assert.strictEqual(typeof privateKey, 'string');
@@ -42,7 +50,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL3 ? {
+                  hasOpenSSL(3) ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js
index 8084cdfc0b3b..e6209a09041d 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js
@@ -4,18 +4,20 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const {
+  isBoringSSL,
+  testSignVerify,
+  spkiExp,
+  sec1Exp,
+} = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support paramEncoding: explicit');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const {
-  testSignVerify,
-  spkiExp,
-  sec1Exp,
-} = require('../common/crypto');
 
 // Test async explicit elliptic curve key generation, e.g. for ECDSA,
 // with a SEC1 private key with paramEncoding explicit.
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
index 4c11401d0fc5..ba86fcdb94e3 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
@@ -12,7 +12,7 @@ const {
   testSignVerify,
   spkiExp,
   pkcs8EncExp,
-  hasOpenSSL3,
+  hasOpenSSL,
 } = require('../common/crypto');
 
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
@@ -39,7 +39,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL3 ? {
+                  hasOpenSSL(3) ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
index 0503ff74787f..84ea9d2f7a9a 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
@@ -9,10 +9,11 @@ const {
   generateKeyPair,
 } = require('crypto');
 const {
+  hasFIPS,
   testSignVerify,
   spkiExp,
   sec1EncExp,
-  hasOpenSSL3,
+  hasOpenSSL,
 } = require('../common/crypto');
 
 {
@@ -31,7 +32,12 @@ const {
       cipher: 'aes-128-cbc',
       passphrase: 'secret'
     }
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (hasFIPS(3)) {
+      assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(typeof publicKey, 'string');
     assert.match(publicKey, spkiExp);
     assert.strictEqual(typeof privateKey, 'string');
@@ -39,7 +45,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL3 ? {
+                  hasOpenSSL(3) ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-rsa.js b/test/parallel/test-crypto-keygen-async-rsa.js
index c80d7d334929..7a372ded9fc5 100644
--- a/test/parallel/test-crypto-keygen-async-rsa.js
+++ b/test/parallel/test-crypto-keygen-async-rsa.js
@@ -10,17 +10,19 @@ const {
 } = require('crypto');
 const {
   assertApproximateSize,
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
   pkcs1EncExp,
-  hasOpenSSL3,
+  hasOpenSSL,
 } = require('../common/crypto');
 
 // Test async RSA key generation with an encrypted private key.
 {
+  const isFips = hasFIPS(3);
   generateKeyPair('rsa', {
     publicExponent: 0x10001,
-    modulusLength: 512,
+    modulusLength: isFips ? 2048 : 512,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'der'
@@ -31,7 +33,12 @@ const {
       cipher: 'aes-256-cbc',
       passphrase: 'secret'
     }
-  }, common.mustSucceed((publicKeyDER, privateKey) => {
+  }, common.mustCall((err, publicKeyDER, privateKey) => {
+    if (isFips) {
+      assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+      return;
+    }
+    assert.ifError(err);
     assert(Buffer.isBuffer(publicKeyDER));
     assertApproximateSize(publicKeyDER, 74);
 
@@ -44,7 +51,7 @@ const {
       type: 'pkcs1',
       format: 'der',
     };
-    const expectedError = hasOpenSSL3 ? {
+    const expectedError = hasOpenSSL(3) ? {
       name: 'Error',
       message: 'error:07880109:common libcrypto routines::interrupted or ' +
                'cancelled'
diff --git a/test/parallel/test-crypto-keygen-bit-length.js b/test/parallel/test-crypto-keygen-bit-length.js
index 13234589a5d6..e5d5917cc6f7 100644
--- a/test/parallel/test-crypto-keygen-bit-length.js
+++ b/test/parallel/test-crypto-keygen-bit-length.js
@@ -4,7 +4,13 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const {
+  isBoringSSL,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support arbitrary RSA modulus length ' +
               'or RSA-PSS/DSA key generation');
 
@@ -12,7 +18,8 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+
+const fips3 = hasFIPS(3);
 
 // This tests check that generateKeyPair returns correct bit length in
 // KeyObject's asymmetricKeyDetails.
@@ -20,23 +27,38 @@ const { hasOpenSSL3 } = require('../common/crypto');
 {
   generateKeyPair('rsa', {
     modulusLength: 513,
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (fips3) {
+      assert.strictEqual(err?.message, 'error:020000AE:rsa routines::invalid modulus');
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 513);
     assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 513);
   }));
 
   generateKeyPair('rsa-pss', {
     modulusLength: 513,
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (fips3) {
+      assert.strictEqual(err?.message, 'error:020000AE:rsa routines::invalid modulus');
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 513);
     assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 513);
   }));
 
-  if (hasOpenSSL3) {
+  if (hasOpenSSL(3)) {
     generateKeyPair('dsa', {
       modulusLength: 2049,
       divisorLength: 256,
-    }, common.mustSucceed((publicKey, privateKey) => {
+    }, common.mustCall((err, publicKey, privateKey) => {
+      if (fips3) {
+        assert.strictEqual(err?.message, 'error:05000072:dsa routines::bad ffc parameters');
+        return;
+      }
+      assert.ifError(err);
       assert.strictEqual(privateKey.asymmetricKeyDetails.modulusLength, 2049);
       assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 2049);
     }));
diff --git a/test/parallel/test-crypto-keygen-deprecation.js b/test/parallel/test-crypto-keygen-deprecation.js
index 926dfbbc4ae9..4ab93c97cb50 100644
--- a/test/parallel/test-crypto-keygen-deprecation.js
+++ b/test/parallel/test-crypto-keygen-deprecation.js
@@ -4,6 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+if (process.features.openssl_is_boringssl)
+  common.skip('BoringSSL does not support RSA-PSS key pair generation');
+
 const DeprecationWarning = [];
 DeprecationWarning.push([
   '"options.hash" is deprecated, use "options.hashAlgorithm" instead.',
@@ -15,13 +18,15 @@ DeprecationWarning.push([
 common.expectWarning({ DeprecationWarning });
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
+const modulusLength = hasFIPS(3) ? 2048 : 512;
 const { generateKeyPair } = require('crypto');
 
 {
   // This test makes sure deprecated options still work as intended
 
   generateKeyPair('rsa-pss', {
-    modulusLength: 512,
+    modulusLength,
     saltLength: 16,
     hash: 'sha256',
     mgf1Hash: 'sha256'
@@ -29,7 +34,7 @@ const { generateKeyPair } = require('crypto');
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'rsa-pss');
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha256',
       mgf1HashAlgorithm: 'sha256',
@@ -39,7 +44,7 @@ const { generateKeyPair } = require('crypto');
     assert.strictEqual(privateKey.type, 'private');
     assert.strictEqual(privateKey.asymmetricKeyType, 'rsa-pss');
     assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha256',
       mgf1HashAlgorithm: 'sha256',
diff --git a/test/parallel/test-crypto-keygen-dh-classic.js b/test/parallel/test-crypto-keygen-dh-classic.js
index 44af7730126a..a78d068ef79d 100644
--- a/test/parallel/test-crypto-keygen-dh-classic.js
+++ b/test/parallel/test-crypto-keygen-dh-classic.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support DH key pair generation');
 
 const assert = require('assert');
@@ -15,7 +17,7 @@ const {
 // Test classic Diffie-Hellman key generation.
 {
   generateKeyPair('dh', {
-    primeLength: 512
+    primeLength: hasFIPS(3) ? 2048 : 512
   }, common.mustSucceed((publicKey, privateKey) => {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'dh');
diff --git a/test/parallel/test-crypto-keygen-duplicate-deprecated-option.js b/test/parallel/test-crypto-keygen-duplicate-deprecated-option.js
index 854ad6e35efc..47b001ae4a0f 100644
--- a/test/parallel/test-crypto-keygen-duplicate-deprecated-option.js
+++ b/test/parallel/test-crypto-keygen-duplicate-deprecated-option.js
@@ -4,7 +4,12 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+if (process.features.openssl_is_boringssl)
+  common.skip('BoringSSL does not support RSA-PSS key pair generation');
+
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
+const modulusLength = hasFIPS(3) ? 2048 : 512;
 const {
   generateKeyPair,
 } = require('crypto');
@@ -13,7 +18,7 @@ const {
 // simultaneously so long as they're identical values.
 {
   generateKeyPair('rsa-pss', {
-    modulusLength: 512,
+    modulusLength,
     saltLength: 16,
     hash: 'sha256',
     hashAlgorithm: 'sha256',
@@ -23,7 +28,7 @@ const {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'rsa-pss');
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha256',
       mgf1HashAlgorithm: 'sha256',
@@ -33,7 +38,7 @@ const {
     assert.strictEqual(privateKey.type, 'private');
     assert.strictEqual(privateKey.asymmetricKeyType, 'rsa-pss');
     assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha256',
       mgf1HashAlgorithm: 'sha256',
diff --git a/test/parallel/test-crypto-keygen-ec-group-names.js b/test/parallel/test-crypto-keygen-ec-group-names.js
new file mode 100644
index 000000000000..b7afa67f9c2b
--- /dev/null
+++ b/test/parallel/test-crypto-keygen-ec-group-names.js
@@ -0,0 +1,38 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { generateKeyPair, generateKeyPairSync, sign, verify } = require('crypto');
+
+const message = Buffer.from('EC group names');
+for (const [alias, canonical] of [
+  ['P-256', 'prime256v1'],
+  ['P-384', 'secp384r1'],
+  ['P-521', 'secp521r1'],
+]) {
+  for (const namedCurve of [alias, canonical]) {
+    const check = common.mustCall((publicKey, privateKey) => {
+      assert.deepStrictEqual(publicKey.asymmetricKeyDetails,
+                             { namedCurve: canonical });
+      assert.deepStrictEqual(privateKey.asymmetricKeyDetails,
+                             { namedCurve: canonical });
+      assert(verify('sha256', message, publicKey,
+                    sign('sha256', message, privateKey)));
+    }, 2);
+    const { publicKey, privateKey } = generateKeyPairSync('ec', { namedCurve });
+    check(publicKey, privateKey);
+    generateKeyPair('ec', { namedCurve }, common.mustSucceed(check));
+  }
+}
+
+for (const namedCurve of ['', 'node-test-unknown-curve']) {
+  assert.throws(() => generateKeyPairSync('ec', { namedCurve }), {
+    code: 'ERR_CRYPTO_INVALID_CURVE',
+  });
+  assert.throws(() => generateKeyPair('ec', { namedCurve }, common.mustNotCall()), {
+    code: 'ERR_CRYPTO_INVALID_CURVE',
+  });
+}
diff --git a/test/parallel/test-crypto-keygen-eddsa.js b/test/parallel/test-crypto-keygen-eddsa.js
index 0a132235ea28..ff17d03e7523 100644
--- a/test/parallel/test-crypto-keygen-eddsa.js
+++ b/test/parallel/test-crypto-keygen-eddsa.js
@@ -8,15 +8,22 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
+const rejectsXCurves = hasFIPS(3, 5);
 
 // Test EdDSA key generation.
 {
   for (const keyType of ['ed25519', 'ed448', 'x25519', 'x448']) {
-    if (process.features.openssl_is_boringssl && keyType.endsWith('448')) {
+    if (isBoringSSL && keyType.endsWith('448')) {
       common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
       continue;
     }
-    generateKeyPair(keyType, common.mustSucceed((publicKey, privateKey) => {
+    generateKeyPair(keyType, common.mustCall((err, publicKey, privateKey) => {
+      if (rejectsXCurves && keyType.startsWith('x')) {
+        assert.strictEqual(err?.message, 'error:0308010C:digital envelope routines::unsupported');
+        return;
+      }
+      assert.ifError(err);
       assert.strictEqual(publicKey.type, 'public');
       assert.strictEqual(publicKey.asymmetricKeyType, keyType);
       assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {});
diff --git a/test/parallel/test-crypto-keygen-empty-passphrase-no-error.js b/test/parallel/test-crypto-keygen-empty-passphrase-no-error.js
index 6c7938f99e1b..ae1ca23c29e8 100644
--- a/test/parallel/test-crypto-keygen-empty-passphrase-no-error.js
+++ b/test/parallel/test-crypto-keygen-empty-passphrase-no-error.js
@@ -8,11 +8,14 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
+
+const fips4 = hasFIPS(4);
 
 // Passing an empty passphrase string should not throw ERR_OSSL_CRYPTO_MALLOC_FAILURE even on OpenSSL 3.
 // Regression test for https://github.com/nodejs/node/issues/41428.
 generateKeyPair('rsa', {
-  modulusLength: 1024,
+  modulusLength: hasFIPS(3) ? 2048 : 1024,
   publicKeyEncoding: {
     type: 'spki',
     format: 'pem'
@@ -23,7 +26,12 @@ generateKeyPair('rsa', {
     cipher: 'aes-256-cbc',
     passphrase: ''
   }
-}, common.mustSucceed((publicKey, privateKey) => {
+}, common.mustCall((err, publicKey, privateKey) => {
+  if (fips4) {
+    assert.strictEqual(err?.code, 'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK');
+    return;
+  }
+  assert.ifError(err);
   assert.strictEqual(typeof publicKey, 'string');
   assert.strictEqual(typeof privateKey, 'string');
 }));
diff --git a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
index cb873ff04748..ccf98bcd3766 100644
--- a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
+++ b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
@@ -10,23 +10,38 @@ const {
   generateKeyPair,
 } = require('crypto');
 const {
+  hasFIPS,
   testSignVerify,
-  hasOpenSSL3,
+  hasOpenSSL,
 } = require('../common/crypto');
 
+const fips4 = hasFIPS(4);
+
 // Passing an empty passphrase string should not cause OpenSSL's default
 // passphrase prompt in the terminal.
 // See https://github.com/nodejs/node/issues/35898.
 for (const type of ['pkcs1', 'pkcs8']) {
   generateKeyPair('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
     privateKeyEncoding: {
       type,
       format: 'pem',
       cipher: 'aes-256-cbc',
       passphrase: ''
     }
-  }, common.mustSucceed((publicKey, privateKey) => {
+  }, common.mustCall((err, publicKey, privateKey) => {
+    if (hasFIPS(3) && type === 'pkcs1') {
+      assert.strictEqual(err?.code, 'ERR_OSSL_EVP_UNSUPPORTED');
+      return;
+    }
+    if (fips4) {
+      assert.strictEqual(
+        err?.code,
+        'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK',
+      );
+      return;
+    }
+    assert.ifError(err);
     assert.strictEqual(publicKey.type, 'public');
 
     for (const passphrase of ['', Buffer.alloc(0)]) {
@@ -41,7 +56,7 @@ for (const type of ['pkcs1', 'pkcs8']) {
     // the key, and not specifying a passphrase should fail when decoding it.
     assert.throws(() => {
       return testSignVerify(publicKey, privateKey);
-    }, hasOpenSSL3 ? {
+    }, hasOpenSSL(3) ? {
       name: 'Error',
       code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED',
       message: 'error:07880109:common libcrypto routines::interrupted or cancelled'
diff --git a/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js b/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
index 9086e2e8a5f1..00cd4ba05f01 100644
--- a/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
+++ b/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support DSA key pair generation');
 
 const assert = require('assert');
@@ -13,6 +15,8 @@ const {
   generateKeyPairSync,
 } = require('crypto');
 
+const fips3 = hasFIPS(3);
+
 // Test invalid parameter encoding.
 {
   assert.throws(() => generateKeyPairSync('dsa', {
@@ -25,7 +29,11 @@ const {
     }
   }), {
     name: 'Error',
-    code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE',
-    message: 'Unsupported JWK Key Type.'
+    ...fips3 ? {
+      message: 'error:05000072:dsa routines::bad ffc parameters',
+    } : {
+      code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE',
+      message: 'Unsupported JWK Key Type.',
+    },
   });
 }
diff --git a/test/parallel/test-crypto-keygen-key-object-without-encoding.js b/test/parallel/test-crypto-keygen-key-object-without-encoding.js
index abcd282871b6..3c44d174df6f 100644
--- a/test/parallel/test-crypto-keygen-key-object-without-encoding.js
+++ b/test/parallel/test-crypto-keygen-key-object-without-encoding.js
@@ -9,6 +9,7 @@ const {
   generateKeyPair,
 } = require('crypto');
 const {
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
 } = require('../common/crypto');
@@ -17,7 +18,7 @@ const {
 {
   // If no publicKeyEncoding is specified, a key object should be returned.
   generateKeyPair('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
     privateKeyEncoding: {
       type: 'pkcs1',
       format: 'pem'
@@ -36,7 +37,7 @@ const {
 
   // If no privateKeyEncoding is specified, a key object should be returned.
   generateKeyPair('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'pem'
diff --git a/test/parallel/test-crypto-keygen-key-objects.js b/test/parallel/test-crypto-keygen-key-objects.js
index a0f1bdf2bcb5..2d22e99360e3 100644
--- a/test/parallel/test-crypto-keygen-key-objects.js
+++ b/test/parallel/test-crypto-keygen-key-objects.js
@@ -8,18 +8,20 @@ const assert = require('assert');
 const {
   generateKeyPairSync,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // Test sync key generation with key objects.
 {
+  const modulusLength = hasFIPS(3) ? 2048 : 512;
   const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-    modulusLength: 512
+    modulusLength
   });
 
   assert.strictEqual(typeof publicKey, 'object');
   assert.strictEqual(publicKey.type, 'public');
   assert.strictEqual(publicKey.asymmetricKeyType, 'rsa');
   assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-    modulusLength: 512,
+    modulusLength,
     publicExponent: 65537n
   });
 
@@ -27,7 +29,7 @@ const {
   assert.strictEqual(privateKey.type, 'private');
   assert.strictEqual(privateKey.asymmetricKeyType, 'rsa');
   assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-    modulusLength: 512,
+    modulusLength,
     publicExponent: 65537n
   });
 }
diff --git a/test/parallel/test-crypto-keygen-missing-oid.js b/test/parallel/test-crypto-keygen-missing-oid.js
index 1e4f309292eb..78b70ee50304 100644
--- a/test/parallel/test-crypto-keygen-missing-oid.js
+++ b/test/parallel/test-crypto-keygen-missing-oid.js
@@ -11,7 +11,7 @@ const {
   getCurves,
 } = require('crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 // This test creates EC key pairs on curves without associated OIDs.
 // Specifying a key encoding should not crash.
@@ -21,8 +21,12 @@ const { hasOpenSSL3 } = require('../common/crypto');
       if (!getCurves().includes(namedCurve))
         continue;
 
-      const expectedErrorCode =
-        hasOpenSSL3 ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID';
+      const expectedError = hasFIPS(3) ? {
+        name: 'Error',
+        message: 'error:08000081:elliptic curve routines::unknown group',
+      } : {
+        code: hasOpenSSL(3) ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID',
+      };
       const params = {
         namedCurve,
         publicKeyEncoding: {
@@ -33,13 +37,9 @@ const { hasOpenSSL3 } = require('../common/crypto');
 
       assert.throws(() => {
         generateKeyPairSync('ec', params);
-      }, {
-        code: expectedErrorCode
-      });
+      }, expectedError);
 
-      generateKeyPair('ec', params, common.mustCall((err) => {
-        assert.strictEqual(err.code, expectedErrorCode);
-      }));
+      generateKeyPair('ec', params, common.expectsError(expectedError));
     }
   }
 }
diff --git a/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js b/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
index 559c6f0af051..44243791b38f 100644
--- a/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
+++ b/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
@@ -15,11 +17,12 @@ const {
 // 'rsa-pss' should not add a RSASSA-PSS-params sequence by default.
 // Regression test for: https://github.com/nodejs/node/issues/39936
 {
+  const modulusLength = hasFIPS(3) ? 2048 : 512;
   generateKeyPair('rsa-pss', {
-    modulusLength: 512
+    modulusLength
   }, common.mustSucceed((publicKey, privateKey) => {
     const expectedKeyDetails = {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n
     };
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, expectedKeyDetails);
@@ -30,6 +33,7 @@ const {
     // AlgorithmIdentifier member of the SubjectPublicKeyInfo has the expected
     // length of 11 bytes (as opposed to > 11 bytes if node added params).
     const spki = publicKey.export({ format: 'der', type: 'spki' });
-    assert.strictEqual(spki[3], 11, spki.toString('hex'));
+    assert.strictEqual(
+      spki[3], hasFIPS(3) ? 32 : 11, spki.toString('hex'));
   }));
 }
diff --git a/test/parallel/test-crypto-keygen-non-standard-public-exponent.js b/test/parallel/test-crypto-keygen-non-standard-public-exponent.js
index f54a9e8a6d9b..96feb6bf8d17 100644
--- a/test/parallel/test-crypto-keygen-non-standard-public-exponent.js
+++ b/test/parallel/test-crypto-keygen-non-standard-public-exponent.js
@@ -8,28 +8,39 @@ const assert = require('assert');
 const {
   generateKeyPairSync,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 
 // Test sync key generation with key objects with a non-standard
 // publicExponent
 {
-  const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-    publicExponent: 3,
-    modulusLength: 512
-  });
+  if (hasFIPS(3)) {
+    assert.throws(() => generateKeyPairSync('rsa', {
+      publicExponent: 3,
+      modulusLength: 2048,
+    }), {
+      name: 'Error',
+      message: 'error:020000B2:rsa routines::pub exponent out of range',
+    });
+  } else {
+    const { publicKey, privateKey } = generateKeyPairSync('rsa', {
+      publicExponent: 3,
+      modulusLength: 512
+    });
 
-  assert.strictEqual(typeof publicKey, 'object');
-  assert.strictEqual(publicKey.type, 'public');
-  assert.strictEqual(publicKey.asymmetricKeyType, 'rsa');
-  assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-    modulusLength: 512,
-    publicExponent: 3n
-  });
+    assert.strictEqual(typeof publicKey, 'object');
+    assert.strictEqual(publicKey.type, 'public');
+    assert.strictEqual(publicKey.asymmetricKeyType, 'rsa');
+    assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
+      modulusLength: 512,
+      publicExponent: 3n
+    });
 
-  assert.strictEqual(typeof privateKey, 'object');
-  assert.strictEqual(privateKey.type, 'private');
-  assert.strictEqual(privateKey.asymmetricKeyType, 'rsa');
-  assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-    modulusLength: 512,
-    publicExponent: 3n
-  });
+    assert.strictEqual(typeof privateKey, 'object');
+    assert.strictEqual(privateKey.type, 'private');
+    assert.strictEqual(privateKey.asymmetricKeyType, 'rsa');
+    assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
+      modulusLength: 512,
+      publicExponent: 3n
+    });
+  }
 }
diff --git a/test/parallel/test-crypto-keygen-promisify.js b/test/parallel/test-crypto-keygen-promisify.js
index cd6ca7d6e3e6..158367cef46b 100644
--- a/test/parallel/test-crypto-keygen-promisify.js
+++ b/test/parallel/test-crypto-keygen-promisify.js
@@ -10,6 +10,7 @@ const {
 } = require('crypto');
 const {
   assertApproximateSize,
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
   pkcs1PubExp,
@@ -19,9 +20,10 @@ const { promisify } = require('util');
 
 // Test the util.promisified API with async RSA key generation.
 {
+  const isFips = hasFIPS(3);
   promisify(generateKeyPair)('rsa', {
     publicExponent: 0x10001,
-    modulusLength: 512,
+    modulusLength: isFips ? 2048 : 512,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'pem'
@@ -34,11 +36,11 @@ const { promisify } = require('util');
     const { publicKey, privateKey } = keys;
     assert.strictEqual(typeof publicKey, 'string');
     assert.match(publicKey, pkcs1PubExp);
-    assertApproximateSize(publicKey, 180);
+    assertApproximateSize(publicKey, isFips ? 426 : 180);
 
     assert.strictEqual(typeof privateKey, 'string');
     assert.match(privateKey, pkcs1PrivExp);
-    assertApproximateSize(privateKey, 512);
+    assertApproximateSize(privateKey, isFips ? 1675 : 512);
 
     testEncryptDecrypt(publicKey, privateKey);
     testSignVerify(publicKey, privateKey);
diff --git a/test/parallel/test-crypto-keygen-raw.js b/test/parallel/test-crypto-keygen-raw.js
index e55c3f10eed8..0006e5e15355 100644
--- a/test/parallel/test-crypto-keygen-raw.js
+++ b/test/parallel/test-crypto-keygen-raw.js
@@ -11,19 +11,29 @@ const {
   createPublicKey,
   createPrivateKey,
 } = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+
+const rejectsXCurves = hasFIPS(3, 5);
 
 // Test generateKeyPairSync with raw encoding for EdDSA/ECDH key types.
 {
   const types = ['ed25519', 'x25519'];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     types.push('ed448', 'x448');
   }
   for (const type of types) {
-    const { publicKey, privateKey } = generateKeyPairSync(type, {
+    const options = {
       publicKeyEncoding: { format: 'raw-public' },
       privateKeyEncoding: { format: 'raw-private' },
-    });
+    };
+    if (rejectsXCurves && type.startsWith('x')) {
+      assert.throws(() => generateKeyPairSync(type, options), {
+        name: 'Error',
+        message: 'error:0308010C:digital envelope routines::unsupported',
+      });
+      continue;
+    }
+    const { publicKey, privateKey } = generateKeyPairSync(type, options);
 
     assert(Buffer.isBuffer(publicKey));
     assert(Buffer.isBuffer(privateKey));
@@ -50,17 +60,24 @@ const { hasOpenSSL } = require('../common/crypto');
 // Test async generateKeyPair with raw encoding for EdDSA/ECDH key types.
 {
   const types = ['ed25519', 'x25519'];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     types.push('ed448', 'x448');
   }
   for (const type of types) {
-    generateKeyPair(type, {
+    const options = {
       publicKeyEncoding: { format: 'raw-public' },
       privateKeyEncoding: { format: 'raw-private' },
-    }, common.mustSucceed((publicKey, privateKey) => {
-      assert(Buffer.isBuffer(publicKey));
-      assert(Buffer.isBuffer(privateKey));
-    }));
+    };
+    generateKeyPair(type, options,
+                    common.mustCall((err, publicKey, privateKey) => {
+                      if (rejectsXCurves && type.startsWith('x')) {
+                        assert.strictEqual(err?.message, 'error:0308010C:digital envelope routines::unsupported');
+                        return;
+                      }
+                      assert.ifError(err);
+                      assert(Buffer.isBuffer(publicKey));
+                      assert(Buffer.isBuffer(privateKey));
+                    }));
   }
 }
 
@@ -158,7 +175,7 @@ const { hasOpenSSL } = require('../common/crypto');
 }
 
 // Test error: raw with DSA.
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   assert.throws(() => generateKeyPairSync('dsa', {
     modulusLength: 2048,
     publicKeyEncoding: { format: 'raw-public' },
@@ -205,7 +222,7 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 // PQC key types
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   // Test raw encoding for ML-DSA key types (raw-public + raw-seed only).
   {
     for (const type of ['ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87']) {
@@ -232,7 +249,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   // Test raw encoding for ML-KEM key types (raw-public + raw-seed only).
   {
     for (const type of ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']) {
-      if (process.features.openssl_is_boringssl && type === 'ml-kem-512') {
+      if (isBoringSSL && type === 'ml-kem-512') {
         common.printSkipMessage(`Skipping unsupported ${type} test case`);
         continue;
       }
@@ -259,7 +276,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   // Test raw encoding for SLH-DSA key types.
   {
     for (const type of ['slh-dsa-sha2-128f', 'slh-dsa-shake-128f']) {
-      if (process.features.openssl_is_boringssl) {
+      if (isBoringSSL) {
         common.printSkipMessage(`Skipping unsupported ${type} test case`);
         continue;
       }
@@ -274,7 +291,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   }
 
   // Test error: raw-seed with SLH-DSA (not supported).
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.throws(() => generateKeyPairSync('slh-dsa-sha2-128f', {
       publicKeyEncoding: { format: 'raw-public' },
       privateKeyEncoding: { format: 'raw-seed' },
diff --git a/test/parallel/test-crypto-keygen-rfc8017-9-1.js b/test/parallel/test-crypto-keygen-rfc8017-9-1.js
index fbefb1b4f642..e1781093c0c2 100644
--- a/test/parallel/test-crypto-keygen-rfc8017-9-1.js
+++ b/test/parallel/test-crypto-keygen-rfc8017-9-1.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
@@ -16,14 +18,14 @@ const {
 // hash function, it is RECOMMENDED that the hash function be the same as the
 // one that is applied to the message."
 {
-
+  const modulusLength = hasFIPS(3) ? 2048 : 512;
   generateKeyPair('rsa-pss', {
-    modulusLength: 512,
+    modulusLength,
     hashAlgorithm: 'sha256',
     saltLength: 16
   }, common.mustSucceed((publicKey, privateKey) => {
     const expectedKeyDetails = {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha256',
       mgf1HashAlgorithm: 'sha256',
diff --git a/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js b/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
index bc96d57ed0cd..f1543462c394 100644
--- a/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
+++ b/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
@@ -15,12 +17,13 @@ const {
 // RFC 8017, A.2.3.: "For a given hashAlgorithm, the default value of
 // saltLength is the octet length of the hash value."
 {
+  const modulusLength = hasFIPS(3) ? 2048 : 512;
   generateKeyPair('rsa-pss', {
-    modulusLength: 512,
+    modulusLength,
     hashAlgorithm: 'sha512'
   }, common.mustSucceed((publicKey, privateKey) => {
     const expectedKeyDetails = {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha512',
       mgf1HashAlgorithm: 'sha512',
@@ -32,12 +35,12 @@ const {
 
   // It is still possible to explicitly set saltLength to 0.
   generateKeyPair('rsa-pss', {
-    modulusLength: 512,
+    modulusLength,
     hashAlgorithm: 'sha512',
     saltLength: 0
   }, common.mustSucceed((publicKey, privateKey) => {
     const expectedKeyDetails = {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha512',
       mgf1HashAlgorithm: 'sha512',
diff --git a/test/parallel/test-crypto-keygen-rsa-pss.js b/test/parallel/test-crypto-keygen-rsa-pss.js
index 3ce0d40e8d1b..386db4fe0115 100644
--- a/test/parallel/test-crypto-keygen-rsa-pss.js
+++ b/test/parallel/test-crypto-keygen-rsa-pss.js
@@ -4,7 +4,14 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const {
+  isBoringSSL,
+  hasFIPS,
+  testEncryptDecrypt,
+  testSignVerify,
+} = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
@@ -12,15 +19,12 @@ const {
   constants,
   generateKeyPair,
 } = require('crypto');
-const {
-  testEncryptDecrypt,
-  testSignVerify,
-} = require('../common/crypto');
 
 // Test RSA-PSS.
 {
+  const modulusLength = hasFIPS(3) ? 2048 : 512;
   generateKeyPair('rsa-pss', {
-    modulusLength: 512,
+    modulusLength,
     saltLength: 16,
     hashAlgorithm: 'sha256',
     mgf1HashAlgorithm: 'sha256'
@@ -28,7 +32,7 @@ const {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'rsa-pss');
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha256',
       mgf1HashAlgorithm: 'sha256',
@@ -38,7 +42,7 @@ const {
     assert.strictEqual(privateKey.type, 'private');
     assert.strictEqual(privateKey.asymmetricKeyType, 'rsa-pss');
     assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-      modulusLength: 512,
+      modulusLength,
       publicExponent: 65537n,
       hashAlgorithm: 'sha256',
       mgf1HashAlgorithm: 'sha256',
diff --git a/test/parallel/test-crypto-keygen-sync.js b/test/parallel/test-crypto-keygen-sync.js
index a100379e21f1..54a91fcfbcae 100644
--- a/test/parallel/test-crypto-keygen-sync.js
+++ b/test/parallel/test-crypto-keygen-sync.js
@@ -10,6 +10,7 @@ const {
 } = require('crypto');
 const {
   assertApproximateSize,
+  hasFIPS,
   testEncryptDecrypt,
   testSignVerify,
   pkcs1PubExp,
@@ -19,9 +20,10 @@ const {
 // To make the test faster, we will only test sync key generation once and
 // with a relatively small key.
 {
+  const isFips = hasFIPS(3);
   const ret = generateKeyPairSync('rsa', {
-    publicExponent: 3,
-    modulusLength: 512,
+    publicExponent: isFips ? 0x10001 : 3,
+    modulusLength: isFips ? 2048 : 512,
     publicKeyEncoding: {
       type: 'pkcs1',
       format: 'pem'
@@ -37,10 +39,10 @@ const {
 
   assert.strictEqual(typeof publicKey, 'string');
   assert.match(publicKey, pkcs1PubExp);
-  assertApproximateSize(publicKey, 162);
+  assertApproximateSize(publicKey, isFips ? 426 : 162);
   assert.strictEqual(typeof privateKey, 'string');
   assert.match(privateKey, pkcs8Exp);
-  assertApproximateSize(privateKey, 512);
+  assertApproximateSize(privateKey, isFips ? 1704 : 512);
 
   testEncryptDecrypt(publicKey, privateKey);
   testSignVerify(publicKey, privateKey);
diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js
index 111d3dcbfd48..dcce85b83776 100644
--- a/test/parallel/test-crypto-keygen.js
+++ b/test/parallel/test-crypto-keygen.js
@@ -14,8 +14,11 @@ const {
 } = require('crypto');
 const { inspect } = require('util');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-const isBoringSSL = process.features.openssl_is_boringssl;
+const {
+  hasOpenSSL,
+  isBoringSSL: commonIsBoringSSL,
+} = require('../common/crypto');
+const isBoringSSL = commonIsBoringSSL;
 
 // Test invalid parameter encoding.
 {
@@ -379,7 +382,7 @@ const isBoringSSL = process.features.openssl_is_boringssl;
   let invalidExponentError = /bad e value/;
   if (isBoringSSL) {
     invalidExponentError = /BAD_E_VALUE/;
-  } else if (hasOpenSSL3) {
+  } else if (hasOpenSSL(3)) {
     invalidExponentError = /exponent/;
   }
   for (const publicExponent of [1, 1 + 0x10001]) {
diff --git a/test/parallel/test-crypto-keyobject-brand-check.js b/test/parallel/test-crypto-keyobject-brand-check.js
index ac0cf1b65f70..ed8e5bdae76e 100644
--- a/test/parallel/test-crypto-keyobject-brand-check.js
+++ b/test/parallel/test-crypto-keyobject-brand-check.js
@@ -15,6 +15,7 @@ const {
   generateKeyPairSync,
   KeyObject,
 } = require('node:crypto');
+const { hasFIPS } = require('../common/crypto');
 const { types: { isKeyObject } } = require('node:util');
 
 const invalidThis = { code: 'ERR_INVALID_THIS', name: 'TypeError' };
@@ -25,7 +26,9 @@ function getter(proto, name) {
 
 {
   const secret = createSecretKey(Buffer.alloc(16));
-  const { publicKey } = generateKeyPairSync('rsa', { modulusLength: 1024 });
+  const { publicKey } = generateKeyPairSync('rsa', {
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
+  });
 
   const type = getter(KeyObject.prototype, 'type');
   const symmetricKeySize =
diff --git a/test/parallel/test-crypto-keyobject-clone-transfer.js b/test/parallel/test-crypto-keyobject-clone-transfer.js
index 1d68e4b9911a..2ac37ca201e7 100644
--- a/test/parallel/test-crypto-keyobject-clone-transfer.js
+++ b/test/parallel/test-crypto-keyobject-clone-transfer.js
@@ -16,6 +16,7 @@ const {
   sign,
   verify,
 } = require('node:crypto');
+const { hasFIPS } = require('../common/crypto');
 const { MessageChannel, Worker } = require('node:worker_threads');
 const { types: { isKeyObject } } = require('node:util');
 
@@ -52,23 +53,25 @@ async function roundTripViaMessageChannel(key) {
   return received;
 }
 
-async function roundTripViaWorker(key) {
-  const worker = new Worker(`
-    'use strict';
-    const { parentPort } = require('node:worker_threads');
-    const { types: { isKeyObject } } = require('node:util');
-
-    parentPort.once('message', ({ key, expectedType }) => {
-      try {
-        if (!isKeyObject(key) || key.type !== expectedType) {
-          throw new Error('KeyObject slot mismatch in worker');
-        }
-        parentPort.postMessage({ key });
-      } catch (err) {
-        parentPort.postMessage({ error: err.stack || err.message });
+function workerMain() {
+  const { parentPort } = require('node:worker_threads');
+  const { types: { isKeyObject: workerIsKeyObject } } = require('node:util');
+
+  parentPort.once('message', ({ key, expectedType }) => {
+    try {
+      if (!workerIsKeyObject(key) || key.type !== expectedType) {
+        throw new Error('KeyObject slot mismatch in worker');
       }
-    });
-  `, { eval: true });
+      parentPort.postMessage({ key });
+    } catch (err) {
+      parentPort.postMessage({ error: err.stack || err.message });
+    }
+  });
+}
+
+async function roundTripViaWorker(key) {
+  const worker = new Worker(
+    `'use strict';(${workerMain.toString()})()`, { eval: true });
 
   worker.postMessage({ key, expectedType: key.type });
   const [msg] = await once(worker, 'message');
@@ -85,7 +88,7 @@ function hmacDigest(key) {
 (async () => {
   const secret = createSecretKey(Buffer.alloc(16));
   const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
   });
 
   for (const key of [secret, publicKey, privateKey]) {
diff --git a/test/parallel/test-crypto-keyobject-hidden-slots.js b/test/parallel/test-crypto-keyobject-hidden-slots.js
index 1ea243ba0ab8..b3db2068541f 100644
--- a/test/parallel/test-crypto-keyobject-hidden-slots.js
+++ b/test/parallel/test-crypto-keyobject-hidden-slots.js
@@ -29,6 +29,7 @@ const {
   X509Certificate,
 } = require('node:crypto');
 const { readFileSync } = require('node:fs');
+const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 function updateFinal(cipher, data = Buffer.alloc(16)) {
@@ -110,12 +111,13 @@ function updateFinal(cipher, data = Buffer.alloc(16)) {
 }
 
 {
+  const modulusLength = hasFIPS(3) ? 2048 : 1024;
   const { publicKey } = generateKeyPairSync('rsa', {
-    modulusLength: 1024,
+    modulusLength,
   });
 
   const details = publicKey.asymmetricKeyDetails;
-  assert.strictEqual(details.modulusLength, 1024);
+  assert.strictEqual(details.modulusLength, modulusLength);
   assert.strictEqual(details.publicExponent, 65537n);
 
   details.modulusLength = 1;
@@ -124,7 +126,7 @@ function updateFinal(cipher, data = Buffer.alloc(16)) {
 
   const freshDetails = publicKey.asymmetricKeyDetails;
   assert.notStrictEqual(freshDetails, details);
-  assert.strictEqual(freshDetails.modulusLength, 1024);
+  assert.strictEqual(freshDetails.modulusLength, modulusLength);
   assert.strictEqual(freshDetails.publicExponent, 65537n);
   assert.strictEqual(freshDetails.extra, undefined);
 }
@@ -150,7 +152,7 @@ function updateFinal(cipher, data = Buffer.alloc(16)) {
 
 {
   const { privateKey, publicKey } = generateKeyPairSync('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
   });
   const originalType =
     Object.getOwnPropertyDescriptor(KeyObject.prototype, 'type');
@@ -175,8 +177,10 @@ function updateFinal(cipher, data = Buffer.alloc(16)) {
     verifier.update(data);
     assert.strictEqual(verifier.verify(publicKey, streamSignature), true);
 
-    const ciphertext = publicEncrypt(publicKey, data);
-    assert.deepStrictEqual(privateDecrypt(privateKey, ciphertext), data);
+    const options = hasFIPS(3) ? { oaepHash: 'sha256' } : {};
+    const ciphertext = publicEncrypt({ key: publicKey, ...options }, data);
+    assert.deepStrictEqual(
+      privateDecrypt({ key: privateKey, ...options }, ciphertext), data);
 
     assert.strictEqual(publicKey.equals(createPublicKey(privateKey)), true);
 
diff --git a/test/parallel/test-crypto-keyobject-no-own-symbols.js b/test/parallel/test-crypto-keyobject-no-own-symbols.js
index f1539c6a0f7a..945032446784 100644
--- a/test/parallel/test-crypto-keyobject-no-own-symbols.js
+++ b/test/parallel/test-crypto-keyobject-no-own-symbols.js
@@ -12,6 +12,7 @@ const {
   createSecretKey,
   generateKeyPairSync,
 } = require('node:crypto');
+const { hasFIPS } = require('../common/crypto');
 
 function assertNoOwnKeys(key) {
   assert.deepStrictEqual(Object.getOwnPropertySymbols(key), []);
@@ -22,7 +23,7 @@ function assertNoOwnKeys(key) {
 {
   const secret = createSecretKey(Buffer.alloc(16));
   const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-    modulusLength: 1024,
+    modulusLength: hasFIPS(3) ? 2048 : 1024,
   });
 
   for (const key of [secret, publicKey, privateKey]) {
diff --git a/test/parallel/test-crypto-mac-errors.js b/test/parallel/test-crypto-mac-errors.js
new file mode 100644
index 000000000000..8bc8cebfcf51
--- /dev/null
+++ b/test/parallel/test-crypto-mac-errors.js
@@ -0,0 +1,180 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3) || isBoringSSL) {
+  common.skip('OpenSSL 3 EVP_MAC support is required');
+}
+
+const assert = require('node:assert');
+const fixtures = require('../common/fixtures');
+const {
+  createMac,
+  createPublicKey,
+  createSecretKey,
+  getMacs,
+} = require('node:crypto');
+
+const key = Buffer.alloc(32, 0x42);
+const data = Buffer.from('data');
+const availableMacs = new Set(getMacs());
+
+function invalidType(fn) {
+  assert.throws(fn, { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+function invalidValue(fn) {
+  assert.throws(fn, { code: 'ERR_INVALID_ARG_VALUE' });
+}
+
+for (const algorithm of [undefined, null, 1, true, [], {}]) {
+  invalidType(() => createMac(algorithm, key));
+}
+
+for (const algorithm of ['', 'hmac\0sha256']) {
+  invalidValue(() => createMac(algorithm, key));
+}
+
+for (const [algorithm, options] of [
+  ['hmac', { digest: 1 }],
+  ['cmac', { cipher: 1 }],
+  ['gmac', { iv: 'not a BufferSource' }],
+  ['kmac128', { customization: 'not a BufferSource' }],
+  ['blake2bmac', { salt: 'not a BufferSource' }],
+  ['kmac128', { outputLength: '32' }],
+]) {
+  invalidType(() => createMac(algorithm, key, options));
+}
+
+for (const [algorithm, options] of [
+  ['hmac', { digest: 'sha256\0sha512' }],
+  ['cmac', { cipher: 'aes-128-cbc\0aes-256-cbc' }],
+]) {
+  invalidValue(() => createMac(algorithm, key, options));
+}
+
+for (const outputLength of [-1, 0.5, 2 ** 32, Infinity, NaN]) {
+  assert.throws(
+    () => createMac('kmac128', key, { outputLength }),
+    { code: 'ERR_OUT_OF_RANGE' },
+  );
+}
+
+assert.throws(
+  () => createMac('definitely-not-a-mac', key),
+  { code: 'ERR_CRYPTO_INVALID_MAC' },
+);
+
+if (availableMacs.has('siphash')) {
+  assert.throws(() => createMac('siphash', Buffer.alloc(15)), (error) => {
+    assert.strictEqual(error.name, 'Error');
+    assert.strictEqual(error.message, 'Failed to initialize MAC');
+    assert.strictEqual(error.code, 'ERR_CRYPTO_OPERATION_FAILED');
+    for (const property of [
+      'function',
+      'library',
+      'reason',
+      'opensslErrorStack',
+    ]) {
+      assert.ok(!(property in error));
+    }
+    return true;
+  });
+}
+
+if (availableMacs.has('hmac')) {
+  const algorithm = 'hmac';
+  const options = { digest: 'sha256' };
+  assert.throws(
+    () => createMac(algorithm, key, { digest: 'definitely-not-a-digest' }),
+    {
+      code: 'ERR_OSSL_EVP_UNSUPPORTED',
+      library: 'digital envelope routines',
+      reason: 'unsupported',
+    },
+  );
+  const publicKey = createPublicKey(fixtures.readKey('rsa_public.pem'));
+  const cryptoKey = createSecretKey(key).toCryptoKey(
+    { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  for (const invalidKey of [
+    undefined,
+    null,
+    'key',
+    {},
+    publicKey,
+    cryptoKey,
+  ]) {
+    invalidType(() => createMac(algorithm, invalidKey, options));
+  }
+
+  for (const invalidData of [
+    undefined,
+    null,
+    1,
+    true,
+    {},
+    new ArrayBuffer(4),
+  ]) {
+    invalidType(() => createMac(algorithm, key, options).update(invalidData));
+  }
+
+  invalidType(() => createMac(algorithm, key, options).update('data', 1));
+  invalidType(() => createMac(algorithm, key, options).final(1));
+  invalidType(() => createMac(algorithm, key, 'hex'));
+
+  invalidValue(() => createMac(algorithm, key, options)
+    .update('data', 'not-an-encoding'));
+  const invalidFinalEncoding = createMac(algorithm, key, options);
+  invalidValue(() => invalidFinalEncoding.final('not-an-encoding'));
+  assert.deepStrictEqual(
+    invalidFinalEncoding.update(data).final(),
+    createMac(algorithm, key, options).update(data).final(),
+  );
+  invalidValue(() => createMac(algorithm, key, options).update('0', 'hex'));
+
+  invalidValue(() => createMac('hmac', key));
+  for (const extra of [
+    { cipher: 'aes-128-cbc' },
+    { iv: Buffer.alloc(12) },
+    { customization: Buffer.alloc(0) },
+    { salt: Buffer.alloc(16) },
+    { outputLength: 16 },
+  ]) {
+    invalidValue(() => createMac('hmac', key, {
+      ...options,
+      ...extra,
+    }));
+  }
+}
+
+if (availableMacs.has('cmac')) {
+  invalidValue(() => createMac('cmac', key));
+  invalidValue(() => createMac('cmac', key, { digest: 'sha256' }));
+  invalidValue(() => createMac('cmac', key, {
+    cipher: 'aes-256-cbc',
+    iv: Buffer.alloc(16),
+  }));
+}
+
+if (availableMacs.has('gmac')) {
+  invalidValue(() => createMac('gmac', key));
+  invalidValue(() => createMac('gmac', key, { cipher: 'aes-256-gcm' }));
+  invalidValue(() => createMac('gmac', key, { iv: Buffer.alloc(12) }));
+  invalidValue(() => createMac('gmac', key, {
+    cipher: 'aes-256-gcm',
+    iv: Buffer.alloc(12),
+    digest: 'sha256',
+  }));
+}
+
+if (availableMacs.has('poly1305')) {
+  invalidValue(() => createMac('poly1305', key, {
+    customization: Buffer.alloc(0),
+  }));
+}
diff --git a/test/parallel/test-crypto-mac-unsupported.js b/test/parallel/test-crypto-mac-unsupported.js
new file mode 100644
index 000000000000..1721e9d1c1a7
--- /dev/null
+++ b/test/parallel/test-crypto-mac-unsupported.js
@@ -0,0 +1,34 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+
+if (hasOpenSSL(3) && !isBoringSSL) {
+  common.skip('this test requires a build without EVP_MAC support');
+}
+
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+
+const algorithm = 'hmac';
+const options = { digest: 'sha256' };
+const key = Buffer.from('key');
+
+assert.strictEqual(typeof crypto.createMac, 'function');
+assert.strictEqual(typeof crypto.getMacs, 'function');
+assert.strictEqual(crypto.Mac, undefined);
+assert.deepStrictEqual(crypto.getMacs(), []);
+assert.throws(() => crypto.createMac(algorithm, key, options), {
+  code: 'ERR_CRYPTO_MAC_NOT_SUPPORTED',
+});
+(async () => {
+  const esmCrypto = await import('node:crypto');
+  assert.strictEqual(esmCrypto.createMac, crypto.createMac);
+  assert.strictEqual(esmCrypto.getMacs, crypto.getMacs);
+  assert.strictEqual(esmCrypto.Mac, undefined);
+})().then(common.mustCall());
diff --git a/test/parallel/test-crypto-mac-vectors.js b/test/parallel/test-crypto-mac-vectors.js
new file mode 100644
index 000000000000..19544ccf4ec1
--- /dev/null
+++ b/test/parallel/test-crypto-mac-vectors.js
@@ -0,0 +1,179 @@
+// Flags: --expose-internals
+
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3) || isBoringSSL) {
+  common.skip('OpenSSL 3 EVP_MAC support is required');
+}
+
+const assert = require('node:assert');
+const { encodingsMap } = require('internal/util');
+const {
+  createMac,
+  getCiphers,
+  getMacs,
+} = require('node:crypto');
+
+const availableMacs = new Set(getMacs());
+const availableCiphers = new Set(getCiphers());
+const kmacVectors = require('../fixtures/crypto/kmac')();
+const gmacIVStorage = Uint8Array.from([
+  0xff,
+  ...Buffer.alloc(12),
+  0xff,
+]);
+const blake2bSaltStorage = Uint8Array.from([
+  0xff,
+  ...Buffer.from('000102030405060708090a0b0c0d0e0f', 'hex'),
+  0xff,
+]);
+const blake2sSaltStorage = Uint8Array.from([
+  0xff,
+  ...Buffer.from('0001020304050607', 'hex'),
+  0xff,
+]);
+
+const vectors = [
+  {
+    label: 'CMAC-AES-128',
+    algorithm: 'cmac',
+    options: { cipher: 'aes-128-cbc' },
+    key: '2b7e151628aed2a6abf7158809cf4f3c',
+    data: '',
+    expected: 'bb1d6929e95937287fa37d129b756746',
+    cipher: 'aes-128-cbc',
+  },
+  {
+    label: 'GMAC-AES-128',
+    algorithm: 'gmac',
+    options: {
+      cipher: 'aes-128-gcm',
+      iv: new DataView(gmacIVStorage.buffer, 1, 12),
+    },
+    key: '00000000000000000000000000000000',
+    data: '',
+    expected: '58e2fccefa7e3061367f1d57a4e7455a',
+    cipher: 'aes-128-gcm',
+  },
+  {
+    label: 'Poly1305',
+    algorithm: 'poly1305',
+    key: '85d6be7857556d337f4452fe42d506a8' +
+         '0103808afb0db2fd4abff6af4149f51b',
+    data: Buffer.from('Cryptographic Forum Research Group').toString('hex'),
+    expected: 'a8061dc1305136c6c22b8baf0c0127a9',
+  },
+  {
+    label: 'SipHash-2-4',
+    algorithm: 'siphash',
+    options: { outputLength: 8 },
+    key: '000102030405060708090a0b0c0d0e0f',
+    data: '',
+    expected: '310e0edd47db6f72',
+  },
+  {
+    label: 'BLAKE2b MAC',
+    algorithm: 'blake2bmac',
+    options: {
+      outputLength: 32,
+      salt: new DataView(blake2bSaltStorage.buffer, 1, 16),
+    },
+    key: '000102030405060708090a0b0c0d0e0f',
+    data: Buffer.from('abc').toString('hex'),
+    expected: '6e583b101a126f2d1fb6d1fff9834f3a' +
+              '0d0e23c17b902cca4f1a0d7abfb327fa',
+  },
+  {
+    label: 'BLAKE2s MAC',
+    algorithm: 'blake2smac',
+    options: {
+      outputLength: 16,
+      salt: new DataView(blake2sSaltStorage.buffer, 1, 8),
+    },
+    key: '000102030405060708090a0b0c0d0e0f',
+    data: Buffer.from('abc').toString('hex'),
+    expected: '18adff242af55a56c7b7646df6c3d9ba',
+  },
+];
+
+for (const index of [0, 3]) {
+  const vector = kmacVectors[index];
+  const algorithm = vector.algorithm.toLowerCase();
+  const options = {
+    outputLength: vector.outputLength / 8,
+  };
+  if (vector.customization !== undefined) {
+    const storage = Uint8Array.from([
+      0xff,
+      ...vector.customization,
+      0xff,
+    ]);
+    options.customization = new DataView(
+      storage.buffer, 1, vector.customization.length);
+  }
+  vectors.push({
+    label: vector.algorithm,
+    algorithm,
+    options,
+    key: vector.key.toString('hex'),
+    data: vector.data.toString('hex'),
+    expected: vector.expected.toString('hex'),
+  });
+}
+
+for (const vector of vectors) {
+  if (!availableMacs.has(vector.algorithm) ||
+      (vector.cipher !== undefined &&
+       !availableCiphers.has(vector.cipher))) {
+    common.printSkipMessage(`${vector.label} is not available`);
+    continue;
+  }
+
+  const key = Buffer.from(vector.key, 'hex');
+  const data = Buffer.from(vector.data, 'hex');
+  const expected = Buffer.from(vector.expected, 'hex');
+  assert.deepStrictEqual(
+    createMac(vector.algorithm, key, vector.options).update(data).final(),
+    expected,
+  );
+}
+
+if (availableMacs.has('kmac128')) {
+  const vector = kmacVectors[0];
+  const algorithm = 'kmac128';
+  const options = { outputLength: 0 };
+  for (const outputEncoding of Object.keys(encodingsMap)) {
+    if (outputEncoding === 'buffer') continue;
+    assert.strictEqual(
+      createMac(algorithm, vector.key, options)
+        .update(vector.data)
+        .final(outputEncoding),
+      '',
+    );
+  }
+
+  for (const result of [
+    createMac(algorithm, vector.key, options)
+      .update(vector.data)
+      .final(),
+    createMac(algorithm, vector.key, options)
+      .update(vector.data)
+      .final('buffer'),
+  ]) {
+    assert(Buffer.isBuffer(result));
+    assert.deepStrictEqual(result, Buffer.alloc(0));
+  }
+
+  const streamed = createMac(algorithm, vector.key, options);
+  streamed.on('data', common.mustNotCall());
+  streamed.on('end', common.mustCall());
+  streamed.end(vector.data);
+}
diff --git a/test/parallel/test-crypto-mac.js b/test/parallel/test-crypto-mac.js
new file mode 100644
index 000000000000..deb2a8a3d32f
--- /dev/null
+++ b/test/parallel/test-crypto-mac.js
@@ -0,0 +1,216 @@
+// Flags: --expose-internals
+
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3) || isBoringSSL) {
+  common.skip('OpenSSL 3 EVP_MAC support is required');
+}
+
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const { encodingsMap } = require('internal/util');
+const {
+  createHmac,
+  createMac,
+  createSecretKey,
+  getMacs,
+} = crypto;
+const { finished } = require('node:stream/promises');
+const { Transform } = require('node:stream');
+
+assert.strictEqual(crypto.Mac, undefined);
+
+const macs = getMacs();
+assert(macs.every((name) => name === name.toLowerCase()));
+assert(macs.every((name) => !/^\d+(?:\.\d+)+$/.test(name)));
+
+const availableMacs = new Set(macs);
+if (!availableMacs.has('hmac')) {
+  common.printSkipMessage('HMAC is not available from the active providers');
+} else {
+  const algorithm = 'HMAC';
+  const options = { digest: 'sha256' };
+  const key = Buffer.from('000102030405060708090a0b0c0d0e0f', 'hex');
+  const data = Buffer.from('The quick brown fox jumps over the lazy dog');
+  const expected = createHmac('sha256', key).update(data).digest();
+  const expectedEmpty = createHmac('sha256', key).digest();
+  const expectedEmptyKey = createHmac('sha256', Buffer.alloc(0))
+    .update(data)
+    .digest();
+
+  assert.deepStrictEqual(
+    createMac(algorithm, key, options).update(data.toString()).final(),
+    expected,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, key, options).final(),
+    expectedEmpty,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, Buffer.alloc(0), options).update(data).final(),
+    expectedEmptyKey,
+  );
+
+  const nullPrototypeOptions = Object.assign({ __proto__: null }, options);
+  assert.deepStrictEqual(
+    createMac(algorithm, key, nullPrototypeOptions).update(data).final(),
+    expected,
+  );
+  const inheritedUnknownOptions = Object.assign(
+    { __proto__: { unknown: true } }, options);
+  assert.deepStrictEqual(
+    createMac(algorithm, key, inheritedUnknownOptions).update(data).final(),
+    expected,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, key, { ...options, unknown: true })
+      .update(data)
+      .final(),
+    expected,
+  );
+  const incremental = createMac(algorithm, key, options);
+  assert(incremental instanceof Transform);
+  assert.strictEqual(incremental.update(data.subarray(0, 10)), incremental);
+  assert.strictEqual(incremental.update(Buffer.alloc(0)), incremental);
+  incremental.update(data.subarray(10));
+  assert.deepStrictEqual(incremental.final(), expected);
+  assert.throws(
+    () => incremental.update(Buffer.alloc(0)),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+  assert.throws(
+    () => incremental.final(),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+
+  // Input encodings are handled by update(), while final() accepts an output
+  // encoding.
+  assert.strictEqual(
+    createMac(algorithm, key, options)
+      .update(data.toString('hex'), 'hex')
+      .final('hex'),
+    expected.toString('hex'),
+  );
+  assert.strictEqual(
+    createMac(algorithm, key, options)
+      .update(data.toString('base64'), 'base64')
+      .final('base64url'),
+    expected.toString('base64url'),
+  );
+  for (const outputEncoding of Object.keys(encodingsMap)) {
+    if (outputEncoding === 'buffer') continue;
+    assert.strictEqual(
+      createMac(algorithm, key, options)
+        .update(data)
+        .final(outputEncoding),
+      expected.toString(outputEncoding),
+    );
+  }
+  assert.deepStrictEqual(
+    createMac(algorithm, key, options)
+      .update(data, 'not-an-encoding')
+      .final(),
+    expected,
+  );
+  const explicitBuffer = createMac(algorithm, key, options)
+    .update(data)
+    .final('buffer');
+  assert(Buffer.isBuffer(explicitBuffer));
+  assert.deepStrictEqual(explicitBuffer, expected);
+
+  const encodedFinal = createMac(algorithm, key, options).update(data);
+  assert.strictEqual(encodedFinal.final('hex'), expected.toString('hex'));
+  assert.throws(
+    () => encodedFinal.update(data),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+  assert.throws(
+    () => encodedFinal.final('hex'),
+    { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+  );
+  // BufferSource keys and data must honor view offsets and lengths.
+  const keyStorage = Uint8Array.from([0xff, ...key, 0xff]);
+  const keyView = new Uint8Array(keyStorage.buffer, 1, key.length);
+  const keyDataView = new DataView(keyStorage.buffer, 1, key.length);
+  const dataStorage = Uint8Array.from([0xff, ...data, 0xff]);
+  const dataView = new DataView(dataStorage.buffer, 1, data.length);
+  assert.deepStrictEqual(
+    createMac(algorithm, keyView, options).update(dataView).final(),
+    expected,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, keyDataView, options).update(dataView).final(),
+    expected,
+  );
+
+  const arrayBufferKey = key.buffer.slice(
+    key.byteOffset,
+    key.byteOffset + key.byteLength,
+  );
+  assert.deepStrictEqual(
+    createMac(algorithm, arrayBufferKey, options).update(data).final(),
+    expected,
+  );
+  const secretKey = createSecretKey(key);
+  assert.deepStrictEqual(
+    createMac(algorithm, secretKey, options).update(data).final(),
+    expected,
+  );
+
+  (async () => {
+    const esmCrypto = await import('node:crypto');
+    assert.strictEqual(esmCrypto.createMac, createMac);
+    assert.strictEqual(esmCrypto.getMacs, getMacs);
+    assert.strictEqual(esmCrypto.Mac, undefined);
+
+    const emptyStream = createMac(algorithm, key, options);
+    const emptyChunks = [];
+    emptyStream.on(
+      'data', common.mustCall((chunk) => emptyChunks.push(chunk), 1));
+    const emptyFinished = finished(emptyStream);
+    emptyStream.end();
+    await emptyFinished;
+    assert.deepStrictEqual(Buffer.concat(emptyChunks), expectedEmpty);
+
+    const streamed = createMac(algorithm, key, {
+      ...options,
+      highWaterMark: 1,
+    });
+    const chunks = [];
+    streamed.on('data', common.mustCall((chunk) => chunks.push(chunk), 1));
+    assert.strictEqual(streamed.writableHighWaterMark, 1);
+    assert.strictEqual(streamed.readableHighWaterMark, 1);
+    const streamedFinished = finished(streamed);
+    streamed.write(data.subarray(0, 10));
+    streamed.end(data.subarray(10));
+    await streamedFinished;
+    assert.deepStrictEqual(Buffer.concat(chunks), expected);
+    assert.throws(
+      () => streamed.update(Buffer.alloc(0)),
+      { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+    );
+    assert.throws(
+      () => streamed.final(),
+      { code: 'ERR_CRYPTO_MAC_FINALIZED' },
+    );
+
+    // Direct finalization followed by stream finalization fails through the
+    // stream error path and does not emit a second tag.
+    const mixed = createMac(algorithm, key, options);
+    mixed.on('data', common.mustNotCall());
+    const mixedFinished = finished(mixed);
+    assert.deepStrictEqual(mixed.update(data).final(), expected);
+    mixed.end();
+    await assert.rejects(mixedFinished, {
+      code: 'ERR_CRYPTO_MAC_FINALIZED',
+    });
+  })().then(common.mustCall());
+}
diff --git a/test/parallel/test-crypto-negative-zero.js b/test/parallel/test-crypto-negative-zero.js
index 0af9220569c3..0e9525fcaf6c 100644
--- a/test/parallel/test-crypto-negative-zero.js
+++ b/test/parallel/test-crypto-negative-zero.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 function getOutcome(fn) {
   try {
@@ -110,7 +110,7 @@ function assertSameErrorOrSuccess(actual, expected) {
                          }));
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   assert.strictEqual(
     crypto.createHash('shake128', { outputLength: -0 }).digest('hex'),
     '',
diff --git a/test/parallel/test-crypto-no-algorithm.js b/test/parallel/test-crypto-no-algorithm.js
index db781c66a6d6..d9e1c0350b02 100644
--- a/test/parallel/test-crypto-no-algorithm.js
+++ b/test/parallel/test-crypto-no-algorithm.js
@@ -4,9 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3)
+if (!hasOpenSSL(3))
   common.skip('this test requires OpenSSL 3.x');
 
 const assert = require('node:assert/strict');
diff --git a/test/parallel/test-crypto-oneshot-hash-xof.js b/test/parallel/test-crypto-oneshot-hash-xof.js
index b4363c315927..fd42e107edbf 100644
--- a/test/parallel/test-crypto-oneshot-hash-xof.js
+++ b/test/parallel/test-crypto-oneshot-hash-xof.js
@@ -1,13 +1,15 @@
 'use strict';
+
 // This tests crypto.hash() works.
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto) common.skip('missing crypto');
 
 const assert = require('assert');
 const crypto = require('crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('BoringSSL does not support XOF hash functions');
 }
 
diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js
index 6e7a7fffee58..dce34409400a 100644
--- a/test/parallel/test-crypto-padding.js
+++ b/test/parallel/test-crypto-padding.js
@@ -26,7 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 // Input data.
 const ODD_LENGTH_PLAIN = 'Hello node world!';
@@ -83,7 +83,7 @@ assert.strictEqual(enc(EVEN_LENGTH_PLAIN, true), EVEN_LENGTH_ENCRYPTED);
 assert.throws(function() {
   // Input must have block length %.
   enc(ODD_LENGTH_PLAIN, false);
-}, hasOpenSSL3 ? {
+}, hasOpenSSL(3) ? {
   message: /wrong[\s_]final[\s_]block[\s_]length/i,
   code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/,
   reason: /wrong[\s_]final[\s_]block[\s_]length/i,
diff --git a/test/parallel/test-crypto-pbkdf2.js b/test/parallel/test-crypto-pbkdf2.js
index 78b73ed6c4e0..7cd1206f4f02 100644
--- a/test/parallel/test-crypto-pbkdf2.js
+++ b/test/parallel/test-crypto-pbkdf2.js
@@ -5,7 +5,16 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+const fips4 = hasFIPS(4);
+const validPassword = fips4 ? 'password' : 'pass';
+const validSalt = fips4 ? '0123456789abcdef' : 'salt';
+const validIterations = fips4 ? 1000 : 8;
+const validKeyLength = fips4 ? 16 : 8;
 
 function runPBKDF2(password, salt, iterations, keylen, hash) {
   const syncResult =
@@ -19,6 +28,25 @@ function runPBKDF2(password, salt, iterations, keylen, hash) {
   return syncResult;
 }
 
+function assertPBKDF2Fails(password, salt, iterations, keylen, hash) {
+  const expected = { message: 'PBKDF2 derivation failed' };
+  assert.throws(
+    () => crypto.pbkdf2Sync(password, salt, iterations, keylen, hash),
+    expected,
+  );
+  crypto.pbkdf2(
+    password,
+    salt,
+    iterations,
+    keylen,
+    hash,
+    common.mustCall((err, result) => {
+      assert.strictEqual(err?.message, expected.message);
+      assert.strictEqual(result, undefined);
+    }),
+  );
+}
+
 function testPBKDF2(password, salt, iterations, keylen, expected, encoding) {
   const actual = runPBKDF2(password, salt, iterations, keylen, 'sha256');
   assert.strictEqual(actual.toString(encoding || 'latin1'), expected);
@@ -28,36 +56,55 @@ function testPBKDF2(password, salt, iterations, keylen, expected, encoding) {
 // Test PBKDF2 with RFC 6070 test vectors (except #4)
 //
 
-testPBKDF2('password', 'salt', 1, 20,
-           '\x12\x0f\xb6\xcf\xfc\xf8\xb3\x2c\x43\xe7\x22\x52' +
-           '\x56\xc4\xf8\x37\xa8\x65\x48\xc9');
-
-testPBKDF2('password', 'salt', 2, 20,
-           '\xae\x4d\x0c\x95\xaf\x6b\x46\xd3\x2d\x0a\xdf\xf9' +
-           '\x28\xf0\x6d\xd0\x2a\x30\x3f\x8e');
-
-testPBKDF2('password', 'salt', 4096, 20,
-           '\xc5\xe4\x78\xd5\x92\x88\xc8\x41\xaa\x53\x0d\xb6' +
-           '\x84\x5c\x4c\x8d\x96\x28\x93\xa0');
-
-testPBKDF2('passwordPASSWORDpassword',
-           'saltSALTsaltSALTsaltSALTsaltSALTsalt',
-           4096,
-           25,
-           '\x34\x8c\x89\xdb\xcb\xd3\x2b\x2f\x32\xd8\x14\xb8\x11' +
-           '\x6e\x84\xcf\x2b\x17\x34\x7e\xbc\x18\x00\x18\x1c');
-
-testPBKDF2('pass\0word', 'sa\0lt', 4096, 16,
-           '\x89\xb6\x9d\x05\x16\xf8\x29\x89\x3c\x69\x62\x26\x65' +
-           '\x0a\x86\x87');
-
-testPBKDF2('password', 'salt', 32, 32,
-           '64c486c55d30d4c5a079b8823b7d7cb37ff0556f537da8410233bcec330ed956',
-           'hex');
+if (fips4) {
+  testPBKDF2(validPassword, validSalt, validIterations, 32,
+             '8514638175a45bc45eb1f22f04ff7d27' +
+             'f4f8be480498c455ff4b494ce8d1e7d2',
+             'hex');
+
+  for (const args of [
+    ['short', validSalt, validIterations],
+    [validPassword, 'short', validIterations],
+    [validPassword, validSalt, 999],
+  ]) {
+    assertPBKDF2Fails(...args, 32, 'sha256');
+  }
+  assertPBKDF2Fails(
+    validPassword, validSalt, validIterations, 8, 'sha256');
+} else {
+  testPBKDF2('password', 'salt', 1, 20,
+             '\x12\x0f\xb6\xcf\xfc\xf8\xb3\x2c\x43\xe7\x22\x52' +
+             '\x56\xc4\xf8\x37\xa8\x65\x48\xc9');
+
+  testPBKDF2('password', 'salt', 2, 20,
+             '\xae\x4d\x0c\x95\xaf\x6b\x46\xd3\x2d\x0a\xdf\xf9' +
+             '\x28\xf0\x6d\xd0\x2a\x30\x3f\x8e');
+
+  testPBKDF2('password', 'salt', 4096, 20,
+             '\xc5\xe4\x78\xd5\x92\x88\xc8\x41\xaa\x53\x0d\xb6' +
+             '\x84\x5c\x4c\x8d\x96\x28\x93\xa0');
+
+  testPBKDF2('passwordPASSWORDpassword',
+             'saltSALTsaltSALTsaltSALTsaltSALTsalt',
+             4096,
+             25,
+             '\x34\x8c\x89\xdb\xcb\xd3\x2b\x2f\x32\xd8\x14\xb8\x11' +
+             '\x6e\x84\xcf\x2b\x17\x34\x7e\xbc\x18\x00\x18\x1c');
+
+  testPBKDF2('pass\0word', 'sa\0lt', 4096, 16,
+             '\x89\xb6\x9d\x05\x16\xf8\x29\x89\x3c\x69\x62\x26\x65' +
+             '\x0a\x86\x87');
+
+  testPBKDF2('password', 'salt', 32, 32,
+             '64c486c55d30d4c5a079b8823b7d7cb3' +
+             '7ff0556f537da8410233bcec330ed956',
+             'hex');
+}
 
 // Error path should not leak memory (check with valgrind).
 assert.throws(
-  () => crypto.pbkdf2('password', 'salt', 1, 20, 'sha1'),
+  () => crypto.pbkdf2(
+    validPassword, validSalt, validIterations, 20, 'sha1'),
   {
     code: 'ERR_INVALID_ARG_TYPE',
     name: 'TypeError'
@@ -66,7 +113,8 @@ assert.throws(
 
 for (const iterations of [-1, 0, 2147483648]) {
   assert.throws(
-    () => crypto.pbkdf2Sync('password', 'salt', iterations, 20, 'sha1'),
+    () => crypto.pbkdf2Sync(
+      validPassword, validSalt, iterations, 20, 'sha1'),
     {
       code: 'ERR_OUT_OF_RANGE',
       name: 'RangeError',
@@ -77,7 +125,8 @@ for (const iterations of [-1, 0, 2147483648]) {
 ['str', null, undefined, [], {}].forEach((notNumber) => {
   assert.throws(
     () => {
-      crypto.pbkdf2Sync('password', 'salt', 1, notNumber, 'sha256');
+      crypto.pbkdf2Sync(
+        validPassword, validSalt, validIterations, notNumber, 'sha256');
     }, {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -89,7 +138,7 @@ for (const iterations of [-1, 0, 2147483648]) {
 [Infinity, -Infinity, NaN].forEach((input) => {
   assert.throws(
     () => {
-      crypto.pbkdf2('password', 'salt', 1, input, 'sha256',
+      crypto.pbkdf2(validPassword, validSalt, validIterations, input, 'sha256',
                     common.mustNotCall());
     }, {
       code: 'ERR_OUT_OF_RANGE',
@@ -102,7 +151,7 @@ for (const iterations of [-1, 0, 2147483648]) {
 [-1, 2147483648, 4294967296].forEach((input) => {
   assert.throws(
     () => {
-      crypto.pbkdf2('password', 'salt', 1, input, 'sha256',
+      crypto.pbkdf2(validPassword, validSalt, validIterations, input, 'sha256',
                     common.mustNotCall());
     }, {
       code: 'ERR_OUT_OF_RANGE',
@@ -119,14 +168,16 @@ for (const iterations of [-1, 0, 2147483648]) {
   let posError;
   let posResult;
   try {
-    posResult = crypto.pbkdf2Sync('password', 'salt', 1, 0, 'sha256');
+    posResult = crypto.pbkdf2Sync(
+      validPassword, validSalt, validIterations, 0, 'sha256');
   } catch (err) {
     posError = err;
   }
   let negError;
   let negResult;
   try {
-    negResult = crypto.pbkdf2Sync('password', 'salt', 1, -0, 'sha256');
+    negResult = crypto.pbkdf2Sync(
+      validPassword, validSalt, validIterations, -0, 'sha256');
   } catch (err) {
     negError = err;
   }
@@ -136,15 +187,22 @@ for (const iterations of [-1, 0, 2147483648]) {
     assert.deepStrictEqual(negResult, posResult);
   }
 
-  crypto.pbkdf2('password', 'salt', 1, -0, 'sha256', common.mustCall());
+  crypto.pbkdf2(
+    validPassword, validSalt, validIterations, -0, 'sha256',
+    common.mustCall());
 }
 
 // Should not get FATAL ERROR with empty password and salt
 // https://github.com/nodejs/node/issues/8571
-crypto.pbkdf2('', '', 1, 32, 'sha256', common.mustSucceed());
+if (fips4) {
+  assertPBKDF2Fails('', '', 1, 32, 'sha256');
+} else {
+  crypto.pbkdf2('', '', 1, 32, 'sha256', common.mustSucceed());
+}
 
 assert.throws(
-  () => crypto.pbkdf2('password', 'salt', 8, 8, common.mustNotCall()),
+  () => crypto.pbkdf2(
+    validPassword, validSalt, validIterations, 8, common.mustNotCall()),
   {
     code: 'ERR_INVALID_ARG_TYPE',
     name: 'TypeError',
@@ -153,7 +211,7 @@ assert.throws(
   });
 
 assert.throws(
-  () => crypto.pbkdf2Sync('password', 'salt', 8, 8),
+  () => crypto.pbkdf2Sync(validPassword, validSalt, validIterations, 8),
   {
     code: 'ERR_INVALID_ARG_TYPE',
     name: 'TypeError',
@@ -162,7 +220,7 @@ assert.throws(
   });
 
 assert.throws(
-  () => crypto.pbkdf2Sync('password', 'salt', 8, 8, null),
+  () => crypto.pbkdf2Sync(validPassword, validSalt, validIterations, 8, null),
   {
     code: 'ERR_INVALID_ARG_TYPE',
     name: 'TypeError',
@@ -171,7 +229,8 @@ assert.throws(
   });
 [1, {}, [], true, undefined, null].forEach((input) => {
   assert.throws(
-    () => crypto.pbkdf2(input, 'salt', 8, 8, 'sha256', common.mustNotCall()),
+    () => crypto.pbkdf2(
+      input, validSalt, validIterations, 8, 'sha256', common.mustNotCall()),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -179,7 +238,9 @@ assert.throws(
   );
 
   assert.throws(
-    () => crypto.pbkdf2('pass', input, 8, 8, 'sha256', common.mustNotCall()),
+    () => crypto.pbkdf2(
+      validPassword, input, validIterations, 8, 'sha256',
+      common.mustNotCall()),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -187,7 +248,8 @@ assert.throws(
   );
 
   assert.throws(
-    () => crypto.pbkdf2Sync(input, 'salt', 8, 8, 'sha256'),
+    () => crypto.pbkdf2Sync(
+      input, validSalt, validIterations, 8, 'sha256'),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -195,7 +257,8 @@ assert.throws(
   );
 
   assert.throws(
-    () => crypto.pbkdf2Sync('pass', input, 8, 8, 'sha256'),
+    () => crypto.pbkdf2Sync(
+      validPassword, input, validIterations, 8, 'sha256'),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -206,7 +269,8 @@ assert.throws(
 ['test', {}, [], true, undefined, null].forEach((i) => {
   const received = common.invalidArgTypeHelper(i);
   assert.throws(
-    () => crypto.pbkdf2('pass', 'salt', i, 8, 'sha256', common.mustNotCall()),
+    () => crypto.pbkdf2(
+      validPassword, validSalt, i, 8, 'sha256', common.mustNotCall()),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -215,7 +279,7 @@ assert.throws(
   );
 
   assert.throws(
-    () => crypto.pbkdf2Sync('pass', 'salt', i, 8, 'sha256'),
+    () => crypto.pbkdf2Sync(validPassword, validSalt, i, 8, 'sha256'),
     {
       code: 'ERR_INVALID_ARG_TYPE',
       name: 'TypeError',
@@ -224,15 +288,32 @@ assert.throws(
   );
 });
 
+if (fips4) {
+  assertPBKDF2Fails(
+    new Uint8Array(1), validSalt, validIterations, validKeyLength, 'sha256');
+  assertPBKDF2Fails(
+    validPassword, new Uint8Array(1), validIterations, validKeyLength,
+    'sha256');
+}
+
 // Any TypedArray should work for password and salt.
 for (const SomeArray of [Uint8Array, Uint16Array, Uint32Array, Float32Array,
                          Float64Array, ArrayBuffer, SharedArrayBuffer]) {
-  runPBKDF2(new SomeArray(10), 'salt', 8, 8, 'sha256');
-  runPBKDF2('pass', new SomeArray(10), 8, 8, 'sha256');
+  const length = fips4 ? 16 : 10;
+  const input = new SomeArray(length);
+  const bytes = ArrayBuffer.isView(input) ?
+    new Uint8Array(input.buffer, input.byteOffset, input.byteLength) :
+    new Uint8Array(input);
+  for (let index = 0; index < bytes.length; index++)
+    bytes[index] = index + 1;
+  runPBKDF2(input, validSalt, validIterations, validKeyLength, 'sha256');
+  runPBKDF2(validPassword, input, validIterations, validKeyLength, 'sha256');
 }
 
 assert.throws(
-  () => crypto.pbkdf2('pass', 'salt', 8, 8, 'md55', common.mustNotCall()),
+  () => crypto.pbkdf2(
+    validPassword, validSalt, validIterations, 8, 'md55',
+    common.mustNotCall()),
   {
     code: 'ERR_CRYPTO_INVALID_DIGEST',
     name: 'TypeError',
@@ -241,7 +322,8 @@ assert.throws(
 );
 
 assert.throws(
-  () => crypto.pbkdf2Sync('pass', 'salt', 8, 8, 'md55'),
+  () => crypto.pbkdf2Sync(
+    validPassword, validSalt, validIterations, 8, 'md55'),
   {
     code: 'ERR_CRYPTO_INVALID_DIGEST',
     name: 'TypeError',
@@ -249,7 +331,7 @@ assert.throws(
   }
 );
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   const kNotPBKDF2Supported = ['shake128', 'shake256'];
   crypto.getHashes()
     .filter((hash) => !kNotPBKDF2Supported.includes(hash))
@@ -261,7 +343,8 @@ if (!hasOpenSSL3) {
 {
   // This should not crash.
   assert.throws(
-    () => crypto.pbkdf2Sync('1', '2', 1, 1, '%'),
+    () => crypto.pbkdf2Sync(
+      validPassword, validSalt, validIterations, 1, '%'),
     {
       code: 'ERR_CRYPTO_INVALID_DIGEST',
       name: 'TypeError',
diff --git a/test/parallel/test-crypto-pkcs12.js b/test/parallel/test-crypto-pkcs12.js
new file mode 100644
index 000000000000..0ec9a2f544d8
--- /dev/null
+++ b/test/parallel/test-crypto-pkcs12.js
@@ -0,0 +1,226 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto) common.skip('missing crypto');
+
+const assert = require('assert');
+const crypto = require('crypto');
+const fixtures = require('../common/fixtures');
+const { hasOpenSSL3, hasFIPS } = require('../common/crypto');
+
+const fips3 = hasFIPS(3);
+
+if (fips3) {
+  // The long-standing fixtures protect their contents with PKCS12KDF and
+  // 3DES, neither of which the FIPS provider offers, so they cannot be opened
+  // at all. Assert the recognizable error rather than skipping: this is the
+  // same path the legacy.pfx case below exercises.
+  for (const name of ['rsa_cert.pfx', 'agent1.pfx']) {
+    assert.throws(
+      () => crypto.parsePKCS12(fixtures.readKey(name), { passphrase: 'sample' }),
+      { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+  }
+
+  // Reading the PBMAC1-protected FIPS fixtures needs OpenSSL 3.5 or newer, so
+  // below that there is nothing further this test can check.
+  if (!hasFIPS(3, 5)) return;
+}
+
+// The FIPS fixtures use PBMAC1/PBKDF2 and AES-256 in place of PKCS12KDF and
+// 3DES. Their passphrase is eight characters because the OpenSSL 4 FIPS
+// provider rejects shorter ones outright, which would mask the errors the
+// cases below are actually about.
+const keyAndCert = fips3 ?
+  { name: 'agent1-fips.pfx', passphrase: 'password', additional: 1 } :
+  { name: 'rsa_cert.pfx', passphrase: 'sample', additional: 0 };
+const withCaCert = fips3 ?
+  { name: 'agent1-fips.pfx', passphrase: 'password' } :
+  { name: 'agent1.pfx', passphrase: 'sample' };
+const ecKeyAndCert = fips3 ?
+  { name: 'ec-fips.pfx', passphrase: 'password' } :
+  { name: 'ec.pfx', passphrase: '' };
+const certWithoutKey = fips3 ?
+  { name: 'cert-without-key-fips.pfx', passphrase: 'password' } :
+  { name: 'cert-without-key.pfx', passphrase: 'test' };
+
+{
+  // Round-trip: a bundle holding one key and its certificate.
+  const bundle = fixtures.readKey(keyAndCert.name);
+  const { privateKey, certificate, additionalCertificates } =
+    crypto.parsePKCS12(bundle, { passphrase: keyAndCert.passphrase });
+
+  assert.strictEqual(privateKey.type, 'private');
+  assert.strictEqual(privateKey.asymmetricKeyType, 'rsa');
+  assert.ok(certificate instanceof crypto.X509Certificate);
+  assert.ok(Array.isArray(additionalCertificates));
+  assert.strictEqual(additionalCertificates.length, keyAndCert.additional);
+
+  // The parsed key and certificate must actually correspond.
+  assert.strictEqual(certificate.checkPrivateKey(privateKey), true);
+
+  // PEM export -- the primary reason callers want this API at all.
+  const keyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+  assert.match(keyPem, /^-----BEGIN PRIVATE KEY-----/);
+  assert.match(certificate.toString(), /^-----BEGIN CERTIFICATE-----/);
+
+  // Round-trips back through createPrivateKey.
+  const reimported = crypto.createPrivateKey(keyPem);
+  assert.strictEqual(reimported.asymmetricKeyType, 'rsa');
+
+  // Passphrase accepted as a buffer as well as a string.
+  const { privateKey: key2 } = crypto.parsePKCS12(
+    bundle, { passphrase: Buffer.from(keyAndCert.passphrase) });
+  assert.strictEqual(key2.type, 'private');
+}
+
+{
+  // A bundle carrying a second certificate alongside the end-entity one.
+  const bundle = fixtures.readKey(withCaCert.name);
+  const { privateKey, certificate, additionalCertificates } =
+    crypto.parsePKCS12(bundle, { passphrase: withCaCert.passphrase });
+  assert.strictEqual(privateKey.type, 'private');
+  assert.ok(certificate instanceof crypto.X509Certificate);
+  assert.strictEqual(additionalCertificates.length, 1);
+  assert.ok(additionalCertificates[0] instanceof crypto.X509Certificate);
+  assert.strictEqual(certificate.checkPrivateKey(privateKey), true);
+}
+
+{
+  // EC key.
+  const bundle = fixtures.readKey(ecKeyAndCert.name);
+  const { privateKey, certificate } =
+    crypto.parsePKCS12(bundle, { passphrase: ecKeyAndCert.passphrase });
+  assert.strictEqual(privateKey.asymmetricKeyType, 'ec');
+  assert.strictEqual(certificate.checkPrivateKey(privateKey), true);
+}
+
+if (!fips3) {
+  // ec.pfx carries an empty passphrase, which the FIPS provider will not
+  // accept at all, so this case has no FIPS counterpart. Omitting the
+  // passphrase rather than passing it empty must behave identically: OpenSSL
+  // tries both PKCS#12 password encodings, so either variant opens the file.
+  const { privateKey } = crypto.parsePKCS12(fixtures.readKey('ec.pfx'));
+  assert.strictEqual(privateKey.asymmetricKeyType, 'ec');
+}
+
+{
+  // Wrong passphrase must be distinguishable from malformed input: OpenSSL
+  // reports it as a MAC verification failure of its own, and BoringSSL
+  // reports the same condition as an incorrect password. It is deliberately
+  // longer than the FIPS minimum password length so that this checks what it
+  // says it does under FIPS too.
+  const code = process.features.openssl_is_boringssl ?
+    'ERR_OSSL_INCORRECT_PASSWORD' : 'ERR_OSSL_PKCS12_MAC_VERIFY_FAILURE';
+  const bundle = fixtures.readKey(keyAndCert.name);
+  assert.throws(
+    () => crypto.parsePKCS12(bundle, { passphrase: 'wrongpassphrase' }),
+    { code });
+}
+
+{
+  // Not a PKCS#12 structure at all. The error must be the same on either
+  // crypto library: OpenSSL rejects this in d2i_PKCS12_bio(), while
+  // BoringSSL's only copies the bytes and leaves every structural check to
+  // PKCS12_parse(), so the binding has to recognize both.
+  assert.throws(
+    () => crypto.parsePKCS12(Buffer.from('not a bundle'), { passphrase: 'x' }),
+    { code: 'ERR_CRYPTO_OPERATION_FAILED', message: /not a valid PKCS#12/ });
+}
+
+{
+  // A bundle with no private key. PKCS12_parse() identifies the end-entity
+  // certificate by its association with the key, so with no key there is
+  // nothing to single out and everything arrives through
+  // `additionalCertificates` -- including the end-entity certificate itself.
+  const bundle = fixtures.readKey(certWithoutKey.name);
+  const { privateKey, certificate, additionalCertificates } =
+    crypto.parsePKCS12(bundle, { passphrase: certWithoutKey.passphrase });
+  assert.strictEqual(privateKey, null);
+  assert.strictEqual(certificate, null);
+  assert.strictEqual(additionalCertificates.length, 1);
+  assert.ok(additionalCertificates[0] instanceof crypto.X509Certificate);
+}
+
+if (hasOpenSSL3) {
+  // Legacy algorithms (RC2-40-CBC) throw a recognizable, actionable error
+  // rather than a bare OpenSSL string. Mirrors the behavior added for the
+  // TLS path in https://github.com/nodejs/node/pull/54485.
+  const bundle = fixtures.readKey('legacy.pfx');
+  assert.throws(
+    () => crypto.parsePKCS12(bundle, { passphrase: 'legacy' }),
+    { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+}
+
+{
+  // ArrayBuffer is a documented input type for both the bundle and the
+  // passphrase, and must behave the same as a view over the same bytes.
+  const buf = fixtures.readKey(keyAndCert.name);
+  const bundleAb =
+    buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+  const passBuf = Buffer.from(keyAndCert.passphrase);
+  const passAb =
+    passBuf.buffer.slice(passBuf.byteOffset,
+                         passBuf.byteOffset + passBuf.byteLength);
+
+  const { privateKey, certificate } =
+    crypto.parsePKCS12(bundleAb, { passphrase: passAb });
+  assert.strictEqual(privateKey.type, 'private');
+  assert.ok(certificate instanceof crypto.X509Certificate);
+  assert.strictEqual(certificate.checkPrivateKey(privateKey), true);
+
+  // DataView too.
+  const { privateKey: key2 } = crypto.parsePKCS12(
+    new DataView(bundleAb), { passphrase: keyAndCert.passphrase });
+  assert.strictEqual(key2.type, 'private');
+}
+
+{
+  // A passphrase reaches OpenSSL as a NUL-terminated C string, and
+  // PKCS12_parse() takes no length alongside it. Without a check, everything
+  // from an embedded NUL onwards is dropped and the bundle opens under the
+  // truncated prefix -- a passphrase of '<pass>\0junk' would unlock a bundle
+  // protected by '<pass>'. Reject the passphrase instead, whatever form it
+  // arrives in.
+  const bundle = fixtures.readKey(keyAndCert.name);
+  const withNul = `${keyAndCert.passphrase}\u0000junk`;
+  const withNulBuf = Buffer.from(withNul);
+  const withNulAb = withNulBuf.buffer.slice(
+    withNulBuf.byteOffset, withNulBuf.byteOffset + withNulBuf.byteLength);
+
+  const passphrases = [
+    withNul,
+    withNulBuf,
+    withNulAb,
+    new DataView(withNulAb),
+    new Uint8Array(withNulAb),
+    // A trailing NUL is no more representable than an interior one.
+    `${keyAndCert.passphrase}\u0000`,
+    // And neither is a passphrase that is nothing but a NUL, which must not
+    // be mistaken for the empty passphrase.
+    '\u0000',
+    Buffer.from([0]),
+  ];
+
+  for (const passphrase of passphrases) {
+    assert.throws(
+      () => crypto.parsePKCS12(bundle, { passphrase }),
+      {
+        code: 'ERR_INVALID_ARG_VALUE',
+        message: /options\.passphrase.*must not contain null bytes/,
+      });
+  }
+
+  // The prefix on its own still opens the bundle, which is precisely why the
+  // truncation had to be rejected rather than tolerated.
+  assert.strictEqual(
+    crypto.parsePKCS12(bundle, { passphrase: keyAndCert.passphrase })
+      .privateKey.type,
+    'private');
+}
+
+{
+  // Argument validation.
+  assert.throws(() => crypto.parsePKCS12('a string'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => crypto.parsePKCS12(Buffer.alloc(0), 'nope'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
diff --git a/test/parallel/test-crypto-pqc-encrypted-pkcs8.js b/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
index b4a1b586d21d..f4e1d781abc3 100644
--- a/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
+++ b/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
@@ -4,9 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -21,7 +21,7 @@ const algorithms = new Set([
   'ml-kem-512', 'ml-kem-768', 'ml-kem-1024',
 ]);
 // BoringSSL does not support ML-KEM-512.
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   algorithms.delete('ml-kem-512');
 }
 
@@ -30,19 +30,32 @@ if (process.features.openssl_is_boringssl) {
 // ciphers like RC2, the optional PBKDF2 keyLength INTEGER branch in
 // the EncryptedPrivateKeyInfo parser.
 const availableCiphers = new Set(getCiphers());
+const passphrase = 'top secret';
 const ciphers = [
   'aes-128-cbc', 'aes-192-cbc', 'aes-256-cbc',
   'des-ede3-cbc', 'rc2-cbc',
-].filter((c) => availableCiphers.has(c));
+].filter((cipher) => availableCiphers.has(cipher) &&
+                       (!hasFIPS(3) || cipher !== 'rc2-cbc'));
+
+if (hasFIPS(3)) {
+  const { privateKey } = generateKeyPairSync('ml-dsa-44');
+  assert.throws(() => privateKey.export({
+    type: 'pkcs8',
+    format: 'der',
+    cipher: 'rc2-cbc',
+    passphrase,
+  }), { code: 'ERR_OSSL_EVP_UNSUPPORTED' });
+}
 
-const passphrase = 'top secret';
+const wrongPassphrase = 'wrong password';
 const wrongPassphraseError =
   /bad decrypt|DECRYPTION_FAILED|BAD_DECRYPT|bad password|DECODE[ _]ERROR/i;
 // A wrong passphrase usually fails during cipher finalization, but CBC output
 // can have valid padding by chance. OpenSSL then parses the bad plaintext as
 // PKCS#8 and may report ASN.1 or decoder errors from the same failed import.
 function assertWrongPassphrase(fn) {
-  assert.throws(fn, (err) => wrongPassphraseError.test(err.message) ||
+  assert.throws(fn, (err) => err.code === 'ERR_OSSL_BAD_DECRYPT' ||
+                            wrongPassphraseError.test(err.message) ||
                             err.code?.startsWith('ERR_OSSL_ASN1_') ||
                             err.code === 'ERR_OSSL_UNSUPPORTED');
 }
@@ -79,7 +92,7 @@ for (const asymmetricKeyType of algorithms) {
         key: encrypted,
         format,
         type: 'pkcs8',
-        passphrase: 'wrong',
+        passphrase: wrongPassphrase,
       }));
     }
   }
@@ -128,7 +141,7 @@ for (const { alg, jwkFile, encBase } of fixtureCases) {
       key: encryptedFixture,
       format,
       type: 'pkcs8',
-      passphrase: 'wrong',
+      passphrase: wrongPassphrase,
     }));
   }
 }
diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
index 883c2b712384..715b313849df 100644
--- a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
+++ b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
@@ -4,7 +4,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
@@ -79,7 +79,7 @@ for (const [asymmetricKeyType, pubLen] of [
     assertPublicKey(createPublicKey(key));
     key.export({ format: 'der', type: 'pkcs8' });
     if (hasSeed) {
-      assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private);
+      assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_seed_only);
       const jwk = key.export({ format: 'jwk' });
       assertPrivateJwk(jwk);
       assert.strictEqual(key.equals(createPrivateKey({ format: 'jwk', key: jwk })), true);
@@ -100,7 +100,7 @@ for (const [asymmetricKeyType, pubLen] of [
     }
   }
 
-  if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+  if (!hasOpenSSL(3, 5) && !isBoringSSL) {
     assert.throws(() => createPublicKey(keys.public), {
       code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
     });
@@ -120,7 +120,7 @@ for (const [asymmetricKeyType, pubLen] of [
         [keys.private_seed_only, true, true],
         [keys.private_priv_only, false, false],
       ]) {
-        if (process.features.openssl_is_boringssl && !seedOnly) {
+        if (isBoringSSL && !seedOnly) {
           common.printSkipMessage('Skipping unsupported private key format test');
           continue;
         }
diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
index de0755ca652c..14473e82e3fe 100644
--- a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
+++ b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
@@ -4,7 +4,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
@@ -79,7 +79,7 @@ for (const [asymmetricKeyType, pubLen] of [
     assertPublicKey(createPublicKey(key));
     key.export({ format: 'der', type: 'pkcs8' });
     if (hasSeed) {
-      assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private);
+      assert.strictEqual(key.export({ format: 'pem', type: 'pkcs8' }), keys.private_seed_only);
       const jwk = key.export({ format: 'jwk' });
       assertPrivateJwk(jwk);
       assert.strictEqual(key.equals(createPrivateKey({ format: 'jwk', key: jwk })), true);
@@ -100,7 +100,7 @@ for (const [asymmetricKeyType, pubLen] of [
     }
   }
 
-  if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+  if (!hasOpenSSL(3, 5) && !isBoringSSL) {
     assert.throws(() => createPublicKey(keys.public), {
       code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
     });
@@ -110,7 +110,7 @@ for (const [asymmetricKeyType, pubLen] of [
         code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
       });
     }
-  } else if (process.features.openssl_is_boringssl && asymmetricKeyType === 'ml-kem-512') {
+  } else if (isBoringSSL && asymmetricKeyType === 'ml-kem-512') {
     // BoringSSL does not support ML-KEM-512.
     assert.throws(() => createPublicKey(keys.public),
                   { code: 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' });
@@ -123,7 +123,7 @@ for (const [asymmetricKeyType, pubLen] of [
     assertPublicKey(publicKey);
 
     {
-      const entries = process.features.openssl_is_boringssl ?
+      const entries = isBoringSSL ?
         // BoringSSL only supports the seed-only PKCS#8 private key encoding.
         [[keys.private_seed_only, true]] :
         [
diff --git a/test/parallel/test-crypto-pqc-keygen-ml-dsa.js b/test/parallel/test-crypto-pqc-keygen-ml-dsa.js
index e6534c988c4e..9f9b25bed8b0 100644
--- a/test/parallel/test-crypto-pqc-keygen-ml-dsa.js
+++ b/test/parallel/test-crypto-pqc-keygen-ml-dsa.js
@@ -4,14 +4,14 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3, 5) && !isBoringSSL) {
   for (const asymmetricKeyType of ['ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87']) {
     assert.throws(() => generateKeyPair(asymmetricKeyType, common.mustNotCall()), {
       code: 'ERR_INVALID_ARG_VALUE',
diff --git a/test/parallel/test-crypto-pqc-keygen-ml-kem.js b/test/parallel/test-crypto-pqc-keygen-ml-kem.js
index 620f65c3a8d1..bcc5e5996683 100644
--- a/test/parallel/test-crypto-pqc-keygen-ml-kem.js
+++ b/test/parallel/test-crypto-pqc-keygen-ml-kem.js
@@ -4,19 +4,19 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
 
-const algorithms = process.features.openssl_is_boringssl ?
+const algorithms = isBoringSSL ?
   // BoringSSL does not support ML-KEM-512.
   ['ml-kem-768', 'ml-kem-1024'] :
   ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024'];
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3, 5) && !isBoringSSL) {
   for (const asymmetricKeyType of ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']) {
     assert.throws(() => generateKeyPair(asymmetricKeyType, common.mustNotCall()), {
       code: 'ERR_INVALID_ARG_VALUE',
@@ -72,7 +72,7 @@ if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
   }
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   assert.throws(() => generateKeyPair('ml-kem-512', common.mustNotCall()), {
     code: 'ERR_INVALID_ARG_VALUE',
     message: /The argument 'type' must be a supported key type/
diff --git a/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js b/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js
index 535e6a33d5cc..e095269bf610 100644
--- a/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js
+++ b/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js
@@ -4,9 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -39,7 +39,7 @@ for (const [asymmetricKeyType, sigLen] of [
     [keys.private_seed_only, true],
     [keys.private_priv_only, false],
   ]) {
-    if (process.features.openssl_is_boringssl && !seedOnly) {
+    if (isBoringSSL && !seedOnly) {
       common.printSkipMessage('Skipping unsupported private key format test');
       continue;
     }
@@ -52,7 +52,7 @@ for (const [asymmetricKeyType, sigLen] of [
         assert.strictEqual(verify(undefined, data, keys.public, Buffer.alloc(sigLen)), false);
         assert.strictEqual(verify(undefined, data, keys.public, signature), true);
         assert.strictEqual(verify(undefined, data, privateKey, signature), true);
-        const code = process.features.openssl_is_boringssl ?
+        const code = isBoringSSL ?
           'ERR_OSSL_EVP_COMMAND_NOT_SUPPORTED' : 'ERR_OSSL_INVALID_DIGEST';
         assert.throws(() => sign('sha256', data, privateKey), { code });
         assert.throws(
@@ -72,7 +72,7 @@ for (const [asymmetricKeyType, sigLen] of [
           }));
         }));
 
-        const message = process.features.openssl_is_boringssl ? /COMMAND_NOT_SUPPORTED/ : /invalid digest/;
+        const message = isBoringSSL ? /COMMAND_NOT_SUPPORTED/ : /invalid digest/;
         sign('sha256', data, privateKey, common.expectsError(message));
         verify('sha256', data, keys.public, Buffer.alloc(sigLen), common.expectsError(message));
       }
diff --git a/test/parallel/test-crypto-prepare-asymmetric-cryptokey.js b/test/parallel/test-crypto-prepare-asymmetric-cryptokey.js
new file mode 100644
index 000000000000..4701480eb88d
--- /dev/null
+++ b/test/parallel/test-crypto-prepare-asymmetric-cryptokey.js
@@ -0,0 +1,50 @@
+'use strict';
+
+// Flags: --expose-internals
+
+const common = require('../common');
+if (!common.hasCrypto) common.skip('missing crypto');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const fixtures = require('../common/fixtures');
+const {
+  prepareAsymmetricKey,
+  getCryptoKeyHandle,
+  kConsumePublic,
+  kConsumePrivate,
+  kCreatePublic,
+  kCreatePrivate,
+} = require('internal/crypto/keys');
+
+common.expectWarning({
+  DeprecationWarning: {
+    DEP0203: 'Passing a CryptoKey to node:crypto functions is deprecated.',
+  },
+});
+
+const privateKeyObject = crypto.createPrivateKey(fixtures.readKey('ec_p256_private.pem'));
+const algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
+const privateKey = privateKeyObject.toCryptoKey(algorithm, true, ['sign']);
+const publicKey = crypto.createPublicKey(privateKeyObject).toCryptoKey(algorithm, true, ['verify']);
+const secretKey = crypto.createSecretKey(Buffer.alloc(16)).toCryptoKey('AES-CBC', true, ['encrypt']);
+
+for (const key of [privateKey, publicKey, secretKey]) {
+  for (const input of [key, { key, format: 'raw-public', asymmetricKeyType: 'invalid' }]) {
+    for (const context of [kConsumePublic, kConsumePrivate, kCreatePublic]) {
+      if (key === privateKey || (key === publicKey && context === kConsumePublic)) {
+        assert.strictEqual(prepareAsymmetricKey(input, context).data, getCryptoKeyHandle(key));
+      } else {
+        const expected = context === kConsumePublic ? 'private or public' : 'private';
+        assert.throws(() => prepareAsymmetricKey(input, context), {
+          code: 'ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE',
+          name: 'TypeError',
+          message: `Invalid key object type ${key.type}, expected ${expected}.`,
+        });
+      }
+    }
+    assert.throws(() => prepareAsymmetricKey(input, kCreatePrivate), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      name: 'TypeError',
+    });
+  }
+}
diff --git a/test/parallel/test-crypto-prepare-asymmetric-key.js b/test/parallel/test-crypto-prepare-asymmetric-key.js
new file mode 100644
index 000000000000..de5ea1b483d1
--- /dev/null
+++ b/test/parallel/test-crypto-prepare-asymmetric-key.js
@@ -0,0 +1,101 @@
+'use strict';
+
+// Flags: --expose-internals
+
+const common = require('../common');
+if (!common.hasCrypto) common.skip('missing crypto');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const fixtures = require('../common/fixtures');
+const {
+  prepareAsymmetricKey,
+  getKeyObjectHandle,
+  kConsumePublic,
+  kConsumePrivate,
+  kCreatePublic,
+  kCreatePrivate,
+} = require('internal/crypto/keys');
+
+const pem = fixtures.readKey('ec_p256_private.pem');
+const keyObject = crypto.createPrivateKey(pem);
+const contexts = [kConsumePublic, kConsumePrivate, kCreatePublic, kCreatePrivate];
+
+for (const input of [
+  pem,
+  new Uint8Array(pem),
+  new DataView(Uint8Array.from(pem).buffer),
+  Uint8Array.from(pem).buffer,
+  new SharedArrayBuffer(pem.length),
+]) {
+  Object.defineProperty(input, 'key', { get: common.mustNotCall() });
+  Object.defineProperty(input, 'format', { get: common.mustNotCall() });
+  Object.defineProperty(input, Symbol.toStringTag, { value: 'KeyObject' });
+  for (const context of contexts) {
+    assert.strictEqual(prepareAsymmetricKey(input, context).data, input);
+    assert.strictEqual(prepareAsymmetricKey({ key: input }, context).data, input);
+  }
+}
+
+for (const context of [kConsumePublic, kConsumePrivate, kCreatePublic]) {
+  const options = { key: keyObject, format: 'raw-public', asymmetricKeyType: 'invalid' };
+  assert.strictEqual(prepareAsymmetricKey(options, context).data, getKeyObjectHandle(keyObject));
+}
+
+{
+  const reads = [];
+  const values = { key: pem.toString(), encoding: 'utf8', format: 'pem' };
+  const options = {};
+  for (const name of ['key', 'encoding', 'format', 'properties', 'type', 'cipher', 'passphrase']) {
+    Object.defineProperty(options, name, {
+      get() {
+        reads.push(name);
+        return values[name];
+      },
+    });
+  }
+  assert.deepStrictEqual(prepareAsymmetricKey(options, kConsumePrivate).data, pem);
+  assert.deepStrictEqual(reads, [
+    'key', 'encoding', 'format', 'properties', 'format', 'type', 'cipher', 'passphrase', 'encoding',
+  ]);
+}
+
+{
+  const input = {
+    key: pem.toString(),
+    encoding: 'invalid',
+    get format() { return 'pem'; },
+    get type() { return assert.fail('String conversion must precede encoding option parsing'); },
+  };
+  assert.throws(() => prepareAsymmetricKey(input, kConsumePrivate), { code: 'ERR_UNKNOWN_ENCODING' });
+}
+
+{
+  const raw = keyObject.export({ format: 'raw-private' });
+  const input = { key: raw, format: 'raw-private', asymmetricKeyType: 'ec', namedCurve: 'P-256' };
+  assert.strictEqual(prepareAsymmetricKey(input, kConsumePrivate).data, raw);
+  assert.throws(() => prepareAsymmetricKey({ ...input, key: raw.toString('hex') }, kConsumePrivate), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+}
+
+for (const encoding of [undefined, 'buffer', 'utf8', 'hex', 'base64']) {
+  const inputEncoding = encoding === 'buffer' ? 'utf8' : encoding;
+  const passphrase = Buffer.from('password');
+  const result = prepareAsymmetricKey({
+    key: pem.toString(inputEncoding),
+    passphrase: passphrase.toString(inputEncoding),
+    encoding,
+  }, kConsumePrivate);
+  assert.deepStrictEqual(result.data, pem);
+  assert.deepStrictEqual(result.passphrase, passphrase);
+}
+
+for (const [options, optionName] of [
+  [{ format: 'invalid' }, 'format'],
+  [{ format: 'der', type: 'invalid' }, 'type'],
+]) {
+  assert.throws(() => prepareAsymmetricKey({ key: pem, ...options }, kConsumePrivate, 'options.key'), {
+    code: 'ERR_INVALID_ARG_VALUE',
+    message: new RegExp(`options\\.key\\.${optionName}`),
+  });
+}
diff --git a/test/parallel/test-crypto-private-decrypt-gh32240.js b/test/parallel/test-crypto-private-decrypt-gh32240.js
index 1ff5b565d6d5..a38fcba6775e 100644
--- a/test/parallel/test-crypto-private-decrypt-gh32240.js
+++ b/test/parallel/test-crypto-private-decrypt-gh32240.js
@@ -14,29 +14,57 @@ const {
   privateDecrypt,
 } = require('crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
 
-const pair = generateKeyPairSync('rsa', { modulusLength: 512 });
+const fips3 = hasFIPS(3);
+const fips4 = hasFIPS(4);
+const pair = generateKeyPairSync('rsa', {
+  modulusLength: fips3 ? 2048 : 512,
+});
 
 const expected = Buffer.from('shibboleth');
-const encrypted = publicEncrypt(pair.publicKey, expected);
+const options = fips3 ? { oaepHash: 'sha256' } : {};
+const encrypted = publicEncrypt({ key: pair.publicKey, ...options }, expected);
 
 const pkey = pair.privateKey.export({ type: 'pkcs1', format: 'pem' });
-const pkeyEncrypted =
-  pair.privateKey.export({
+if (fips3) {
+  assert.throws(() => pair.privateKey.export({
     type: 'pkcs1',
     format: 'pem',
     cipher: 'aes-128-cbc',
     passphrase: 'secret',
+  }), {
+    code: 'ERR_OSSL_EVP_UNSUPPORTED',
+  });
+}
+if (fips4) {
+  assert.throws(() => pair.privateKey.export({
+    type: 'pkcs8',
+    format: 'pem',
+    cipher: 'aes-256-cbc',
+    passphrase: 'secret',
+  }), {
+    code: 'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK',
+  });
+}
+const pkeyEncrypted =
+  pair.privateKey.export({
+    type: fips3 ? 'pkcs8' : 'pkcs1',
+    format: 'pem',
+    cipher: fips3 ? 'aes-256-cbc' : 'aes-128-cbc',
+    passphrase: 'password',
   });
 
 function decrypt(key) {
-  const decrypted = privateDecrypt(key, encrypted);
+  const decrypted = privateDecrypt({ key, ...options }, encrypted);
   assert.deepStrictEqual(decrypted, expected);
 }
 
 decrypt(pkey);
-assert.throws(() => decrypt(pkeyEncrypted), hasOpenSSL3 ?
+assert.throws(() => decrypt(pkeyEncrypted), hasOpenSSL(3) ?
   { message: 'error:07880109:common libcrypto routines::interrupted or ' +
              'cancelled' } :
   { code: 'ERR_MISSING_PASSPHRASE' });
diff --git a/test/parallel/test-crypto-provider-cache-snapshot.js b/test/parallel/test-crypto-provider-cache-snapshot.js
new file mode 100644
index 000000000000..522dedfc436a
--- /dev/null
+++ b/test/parallel/test-crypto-provider-cache-snapshot.js
@@ -0,0 +1,28 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+const { buildSnapshot, runWithSnapshot } = require('../common/snapshot');
+
+if (!hasOpenSSL(3) || isBoringSSL)
+  common.skip('this test requires OpenSSL 3.x');
+
+const entry = fixtures.path('snapshot', 'crypto-provider-cache.js');
+const buildEnv = {
+  OPENSSL_CONF: fixtures.path(
+    'openssl3-conf', 'legacy_provider_enabled.cnf'),
+};
+const runEnv = {
+  OPENSSL_CONF: fixtures.path('openssl3-conf', 'default_only.cnf'),
+};
+
+tmpdir.refresh();
+buildSnapshot(entry, buildEnv);
+const { stdout } = runWithSnapshot(undefined, runEnv);
+assert.match(stdout, /provider crypto caches snapshot: ok/);
diff --git a/test/parallel/test-crypto-provider-cache.js b/test/parallel/test-crypto-provider-cache.js
new file mode 100644
index 000000000000..4767d47dc52a
--- /dev/null
+++ b/test/parallel/test-crypto-provider-cache.js
@@ -0,0 +1,364 @@
+// Flags: --expose-internals --no-warnings
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+if (!hasOpenSSL(3) || isBoringSSL)
+  common.skip('this test requires OpenSSL 3 provider support');
+
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const { once } = require('node:events');
+const {
+  isMainThread,
+  parentPort,
+  Worker,
+  workerData,
+} = require('node:worker_threads');
+const { getMacCache } = require('internal/crypto/util');
+const { internalBinding } = require('internal/test/binding');
+
+if (!isMainThread && !workerData?.cryptoCacheTest)
+  common.skip('crypto.setFips() is not supported in workers');
+
+const binding = internalBinding('crypto');
+const getters = ['getCiphers', 'getHashes', 'getMacs', 'getCurves'];
+const cipherAlgorithm = 'camellia-128-cbc-cts';
+const cipherKey = Buffer.alloc(16);
+const iv = Buffer.alloc(16);
+const plaintext = Buffer.alloc(32);
+const hashAlgorithm = 'md5';
+const emptyHash = 'd41d8cd98f00b204e9800998ecf8427e';
+const macAlgorithm = 'poly1305';
+const macKey = Buffer.from(
+  '85d6be7857556d337f4452fe42d506a8' +
+  '0103808afb0db2fd4abff6af4149f51b',
+  'hex',
+);
+const macData = Buffer.from('Cryptographic Forum Research Group');
+const expectedMac = 'a8061dc1305136c6c22b8baf0c0127a9';
+const curve = 'secp256k1';
+
+function checkLists() {
+  const lists = {};
+  for (const name of getters) {
+    const list = crypto[name]();
+    assert(list.every((entry) => typeof entry === 'string'), name);
+    assert.deepStrictEqual(list, [...list].sort(), name);
+    assert.strictEqual(
+      new Set(list.map((entry) => entry.toLowerCase())).size,
+      list.length,
+      name,
+    );
+    const disposable = crypto[name]();
+    assert.notStrictEqual(disposable, list, name);
+    disposable.length = 0;
+    disposable.push('not-a-real-algorithm');
+    assert.deepStrictEqual(crypto[name](), list, name);
+    lists[name] = list;
+  }
+  return lists;
+}
+
+function getAliasId(aliases, name) {
+  const normalized = name.toLowerCase();
+  for (const [alias, id] of Object.entries(aliases)) {
+    if (alias.toLowerCase() === normalized) return id;
+  }
+  return undefined;
+}
+
+function checkMacAliases() {
+  // Both spellings must refer to one cached EVP_MAC.
+  const aliases = binding.getCachedMacAliases();
+  const id = getAliasId(aliases, 'kmac128');
+  const hyphenatedId = getAliasId(aliases, 'kmac-128');
+  if (id === undefined || hyphenatedId === undefined) {
+    common.printSkipMessage('KMAC-128 aliases are not available');
+    return;
+  }
+  assert.strictEqual(id, hyphenatedId);
+  const options = { outputLength: 32 };
+  const key = Buffer.alloc(32, 0x42);
+  const data = Buffer.from('cache alias test');
+  assert.deepStrictEqual(
+    crypto.createMac('KMAC128', key, options).update(data).final(),
+    crypto.createMac('KMAC-128', key, options).update(data).final(),
+  );
+  const after = binding.getCachedMacAliases();
+  assert.strictEqual(getAliasId(after, 'kmac128'), id);
+  assert.strictEqual(getAliasId(after, 'kmac-128'), id);
+}
+
+function createFixtures(lists) {
+  const fixtures = {};
+  if (lists.getCiphers.includes(cipherAlgorithm)) {
+    const info = crypto.getCipherInfo(cipherAlgorithm);
+    assert(info);
+    assert.deepStrictEqual(
+      crypto.getCipherInfo(cipherAlgorithm.toUpperCase()), info);
+    assert.deepStrictEqual(crypto.getCipherInfo(cipherAlgorithm), info);
+    fixtures.cipher = crypto.createCipheriv(cipherAlgorithm, cipherKey, iv);
+  } else {
+    common.printSkipMessage(`${cipherAlgorithm} is not supported`);
+  }
+  for (let i = 0; i < 2; i++) {
+    assert.strictEqual(
+      crypto.getCipherInfo('node-test-unknown-provider-cipher'), undefined);
+  }
+  fixtures.hash = lists.getHashes.includes(hashAlgorithm);
+  if (lists.getMacs.includes(macAlgorithm)) {
+    fixtures.mac = crypto.createMac(macAlgorithm, macKey).update(macData);
+    fixtures.macId = getAliasId(binding.getCachedMacAliases(), macAlgorithm);
+    assert.strictEqual(typeof fixtures.macId, 'number');
+  } else {
+    common.printSkipMessage(`${macAlgorithm} is not supported`);
+  }
+  checkMacAliases();
+  if (lists.getCurves.includes(curve)) {
+    fixtures.ecdh = crypto.createECDH(curve);
+    fixtures.ecdh.generateKeys();
+    fixtures.peer = crypto.createECDH(curve).generateKeys();
+    fixtures.ecdh.computeSecret(fixtures.peer);
+  }
+  return fixtures;
+}
+
+function checkEnabled(fixtures, available) {
+  // Availability comes from a fresh environment. Exercise cached handles before
+  // refreshing the warmed JavaScript lists.
+  assert(!available.getCiphers.includes(cipherAlgorithm));
+  assert(!available.getHashes.includes(hashAlgorithm));
+  assert(!available.getCurves.includes(curve));
+  if (fixtures.cipher !== undefined) {
+    assert.strictEqual(crypto.getCipherInfo(cipherAlgorithm), undefined);
+    assert.throws(
+      () => crypto.createCipheriv(cipherAlgorithm, cipherKey, iv),
+      { code: 'ERR_CRYPTO_UNKNOWN_CIPHER' },
+    );
+    const output = Buffer.concat([
+      fixtures.cipher.update(plaintext), fixtures.cipher.final(),
+    ]);
+    assert.strictEqual(output.length, plaintext.length);
+  }
+  if (fixtures.mac !== undefined) {
+    if (!available.getMacs.includes(macAlgorithm)) {
+      assert.throws(() => crypto.createMac(macAlgorithm, macKey), {
+        code: 'ERR_CRYPTO_INVALID_MAC',
+      });
+      assert.strictEqual(
+        getAliasId(binding.getCachedMacAliases(), macAlgorithm), undefined);
+    }
+    assert.strictEqual(fixtures.mac.final('hex'), expectedMac);
+  }
+  if (fixtures.ecdh !== undefined) {
+    // Existing keys and keys installed after the transition obey current policy.
+    const error = { code: 'ERR_CRYPTO_INVALID_KEYPAIR', name: 'RangeError' };
+    assert.throws(() => fixtures.ecdh.computeSecret(fixtures.peer), error);
+    const installed = crypto.createECDH(curve);
+    installed.setPrivateKey(Buffer.from('cafebabe'.repeat(8), 'hex'));
+    assert.throws(() => installed.computeSecret(fixtures.peer), error);
+  }
+}
+
+function checkDisabled(fixtures) {
+  if (fixtures.cipher !== undefined) {
+    assert(crypto.getCipherInfo(cipherAlgorithm));
+    const cipher = crypto.createCipheriv(cipherAlgorithm, cipherKey, iv);
+    const output = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    assert.strictEqual(output.length, plaintext.length);
+  }
+  if (fixtures.hash) {
+    assert.strictEqual(crypto.createHash(hashAlgorithm).digest('hex'), emptyHash);
+  }
+  if (fixtures.mac !== undefined) {
+    assert.strictEqual(
+      crypto.createMac(macAlgorithm, macKey).update(macData).final('hex'),
+      expectedMac,
+    );
+    const id = getAliasId(binding.getCachedMacAliases(), macAlgorithm);
+    assert.strictEqual(typeof id, 'number');
+    assert.notStrictEqual(id, fixtures.macId);
+  }
+  if (fixtures.ecdh !== undefined) fixtures.ecdh.computeSecret(fixtures.peer);
+}
+
+function setFips(value) {
+  const before = crypto.getFips();
+  const generation = binding.getFipsCryptoGeneration();
+  try {
+    crypto.setFips(value);
+  } catch (err) {
+    assert.strictEqual(crypto.getFips(), before);
+    assert.strictEqual(binding.getFipsCryptoGeneration(), generation);
+    throw err;
+  }
+  assert.strictEqual(crypto.getFips(), value);
+  assert.strictEqual(
+    binding.getFipsCryptoGeneration(),
+    generation + (before === value ? 0n : 1n),
+  );
+}
+
+// Cached IDs are written back through JavaScript properties. Setter failures
+// must propagate for both a stale ID and an uncached (-1) ID.
+function withMacCacheSetter(fixtures, toggle) {
+  if (fixtures.mac === undefined) return toggle();
+  const cache = getMacCache();
+  const name = Object.keys(cache).find(
+    (name) => name.toLowerCase() === macAlgorithm);
+  assert(name);
+  const descriptor = Object.getOwnPropertyDescriptor(cache, name);
+  assert.strictEqual(descriptor.value, fixtures.macId);
+  const sentinel = new Error('mac cache setter');
+  function install(id) {
+    Object.defineProperty(cache, name, {
+      __proto__: null,
+      configurable: true,
+      enumerable: descriptor.enumerable,
+      get() { return id; },
+      set() { throw sentinel; },
+    });
+  }
+
+  function check() {
+    assert.throws(() => crypto.createMac(name, macKey), (err) => err === sentinel);
+  }
+  try {
+    install(-1);
+    check();
+    install(descriptor.value);
+    toggle();
+    check();
+    install(-1);
+    check();
+  } finally {
+    Object.defineProperty(cache, name, descriptor);
+  }
+}
+
+if (!isMainThread) {
+  function reply(phase, lists) {
+    parentPort.postMessage({
+      phase,
+      lists,
+      fips: crypto.getFips(),
+      generation: binding.getFipsCryptoGeneration(),
+    });
+  }
+  if (workerData.listsOnly) {
+    parentPort.once('message', common.mustCall(() => {
+      reply('fresh', checkLists());
+    }));
+    parentPort.postMessage('ready');
+  } else {
+    let lists = checkLists();
+    const fixtures = createFixtures(lists);
+    assert.throws(() => setFips(1), {
+      code: 'ERR_WORKER_UNSUPPORTED_OPERATION',
+    });
+    assert.deepStrictEqual(checkLists(), lists);
+    reply('warm', lists);
+    parentPort.on('message', common.mustCallAtLeast(({ phase, available }) => {
+      if (phase === 'done') {
+        parentPort.close();
+        return;
+      }
+      if (phase === 'fips-on') checkEnabled(fixtures, available);
+      if (phase === 'fips-off') checkDisabled(fixtures);
+      const next = checkLists();
+      if (phase === 'unchanged') assert.deepStrictEqual(next, lists);
+      lists = next;
+      reply(phase, lists);
+    }));
+  }
+} else {
+  async function main() {
+    const originalFips = crypto.getFips();
+    const originalLists = checkLists();
+    try {
+      setFips(0);
+    } catch (err) {
+      if (err.code !== 'ERR_CRYPTO_FIPS_FORCED') throw err;
+      assert.deepStrictEqual(checkLists(), originalLists);
+      common.printSkipMessage('FIPS mode cannot be disabled');
+      return;
+    }
+    let worker;
+    let freshWorker;
+    try {
+      const defaultLists = checkLists();
+      const fixtures = createFixtures(defaultLists);
+      worker = new Worker(__filename, { workerData: { cryptoCacheTest: true } });
+      worker.on('error', common.mustNotCall());
+      const exitPromise = once(worker, 'exit');
+      function checkReply(message, phase, lists) {
+        assert.strictEqual(message.phase, phase);
+        assert.strictEqual(message.fips, crypto.getFips());
+        assert.strictEqual(
+          message.generation, binding.getFipsCryptoGeneration());
+        assert.deepStrictEqual(message.lists, lists);
+      }
+
+      async function exchange(phase, lists) {
+        const response = once(worker, 'message');
+        worker.postMessage({ phase, available: lists });
+        const [message] = await response;
+        checkReply(message, phase, lists);
+      }
+      const [warm] = await once(worker, 'message');
+      checkReply(warm, 'warm', defaultLists);
+
+      setFips(0);
+      assert.deepStrictEqual(checkLists(), defaultLists);
+      await exchange('unchanged', defaultLists);
+
+      // AIX uses OpenSSL entropy when initializing a worker's V8 isolate.
+      // Start it before enabling FIPS properties, which can succeed without a
+      // FIPS provider, but defer its first cache lookup until after the toggle.
+      freshWorker = new Worker(__filename, {
+        workerData: { cryptoCacheTest: true, listsOnly: true },
+      });
+      freshWorker.on('error', common.mustNotCall());
+      const freshExit = once(freshWorker, 'exit');
+      const [ready] = await once(freshWorker, 'message');
+      assert.strictEqual(ready, 'ready');
+
+      withMacCacheSetter(fixtures, () => setFips(1));
+      // A cold environment provides independent expectations for both native
+      // and JavaScript caches, including when no FIPS provider is installed.
+      const freshResponse = once(freshWorker, 'message');
+      freshWorker.postMessage('read');
+      const [fresh] = await freshResponse;
+      const [freshCode] = await freshExit;
+      assert.strictEqual(freshCode, 0);
+      const enabledLists = fresh.lists;
+      checkReply(fresh, 'fresh', enabledLists);
+      checkEnabled(fixtures, enabledLists);
+      assert.deepStrictEqual(checkLists(), enabledLists);
+      await exchange('fips-on', enabledLists);
+
+      setFips(1);
+      assert.deepStrictEqual(checkLists(), enabledLists);
+      await exchange('unchanged', enabledLists);
+
+      setFips(0);
+      checkDisabled(fixtures);
+      assert.deepStrictEqual(checkLists(), defaultLists);
+      await exchange('fips-off', defaultLists);
+
+      worker.postMessage({ phase: 'done' });
+      const [code] = await exitPromise;
+      assert.strictEqual(code, 0);
+    } finally {
+      if (freshWorker !== undefined && freshWorker.threadId !== -1)
+        await freshWorker.terminate();
+      if (worker !== undefined && worker.threadId !== -1) await worker.terminate();
+      setFips(originalFips);
+    }
+  }
+  main().then(common.mustCall());
+}
diff --git a/test/parallel/test-crypto-provider-hash-options.js b/test/parallel/test-crypto-provider-hash-options.js
new file mode 100644
index 000000000000..ecccc02f01e4
--- /dev/null
+++ b/test/parallel/test-crypto-provider-hash-options.js
@@ -0,0 +1,389 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+if (Number(process.versions.openssl.split('.')[0]) < 4 ||
+    isBoringSSL) {
+  common.skip('OpenSSL 4 provider support is required');
+}
+
+const assert = require('node:assert');
+const {
+  createHash,
+  getHashes,
+  hash,
+} = require('node:crypto');
+const { internalBinding } = require('internal/test/binding');
+const {
+  HashJob,
+  kCryptoJobSync,
+  kCryptoJobWebCrypto,
+} = internalBinding('crypto');
+
+const hashes = getHashes();
+const hashNames = new Map(
+  hashes.map((name) => [name.toLowerCase(), name]),
+);
+
+let exercised = false;
+
+function findHash(...names) {
+  for (const name of names) {
+    const result = hashNames.get(name);
+    if (result !== undefined) return result;
+  }
+  return undefined;
+}
+
+function testHashJob(args, expected) {
+  const { 0: err, 1: result } = new HashJob(
+    kCryptoJobSync,
+    ...args,
+  ).run();
+  assert.strictEqual(err, undefined);
+  assert.deepStrictEqual(Buffer.from(result), expected);
+
+  (async () => {
+    const asyncResult = await new HashJob(
+      kCryptoJobWebCrypto,
+      ...args,
+    ).run();
+    assert.deepStrictEqual(Buffer.from(asyncResult), expected);
+  })().then(common.mustCall());
+}
+
+const cshakeVectors = [
+  {
+    names: ['cshake-128', 'cshake128'],
+    shakeNames: ['shake128', 'shake-128'],
+    outputLength: 32,
+    input: Buffer.from('00010203', 'hex'),
+    expected: 'c1c36925b6409a04f1b504fcbca9d82b' +
+              '4017277cb5ed2b2065fc1d3814d5aaf5',
+  },
+  {
+    names: ['cshake-256', 'cshake256'],
+    shakeNames: ['shake256', 'shake-256'],
+    outputLength: 64,
+    input: Buffer.from('00010203', 'hex'),
+    expected: 'd008828e2b80ac9d2218ffee1d070c48' +
+              'b8e4c87bff32c9699d5b6896eee0edd1' +
+              '64020e2be0560858d9c00c037e34a96' +
+              '937c561a74c412bb4c746469527281c8c',
+  },
+];
+
+for (const vector of cshakeVectors) {
+  const algorithm = findHash(...vector.names);
+  if (algorithm === undefined) {
+    common.printSkipMessage(`${vector.names[0]} is not available`);
+    continue;
+  }
+
+  exercised = true;
+
+  const options = {
+    outputLength: vector.outputLength,
+    customization: 'Email Signature',
+  };
+  const streaming = createHash(algorithm, options)
+    .update(vector.input.subarray(0, 2))
+    .update(vector.input.subarray(2))
+    .digest('hex');
+  const partial = createHash(algorithm, options)
+    .update(vector.input.subarray(0, 2));
+  const copyOptionReads = [];
+  const copied = partial.copy({
+    get outputLength() {
+      copyOptionReads.push('outputLength');
+      return vector.outputLength;
+    },
+    get functionName() {
+      copyOptionReads.push('functionName');
+      return undefined;
+    },
+    get customization() {
+      copyOptionReads.push('customization');
+      return undefined;
+    },
+  })
+    .update(vector.input.subarray(2))
+    .digest('hex');
+
+  assert.strictEqual(streaming, vector.expected);
+  assert.strictEqual(copied, vector.expected);
+  assert.deepStrictEqual(copyOptionReads, ['outputLength']);
+  assert.strictEqual(hash(algorithm, vector.input, options), vector.expected);
+
+  // BufferSource parameters have the same semantics as their string form.
+  const bufferOptions = {
+    ...options,
+    customization: Buffer.from(options.customization),
+  };
+  assert.strictEqual(
+    createHash(algorithm, bufferOptions).update(vector.input).digest('hex'),
+    vector.expected,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, bufferOptions),
+    vector.expected,
+  );
+
+  // Without function-name and customization parameters, cSHAKE is SHAKE.
+  const withoutParameters = createHash(algorithm)
+    .update(vector.input)
+    .digest('hex');
+  assert.strictEqual(hash(algorithm, vector.input), withoutParameters);
+
+  // Explicit undefined parameters have the same semantics as omitted ones.
+  const undefinedOptions = {
+    outputLength: vector.outputLength,
+    functionName: undefined,
+    customization: undefined,
+  };
+  assert.strictEqual(
+    createHash(algorithm, undefinedOptions).update(vector.input).digest('hex'),
+    withoutParameters,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, undefinedOptions),
+    withoutParameters,
+  );
+
+  // Empty BufferSource parameters are still supplied to OpenSSL, but cSHAKE
+  // with two empty parameters is equivalent to SHAKE.
+  const emptyOptions = {
+    outputLength: vector.outputLength,
+    functionName: Buffer.alloc(0),
+    customization: new Uint8Array(0),
+  };
+  assert.strictEqual(
+    createHash(algorithm, emptyOptions).update(vector.input).digest('hex'),
+    withoutParameters,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, emptyOptions),
+    withoutParameters,
+  );
+  const emptyFunctionNameOptions = {
+    outputLength: vector.outputLength,
+    functionName: Buffer.alloc(0),
+  };
+  assert.strictEqual(
+    createHash(algorithm, emptyFunctionNameOptions)
+      .update(vector.input)
+      .digest('hex'),
+    withoutParameters,
+  );
+  assert.strictEqual(
+    hash(algorithm, vector.input, emptyFunctionNameOptions),
+    withoutParameters,
+  );
+
+  const createHashOptionReads = [];
+  assert.strictEqual(
+    createHash(algorithm, {
+      get outputLength() {
+        createHashOptionReads.push('outputLength');
+        return vector.outputLength;
+      },
+      get functionName() {
+        createHashOptionReads.push('functionName');
+        return undefined;
+      },
+      get customization() {
+        createHashOptionReads.push('customization');
+        return undefined;
+      },
+    }).update(vector.input).digest('hex'),
+    withoutParameters,
+  );
+  assert.deepStrictEqual(
+    createHashOptionReads,
+    ['outputLength', 'functionName', 'customization'],
+  );
+
+  const hashOptionReads = [];
+  assert.strictEqual(
+    hash(algorithm, vector.input, {
+      get outputLength() {
+        hashOptionReads.push('outputLength');
+        return vector.outputLength;
+      },
+      get outputEncoding() {
+        hashOptionReads.push('outputEncoding');
+        return 'hex';
+      },
+      get functionName() {
+        hashOptionReads.push('functionName');
+        return undefined;
+      },
+      get customization() {
+        hashOptionReads.push('customization');
+        return undefined;
+      },
+    }),
+    withoutParameters,
+  );
+  assert.deepStrictEqual(
+    hashOptionReads,
+    ['outputLength', 'outputEncoding', 'functionName', 'customization'],
+  );
+
+  for (const zeroLengthOptions of [
+    { outputLength: 0 },
+    {
+      outputLength: 0,
+      functionName: Buffer.alloc(0),
+      customization: new Uint8Array(0),
+    },
+  ]) {
+    assert.deepStrictEqual(
+      createHash(algorithm, zeroLengthOptions).update(vector.input).digest(),
+      Buffer.alloc(0),
+    );
+    assert.strictEqual(
+      hash(algorithm, vector.input, zeroLengthOptions),
+      '',
+    );
+  }
+
+  const shake = findHash(...vector.shakeNames);
+  if (shake !== undefined) {
+    assert.strictEqual(
+      withoutParameters,
+      createHash(shake, { outputLength: vector.outputLength })
+        .update(vector.input)
+        .digest('hex'),
+    );
+  }
+
+  const namedOptions = {
+    outputLength: vector.outputLength,
+    functionName: 'KMAC',
+    customization: 'Node.js',
+  };
+  let namedResult;
+  try {
+    namedResult = createHash(algorithm, namedOptions)
+      .update(vector.input)
+      .digest();
+  } catch {
+    common.printSkipMessage(
+      `${algorithm} does not support the KMAC function name`,
+    );
+  }
+  if (namedResult !== undefined) {
+    assert.deepStrictEqual(
+      hash(algorithm, vector.input, {
+        ...namedOptions,
+        outputEncoding: 'buffer',
+      }),
+      namedResult,
+    );
+    assert.deepStrictEqual(
+      createHash(algorithm, {
+        ...namedOptions,
+        functionName: Buffer.from(namedOptions.functionName),
+        customization: new Uint8Array(Buffer.from(namedOptions.customization)),
+      }).update(vector.input).digest(),
+      namedResult,
+    );
+    assert.deepStrictEqual(
+      hash(algorithm, vector.input, {
+        ...namedOptions,
+        functionName: Buffer.from(namedOptions.functionName),
+        customization: new Uint8Array(Buffer.from(namedOptions.customization)),
+        outputEncoding: 'buffer',
+      }),
+      namedResult,
+    );
+  }
+
+  for (const functionName of ['', 'TupleHash', 'ParallelHash', 'KMAC']) {
+    const functionOptions = {
+      outputLength: vector.outputLength,
+      functionName,
+    };
+    let functionResult;
+    try {
+      functionResult = createHash(algorithm, functionOptions)
+        .update(vector.input)
+        .digest();
+    } catch {
+      common.printSkipMessage(
+        `${algorithm} does not support the ${functionName} function name`,
+      );
+      continue;
+    }
+    assert.deepStrictEqual(
+      functionResult,
+      hash(algorithm, vector.input, {
+        ...functionOptions,
+        outputEncoding: 'buffer',
+      }),
+    );
+  }
+
+  testHashJob([
+    algorithm,
+    vector.input,
+    vector.outputLength * 8,
+    undefined,
+    Buffer.from(options.customization),
+  ], Buffer.from(vector.expected, 'hex'));
+
+  for (const invalidOptions of [
+    { functionName: 1 },
+    { customization: {} },
+  ]) {
+    const expected = { code: 'ERR_INVALID_ARG_TYPE' };
+    assert.throws(() => createHash(algorithm, invalidOptions), expected);
+    assert.throws(
+      () => hash(algorithm, vector.input, invalidOptions),
+      expected,
+    );
+  }
+
+  for (const invalidOptions of [
+    { functionName: 'KMAC\0' },
+    { customization: 'Node\0js' },
+    { customization: Buffer.from([0x61, 0x00, 0x62]) },
+  ]) {
+    const expected = { code: 'ERR_INVALID_ARG_VALUE' };
+    assert.throws(() => createHash(algorithm, invalidOptions), expected);
+    assert.throws(
+      () => hash(algorithm, vector.input, invalidOptions),
+      expected,
+    );
+  }
+}
+
+if (cshakeVectors.some(({ names }) => findHash(...names) !== undefined)) {
+  for (const mismatchedOptions of [
+    { functionName: 'KMAC' },
+    { customization: 'Node.js' },
+    { functionName: Buffer.alloc(0) },
+    { customization: new Uint8Array(0) },
+  ]) {
+    assert.throws(
+      () => createHash('sha256', mismatchedOptions),
+      { message: 'Digest method not supported' },
+    );
+    assert.throws(
+      () => hash('sha256', Buffer.from('abc'), mismatchedOptions),
+      { message: 'Digest options are not supported' },
+    );
+  }
+}
+
+if (!exercised) {
+  common.printSkipMessage('cSHAKE is not available');
+}
diff --git a/test/parallel/test-crypto-provider-hashes.js b/test/parallel/test-crypto-provider-hashes.js
new file mode 100644
index 000000000000..5e6883039100
--- /dev/null
+++ b/test/parallel/test-crypto-provider-hashes.js
@@ -0,0 +1,252 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const assert = require('node:assert');
+const {
+  createHash,
+  createHmac,
+  createSign,
+  createVerify,
+  generateKeyPair,
+  generateKeyPairSync,
+  getHashes,
+  hash,
+  hkdf,
+  hkdfSync,
+  pbkdf2,
+  pbkdf2Sync,
+  privateDecrypt,
+  publicEncrypt,
+  sign,
+  verify,
+} = require('node:crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3) || isBoringSSL) {
+  common.skip('OpenSSL 3 provider support is required');
+}
+
+const { internalBinding } = require('internal/test/binding');
+const {
+  HashJob,
+  kCryptoJobSync,
+  kCryptoJobWebCrypto,
+} = internalBinding('crypto');
+
+const hashes = getHashes();
+const lowercaseHashes = hashes.map((name) => name.toLowerCase());
+if (lowercaseHashes.includes('sha1')) {
+  assert(hashes.includes('RSA-SHA1'));
+}
+assert(!lowercaseHashes.includes('null'));
+assert(!lowercaseHashes.includes('ml-dsa-mu'));
+assert(!hashes.some((name) => /^\d+(?:\.\d+)+$/.test(name)));
+
+for (const name of hashes) {
+  try {
+    createHash(name);
+  } catch (err) {
+    assert.strictEqual(err.code, 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH');
+    createHash(name, { outputLength: 32 });
+  }
+}
+
+const input = Buffer.alloc(0);
+assert.throws(
+  () => createHash('ml-dsa-mu'),
+  /Digest method not supported/,
+);
+assert.throws(
+  () => hash('ml-dsa-mu', input),
+  { message: 'Digest method ml-dsa-mu is not supported' },
+);
+
+const providerVectors = {
+  'keccak-kmac-128': {
+    aliases: ['keccak-kmac-128', 'keccak-kmac128'],
+    expected: '83aa04c211dc19d16912571ed0a75130' +
+              'd36aebd58562dd080c1ea84a8c7d73f7',
+    options: { outputLength: 32 },
+  },
+  'keccak-256': {
+    aliases: ['keccak-256'],
+    expected: 'c5d2460186f7233c927e7db2dcc703c0' +
+              'e500b653ca82273b7bfad8045d85a470',
+  },
+  'sha256-192': {
+    aliases: ['sha2-256/192', 'sha-256/192', 'sha256-192'],
+    expected: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934c',
+  },
+};
+
+function testHashVector({ aliases, expected, options }) {
+  for (const alias of aliases) {
+    if (!hashes.includes(alias)) continue;
+    assert(!hashes.includes(alias.toUpperCase()));
+
+    for (const name of [alias, alias.toUpperCase()]) {
+      const streaming = createHash(name, options).update(input).digest('hex');
+      assert.strictEqual(streaming, expected);
+      assert.strictEqual(hash(name, input, options), expected);
+    }
+  }
+}
+
+// These digests are tested when the active provider advertises them.
+for (const name of ['keccak-kmac-128', 'keccak-256', 'sha256-192']) {
+  const vector = providerVectors[name];
+  if (vector.aliases.some((alias) => hashes.includes(alias))) {
+    testHashVector(vector);
+  } else {
+    common.printSkipMessage(`${name} is not available from the active provider`);
+  }
+}
+
+const keccakKmacName = providerVectors['keccak-kmac-128'].aliases
+  .find((alias) => hashes.includes(alias));
+if (keccakKmacName !== undefined) {
+  (async () => {
+    const { expected } = providerVectors['keccak-kmac-128'];
+    const { 0: err, 1: syncResult } = new HashJob(
+      kCryptoJobSync,
+      keccakKmacName,
+      input,
+      256,
+    ).run();
+    assert.strictEqual(err, undefined);
+    assert.strictEqual(Buffer.from(syncResult).toString('hex'), expected);
+
+    const result = await new HashJob(
+      kCryptoJobWebCrypto,
+      keccakKmacName,
+      input,
+      256,
+    ).run();
+    assert.strictEqual(Buffer.from(result).toString('hex'), expected);
+  })().then(common.mustCall());
+}
+
+if (hashes.includes('sha256-192')) {
+  const operationInput = Buffer.from('abc');
+
+  assert.strictEqual(
+    createHmac('sha256-192', 'key').update(operationInput).digest('hex'),
+    'd7774e586190fa2d2f4d4be4bc86ccd459a9170d52c38809',
+  );
+
+  const hkdfExpected = 'ef23757b94b5e1e46c3f981d87828d7aeb0207733ab5c78' +
+                       'c60df321c9e8c88e0ad54b4eecfef8c258ccd';
+  assert.strictEqual(
+    Buffer.from(hkdfSync('sha256-192', 'key', 'salt', 'info', 42))
+      .toString('hex'),
+    hkdfExpected,
+  );
+  hkdf(
+    'sha256-192',
+    'key',
+    'salt',
+    'info',
+    42,
+    common.mustSucceed((result) => {
+      assert.strictEqual(Buffer.from(result).toString('hex'), hkdfExpected);
+    }),
+  );
+
+  const pbkdf2Expected = '1fee3dd5ea13d5b563d3cc88fbc6dcf7' +
+                         '3497aeffc3b3e6358ab3d3d1aa2aa0ee';
+  assert.strictEqual(
+    pbkdf2Sync('password', 'salt', 2, 32, 'sha256-192').toString('hex'),
+    pbkdf2Expected,
+  );
+  pbkdf2(
+    'password',
+    'salt',
+    2,
+    32,
+    'sha256-192',
+    common.mustSucceed((result) => {
+      assert.strictEqual(result.toString('hex'), pbkdf2Expected);
+    }),
+  );
+
+  const { privateKey: ecPrivateKey, publicKey: ecPublicKey } =
+    generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+  const signature = sign('sha256-192', operationInput, ecPrivateKey);
+  assert(verify('sha256-192', operationInput, ecPublicKey, signature));
+
+  const streamingSignature = createSign('sha256-192')
+    .update(operationInput)
+    .sign(ecPrivateKey);
+  const verifier = createVerify('sha256-192');
+  verifier.update(operationInput);
+  assert(verifier.verify(ecPublicKey, streamingSignature));
+
+  sign(
+    'sha256-192',
+    operationInput,
+    ecPrivateKey,
+    common.mustSucceed((asyncSignature) => {
+      verify(
+        'sha256-192',
+        operationInput,
+        ecPublicKey,
+        asyncSignature,
+        common.mustSucceed((result) => assert(result)),
+      );
+    }),
+  );
+
+  const { privateKey: rsaPrivateKey, publicKey: rsaPublicKey } =
+    generateKeyPairSync('rsa', { modulusLength: 2048 });
+  const plaintext = Buffer.from('provider digest');
+
+  assert.throws(
+    () => sign('sha256-192', plaintext, rsaPrivateKey),
+    { code: 'ERR_OSSL_DIGEST_NOT_ALLOWED' },
+  );
+  assert.deepStrictEqual(
+    privateDecrypt(
+      { key: rsaPrivateKey, oaepHash: 'sha256-192' },
+      publicEncrypt(
+        { key: rsaPublicKey, oaepHash: 'sha256-192' },
+        plaintext,
+      ),
+    ),
+    plaintext,
+  );
+
+  const pssOptions = [
+    {
+      hashAlgorithm: 'sha256-192',
+      modulusLength: 2048,
+    },
+    {
+      hashAlgorithm: 'sha256',
+      mgf1HashAlgorithm: 'sha256-192',
+      modulusLength: 2048,
+    },
+  ];
+  const keyGenerationFailed = { message: 'Key generation job failed' };
+
+  for (const options of pssOptions) {
+    assert.throws(
+      () => generateKeyPairSync('rsa-pss', options),
+      keyGenerationFailed,
+    );
+    generateKeyPair(
+      'rsa-pss',
+      options,
+      common.mustCall((err, publicKey, privateKey) => {
+        assert.strictEqual(err?.message, keyGenerationFailed.message);
+        assert.strictEqual(publicKey, undefined);
+        assert.strictEqual(privateKey, undefined);
+      }),
+    );
+  }
+}
diff --git a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
index 1d64e08920c6..21cc5f3ebce2 100644
--- a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
+++ b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
@@ -7,15 +7,17 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('only openssl3'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901
 }
 
 const assert = require('assert');
 const crypto = require('crypto');
 
+const passphrase = 'password';
+
 const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
   modulusLength: 2048,
   publicKeyEncoding: {
@@ -26,7 +28,7 @@ const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
     type: 'pkcs8',
     format: 'pem',
     cipher: 'aes-128-ecb',
-    passphrase: 'abcdef'
+    passphrase
   }
 });
 assert.notStrictEqual(privateKey.toString(), '');
@@ -35,7 +37,7 @@ const msg = 'The quick brown fox jumps over the lazy dog';
 
 const encryptedString = crypto.privateEncrypt({
   key: privateKey,
-  passphrase: 'abcdef'
+  passphrase
 }, Buffer.from(msg)).toString('base64');
 const decryptedString = crypto.publicDecrypt(publicKey, Buffer.from(encryptedString, 'base64')).toString();
 console.log(`Encrypted: ${encryptedString}`);
diff --git a/test/parallel/test-crypto-raw-key-type-validation.js b/test/parallel/test-crypto-raw-key-type-validation.js
new file mode 100644
index 000000000000..c4ed8f10f523
--- /dev/null
+++ b/test/parallel/test-crypto-raw-key-type-validation.js
@@ -0,0 +1,81 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const { createPrivateKey, createPublicKey } = require('node:crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+
+const key = Buffer.alloc(32);
+const formats = ['raw-public', 'raw-private', 'raw-seed'];
+
+// Recognized classical types reject raw encodings with a format error.
+for (const asymmetricKeyType of ['rsa', 'rsa-pss', 'dsa', 'dh']) {
+  for (const format of formats) {
+    assert.throws(() => createPublicKey({ key, format, asymmetricKeyType }), {
+      code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS',
+    });
+  }
+}
+
+// Only exact public names are accepted, excluding aliases and unexposed types.
+for (const asymmetricKeyType of [
+  'RSA', 'RSA-PSS', 'DSA', 'DH', 'EC', 'sm2', 'SM2', 'unknown',
+  'Ed25519', 'ED25519', 'Ed448', 'ED448', 'X25519', 'X448',
+  'ML-DSA-44', 'Ml-Dsa-65', 'ML-DSA-87',
+  'ML-KEM-512', 'Ml-Kem-768', 'ML-KEM-1024', 'SLH-DSA-SHA2-128s',
+  'rsaEncryption', 'id-ecPublicKey', '1.3.101.112', '1.3.101.110',
+  'ed25519 ', ' ml-dsa-44',
+  'rsa\0suffix', 'ec\0suffix', 'ed25519\0suffix', 'ml-dsa-44\0suffix',
+]) {
+  for (const format of formats) {
+    assert.throws(() => createPublicKey({
+      key, format, asymmetricKeyType, namedCurve: 'P-256',
+    }), {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: `Invalid asymmetricKeyType: ${asymmetricKeyType.split('\0')[0]}`,
+    });
+  }
+}
+
+assert.throws(() => createPublicKey({
+  key, format: 'raw-seed', asymmetricKeyType: 'ec', namedCurve: 'P-256',
+}), { code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS' });
+
+// Recognized OKP and PQC names retain their raw-format restrictions.
+for (const asymmetricKeyType of ['ed25519', 'x25519']) {
+  const options = { key, format: 'raw-private', asymmetricKeyType };
+  if (asymmetricKeyType === 'x25519' && hasFIPS(3, 5)) {
+    assert.throws(() => createPrivateKey(options), {
+      code: 'ERR_INVALID_ARG_VALUE', message: 'Invalid key data',
+    });
+  } else {
+    const imported = createPrivateKey(options);
+    assert.strictEqual(imported.asymmetricKeyType, asymmetricKeyType);
+  }
+  assert.throws(() => createPrivateKey({
+    key, format: 'raw-seed', asymmetricKeyType,
+  }), { code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS' });
+}
+
+{
+  const asymmetricKeyType = 'ml-dsa-44';
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
+    const imported = createPrivateKey({
+      key, format: 'raw-seed', asymmetricKeyType,
+    });
+    assert.strictEqual(imported.asymmetricKeyType, 'ml-dsa-44');
+    assert.throws(() => createPrivateKey({
+      key, format: 'raw-private', asymmetricKeyType,
+    }), { code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS' });
+  } else {
+    for (const format of formats) {
+      assert.throws(() => createPublicKey({ key, format, asymmetricKeyType }), {
+        code: 'ERR_INVALID_ARG_VALUE',
+        message: 'Unsupported key type',
+      });
+    }
+  }
+}
diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
index 35ad67302077..6e47d2a18654 100644
--- a/test/parallel/test-crypto-rsa-dsa.js
+++ b/test/parallel/test-crypto-rsa-dsa.js
@@ -9,7 +9,17 @@ const crypto = require('crypto');
 const constants = crypto.constants;
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasOpenSSL3 } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+  isBoringSSL,
+} = require('../common/crypto');
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+const fips30 = fips3 && !fips35;
+const fips4 = hasFIPS(4);
+const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED';
+const wrongPassphrase = 'wrong-password';
 
 // Test certificates
 const certPem = fixtures.readKey('rsa_cert.crt');
@@ -17,12 +27,14 @@ const keyPem = fixtures.readKey('rsa_private.pem');
 const rsaKeySize = 2048;
 const rsaPubPem = fixtures.readKey('rsa_public.pem', 'ascii');
 const rsaKeyPem = fixtures.readKey('rsa_private.pem', 'ascii');
-const rsaKeyPemEncrypted = fixtures.readKey('rsa_private_encrypted.pem',
-                                            'ascii');
+// Fixed ciphertexts keep wrong passwords from occasionally producing valid
+// padding and a decoder error instead of the expected bad decrypt.
+const rsaKeyPemEncrypted = fixtures.readKey(
+  'rsa_private_encrypted.pem', 'ascii');
 const dsaPubPem = fixtures.readKey('dsa_public.pem', 'ascii');
 const dsaKeyPem = fixtures.readKey('dsa_private.pem', 'ascii');
-const dsaKeyPemEncrypted = fixtures.readKey('dsa_private_encrypted.pem',
-                                            'ascii');
+const dsaKeyPemEncrypted = fixtures.readKey(
+  'dsa_private_encrypted.pem', 'ascii');
 const rsaPkcs8KeyPem = fixtures.readKey('rsa_private_pkcs8.pem');
 const dsaPkcs8KeyPem = fixtures.readKey('dsa_private_pkcs8.pem');
 
@@ -37,20 +49,23 @@ const openssl1DecryptError = {
   library: 'digital envelope routines',
 };
 
-const decryptError = hasOpenSSL3 ?
-  { message: 'error:1C800064:Provider routines::bad decrypt' } :
-  process.features.openssl_is_boringssl ? {
-    message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
-    code: 'ERR_OSSL_BAD_DECRYPT',
-    reason: 'BAD_DECRYPT',
-    function: 'OPENSSL_internal',
-    library: 'Cipher functions',
-  } :
-    openssl1DecryptError;
-
-const decryptPrivateKeyError = hasOpenSSL3 ? {
+const decryptError = fips4 ?
+  { code: 'ERR_OSSL_BAD_DECRYPT' } : hasOpenSSL(3) ?
+    { message: 'error:1C800064:Provider routines::bad decrypt' } :
+    isBoringSSL ? {
+      message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
+      code: 'ERR_OSSL_BAD_DECRYPT',
+      reason: 'BAD_DECRYPT',
+      function: 'OPENSSL_internal',
+      library: 'Cipher functions',
+    } :
+      openssl1DecryptError;
+
+const decryptPrivateKeyError = fips4 ? {
+  code: 'ERR_OSSL_BAD_DECRYPT',
+} : hasOpenSSL(3) ? {
   message: 'error:1C800064:Provider routines::bad decrypt',
-} : process.features.openssl_is_boringssl ? {
+} : isBoringSSL ? {
   message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
 } : openssl1DecryptError;
 
@@ -156,7 +171,7 @@ function getBufferCopy(buf) {
   // Now with RSA_NO_PADDING. Plaintext needs to match key size.
   // OpenSSL 3.x has a rsa_check_padding that will cause an error if
   // RSA_NO_PADDING is used.
-  if (!hasOpenSSL3) {
+  if (!hasOpenSSL(3)) {
     {
       const plaintext = 'x'.repeat(rsaKeySize / 8);
       encryptedBuffer = crypto.privateEncrypt({
@@ -192,14 +207,14 @@ function getBufferCopy(buf) {
   assert.throws(() => {
     crypto.privateDecrypt({
       key: rsaKeyPemEncrypted,
-      passphrase: 'wrong'
+      passphrase: wrongPassphrase
     }, bufferToEncrypt);
   }, decryptError);
 
   assert.throws(() => {
     crypto.publicEncrypt({
       key: rsaKeyPemEncrypted,
-      passphrase: 'wrong'
+      passphrase: wrongPassphrase
     }, encryptedBuffer);
   }, decryptError);
 
@@ -211,7 +226,7 @@ function getBufferCopy(buf) {
   assert.throws(() => {
     crypto.publicDecrypt({
       key: rsaKeyPemEncrypted,
-      passphrase: Buffer.from('wrong')
+      passphrase: Buffer.from(wrongPassphrase)
     }, encryptedBuffer);
   }, decryptError);
 }
@@ -336,7 +351,7 @@ function test_rsa(padding, encryptOaepHash, decryptOaepHash) {
 test_rsa('RSA_NO_PADDING');
 test_rsa('RSA_PKCS1_OAEP_PADDING');
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   test_rsa('RSA_PKCS1_PADDING');
 } else {
   common.printSkipMessage('Skipping unsupported RSA_PKCS1_PADDING test case');
@@ -349,8 +364,12 @@ test_rsa('RSA_PKCS1_OAEP_PADDING', 'sha256', 'sha256');
 test_rsa('RSA_PKCS1_OAEP_PADDING', 'sha512', 'sha512');
 assert.throws(() => {
   test_rsa('RSA_PKCS1_OAEP_PADDING', 'sha256', 'sha512');
-}, {
-  code: 'ERR_OSSL_RSA_OAEP_DECODING_ERROR'
+}, fips35 ? {
+  code: 'ERR_OSSL_EVP_PROVIDER_ASYM_CIPHER_FAILURE',
+} : fips3 ? {
+  message: 'error:00000000:lib(0)::reason(0)',
+} : {
+  code: 'ERR_OSSL_RSA_OAEP_DECODING_ERROR',
 });
 
 // The following RSA-OAEP test cases were created using the WebCrypto API to
@@ -416,8 +435,9 @@ for (const fn of [crypto.publicEncrypt, crypto.privateDecrypt]) {
 }
 
 // Test RSA key signing/verification
-let rsaSign = crypto.createSign('SHA1');
-let rsaVerify = crypto.createVerify('SHA1');
+const rsaDigest = fips3 ? 'SHA256' : 'SHA1';
+let rsaSign = crypto.createSign(rsaDigest);
+let rsaVerify = crypto.createVerify(rsaDigest);
 assert.ok(rsaSign);
 assert.ok(rsaVerify);
 
@@ -428,36 +448,39 @@ const expectedSignature = fixtures.readKey(
 
 rsaSign.update(rsaPubPem);
 let rsaSignature = rsaSign.sign(rsaKeyPem, 'hex');
-assert.strictEqual(rsaSignature, expectedSignature);
+if (!fips3)
+  assert.strictEqual(rsaSignature, expectedSignature);
 
 rsaVerify.update(rsaPubPem);
 assert.strictEqual(rsaVerify.verify(rsaPubPem, rsaSignature, 'hex'), true);
 
 // Test RSA PKCS#8 key signing/verification
-rsaSign = crypto.createSign('SHA1');
+rsaSign = crypto.createSign(rsaDigest);
 rsaSign.update(rsaPubPem);
 rsaSignature = rsaSign.sign(rsaPkcs8KeyPem, 'hex');
-assert.strictEqual(rsaSignature, expectedSignature);
+if (!fips3)
+  assert.strictEqual(rsaSignature, expectedSignature);
 
-rsaVerify = crypto.createVerify('SHA1');
+rsaVerify = crypto.createVerify(rsaDigest);
 rsaVerify.update(rsaPubPem);
 assert.strictEqual(rsaVerify.verify(rsaPubPem, rsaSignature, 'hex'), true);
 
 // Test RSA key signing/verification with encrypted key
-rsaSign = crypto.createSign('SHA1');
+rsaSign = crypto.createSign(rsaDigest);
 rsaSign.update(rsaPubPem);
 const signOptions = { key: rsaKeyPemEncrypted, passphrase: 'password' };
 rsaSignature = rsaSign.sign(signOptions, 'hex');
-assert.strictEqual(rsaSignature, expectedSignature);
+if (!fips3)
+  assert.strictEqual(rsaSignature, expectedSignature);
 
-rsaVerify = crypto.createVerify('SHA1');
+rsaVerify = crypto.createVerify(rsaDigest);
 rsaVerify.update(rsaPubPem);
 assert.strictEqual(rsaVerify.verify(rsaPubPem, rsaSignature, 'hex'), true);
 
-rsaSign = crypto.createSign('SHA1');
+rsaSign = crypto.createSign(rsaDigest);
 rsaSign.update(rsaPubPem);
 assert.throws(() => {
-  const signOptions = { key: rsaKeyPemEncrypted, passphrase: 'wrong' };
+  const signOptions = { key: rsaKeyPemEncrypted, passphrase: wrongPassphrase };
   rsaSign.sign(signOptions, 'hex');
 }, decryptPrivateKeyError);
 
@@ -503,16 +526,17 @@ assert.throws(() => {
 //
 // Test DSA signing and verification
 //
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const input = 'I AM THE WALRUS';
 
   // DSA signatures vary across runs so there is no static string to verify
   // against.
-  const sign = crypto.createSign('SHA1');
+  const dsaDigest = fips3 ? 'SHA256' : 'SHA1';
+  const sign = crypto.createSign(dsaDigest);
   sign.update(input);
   const signature = sign.sign(dsaKeyPem, 'hex');
 
-  const verify = crypto.createVerify('SHA1');
+  const verify = crypto.createVerify(dsaDigest);
   verify.update(input);
 
   assert.strictEqual(verify.verify(dsaPubPem, signature, 'hex'), true);
@@ -520,12 +544,18 @@ if (!process.features.openssl_is_boringssl) {
   // Test the legacy 'DSS1' name.
   const sign2 = crypto.createSign('DSS1');
   sign2.update(input);
-  const signature2 = sign2.sign(dsaKeyPem, 'hex');
+  if (fips30) {
+    assert.throws(() => sign2.sign(dsaKeyPem, 'hex'), {
+      code: fipsDigestErrorCode,
+    });
+  } else {
+    const signature2 = sign2.sign(dsaKeyPem, 'hex');
 
-  const verify2 = crypto.createVerify('DSS1');
-  verify2.update(input);
+    const verify2 = crypto.createVerify('DSS1');
+    verify2.update(input);
 
-  assert.strictEqual(verify2.verify(dsaPubPem, signature2, 'hex'), true);
+    assert.strictEqual(verify2.verify(dsaPubPem, signature2, 'hex'), true);
+  }
 } else {
   common.printSkipMessage('Skipping unsupported DSA test case');
 }
@@ -534,16 +564,17 @@ if (!process.features.openssl_is_boringssl) {
 //
 // Test DSA signing and verification with PKCS#8 private key
 //
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const input = 'I AM THE WALRUS';
 
   // DSA signatures vary across runs so there is no static string to verify
   // against.
-  const sign = crypto.createSign('SHA1');
+  const dsaDigest = fips3 ? 'SHA256' : 'SHA1';
+  const sign = crypto.createSign(dsaDigest);
   sign.update(input);
   const signature = sign.sign(dsaPkcs8KeyPem, 'hex');
 
-  const verify = crypto.createVerify('SHA1');
+  const verify = crypto.createVerify(dsaDigest);
   verify.update(input);
 
   assert.strictEqual(verify.verify(dsaPubPem, signature, 'hex'), true);
@@ -558,22 +589,23 @@ if (!process.features.openssl_is_boringssl) {
 const input = 'I AM THE WALRUS';
 
 {
-  const sign = crypto.createSign('SHA1');
+  const sign = crypto.createSign(fips3 ? 'SHA256' : 'SHA1');
   sign.update(input);
   assert.throws(() => {
-    sign.sign({ key: dsaKeyPemEncrypted, passphrase: 'wrong' }, 'hex');
+    sign.sign({ key: dsaKeyPemEncrypted, passphrase: wrongPassphrase }, 'hex');
   }, decryptPrivateKeyError);
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // DSA signatures vary across runs so there is no static string to verify
   // against.
-  const sign = crypto.createSign('SHA1');
+  const dsaDigest = fips3 ? 'SHA256' : 'SHA1';
+  const sign = crypto.createSign(dsaDigest);
   sign.update(input);
   const signOptions = { key: dsaKeyPemEncrypted, passphrase: 'password' };
   const signature = sign.sign(signOptions, 'hex');
 
-  const verify = crypto.createVerify('SHA1');
+  const verify = crypto.createVerify(dsaDigest);
   verify.update(input);
 
   assert.strictEqual(verify.verify(dsaPubPem, signature, 'hex'), true);
diff --git a/test/parallel/test-crypto-rsa-multiprime-jwk.js b/test/parallel/test-crypto-rsa-multiprime-jwk.js
new file mode 100644
index 000000000000..be434c76e828
--- /dev/null
+++ b/test/parallel/test-crypto-rsa-multiprime-jwk.js
@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const { hasFIPS } = require('../common/crypto');
+const {
+  createPrivateKey,
+} = require('crypto');
+const { subtle } = globalThis.crypto;
+
+if (process.features.openssl_is_boringssl)
+  common.skip('multi-prime RSA is not available with BoringSSL');
+if (hasFIPS())
+  common.skip('multi-prime RSA is not available in FIPS mode');
+
+const privateKey = createPrivateKey(
+  fixtures.readKey('rsa_private_2048_3_primes.pem'));
+const pkcs8 = privateKey.export({ format: 'der', type: 'pkcs8' });
+const jwk = privateKey.export({ format: 'jwk' });
+
+assert.strictEqual(jwk.oth.length, 1);
+assert.deepStrictEqual(Object.keys(jwk.oth[0]), ['r', 'd', 't']);
+
+const importedKey = createPrivateKey({ key: jwk, format: 'jwk' });
+assert.deepStrictEqual(importedKey.export({ format: 'jwk' }), jwk);
+assert.deepStrictEqual(
+  importedKey.export({ format: 'der', type: 'pkcs8' }),
+  pkcs8);
+
+for (const field of ['r', 'd', 't']) {
+  const invalidJwk = {
+    ...jwk,
+    oth: [{ ...jwk.oth[0] }],
+  };
+  delete invalidJwk.oth[0][field];
+  assert.throws(
+    () => createPrivateKey({ key: invalidJwk, format: 'jwk' }),
+    { code: 'ERR_CRYPTO_INVALID_JWK' });
+}
+
+(async () => {
+  const algorithm = { name: 'RSA-PSS', hash: 'SHA-256' };
+  const cryptoKey = await subtle.importKey(
+    'pkcs8', pkcs8, algorithm, true, ['sign']);
+  const exportedJwk = await subtle.exportKey('jwk', cryptoKey);
+
+  const exportedKeyMaterial = { ...exportedJwk };
+  delete exportedKeyMaterial.key_ops;
+  delete exportedKeyMaterial.ext;
+  delete exportedKeyMaterial.alg;
+  assert.deepStrictEqual(exportedKeyMaterial, jwk);
+
+  const importedCryptoKey = await subtle.importKey(
+    'jwk', exportedJwk, algorithm, true, ['sign']);
+  assert.deepStrictEqual(
+    Buffer.from(await subtle.exportKey('pkcs8', importedCryptoKey)),
+    pkcs8);
+})().then(common.mustCall());
diff --git a/test/parallel/test-crypto-rsa-oaep-mgf1.js b/test/parallel/test-crypto-rsa-oaep-mgf1.js
new file mode 100644
index 000000000000..7ba7f19f6b5c
--- /dev/null
+++ b/test/parallel/test-crypto-rsa-oaep-mgf1.js
@@ -0,0 +1,149 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+// Tests the `mgf1Hash` option of crypto.publicEncrypt() and
+// crypto.privateDecrypt(), which allows the MGF1 digest of RSA-OAEP padding to
+// differ from the OAEP message digest (`oaepHash`). This is required for
+// interoperability with profiles such as XML Encryption's `rsa-oaep-mgf1p`,
+// where the OAEP digest may be changed but MGF1 is fixed to SHA-1.
+
+const assert = require('assert');
+const crypto = require('crypto');
+const fixtures = require('../common/fixtures');
+const { hasFIPS } = require('../common/crypto');
+
+const constants = crypto.constants;
+
+const publicKey = fixtures.readKey('rsa_public.pem', 'ascii');
+const privateKey = fixtures.readKey('rsa_private.pem', 'ascii');
+
+const input = Buffer.from('the quick brown fox jumps over the lazy dog');
+
+// A round-trip with mismatched OAEP and MGF1 digests must succeed when both
+// sides agree on the digests.
+{
+  const encrypted = crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+    mgf1Hash: 'sha1',
+  }, input);
+
+  const decrypted = crypto.privateDecrypt({
+    key: privateKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+    mgf1Hash: 'sha1',
+  }, encrypted);
+
+  assert.deepStrictEqual(decrypted, input);
+}
+
+// mgf1Hash actually affects the padding: a ciphertext produced with
+// oaepHash=sha256 and mgf1Hash=sha1 must NOT decrypt when MGF1 defaults to the
+// OAEP digest (sha256), which is the pre-existing behavior.
+{
+  const encrypted = crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+    mgf1Hash: 'sha1',
+  }, input);
+
+  assert.throws(() => {
+    crypto.privateDecrypt({
+      key: privateKey,
+      padding: constants.RSA_PKCS1_OAEP_PADDING,
+      oaepHash: 'sha256',
+      // No mgf1Hash: MGF1 follows oaepHash (sha256) and must fail to unpad.
+    }, encrypted);
+  }, {
+    code: hasFIPS(3, 5) ? 'ERR_OSSL_EVP_PROVIDER_ASYM_CIPHER_FAILURE' :
+      'ERR_OSSL_RSA_OAEP_DECODING_ERROR'
+  });
+}
+
+// Backward compatibility: omitting mgf1Hash on both sides keeps MGF1 == oaepHash
+// (the historical behavior), so this round-trips, and setting mgf1Hash equal to
+// oaepHash is equivalent to omitting it.
+{
+  const encrypted = crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+  }, input);
+
+  const decrypted = crypto.privateDecrypt({
+    key: privateKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+    mgf1Hash: 'sha256',
+  }, encrypted);
+
+  assert.deepStrictEqual(decrypted, input);
+}
+
+// The default oaepHash is sha1, so mgf1Hash defaults to sha1 as well. A
+// ciphertext encrypted with all defaults must decrypt with an explicit
+// mgf1Hash: 'sha1'.
+{
+  const encrypted = crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+  }, input);
+
+  const decrypted = crypto.privateDecrypt({
+    key: privateKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    mgf1Hash: 'sha1',
+  }, encrypted);
+
+  assert.deepStrictEqual(decrypted, input);
+}
+
+// A few other digest combinations round-trip.
+for (const [oaepHash, mgf1Hash] of [
+  ['sha512', 'sha1'],
+  ['sha384', 'sha256'],
+  ['sha1', 'sha256'],
+]) {
+  const encrypted = crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash,
+    mgf1Hash,
+  }, input);
+
+  const decrypted = crypto.privateDecrypt({
+    key: privateKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash,
+    mgf1Hash,
+  }, encrypted);
+
+  assert.deepStrictEqual(decrypted, input);
+}
+
+// mgf1Hash must be a string.
+for (const mgf1Hash of [1, true, {}, [], null]) {
+  assert.throws(() => {
+    crypto.publicEncrypt({
+      key: publicKey,
+      padding: constants.RSA_PKCS1_OAEP_PADDING,
+      oaepHash: 'sha256',
+      mgf1Hash,
+    }, input);
+  }, { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
+// An unknown mgf1Hash digest name is rejected.
+assert.throws(() => {
+  crypto.publicEncrypt({
+    key: publicKey,
+    padding: constants.RSA_PKCS1_OAEP_PADDING,
+    oaepHash: 'sha256',
+    mgf1Hash: 'not-a-real-digest',
+  }, input);
+}, { code: 'ERR_OSSL_EVP_INVALID_DIGEST' });
diff --git a/test/parallel/test-crypto-rsa-pkcs1-public-key.js b/test/parallel/test-crypto-rsa-pkcs1-public-key.js
new file mode 100644
index 000000000000..ee37a17cce28
--- /dev/null
+++ b/test/parallel/test-crypto-rsa-pkcs1-public-key.js
@@ -0,0 +1,94 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const { createPrivateKey, createPublicKey, sign, verify } = require('node:crypto');
+const fixtures = require('../common/fixtures');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+
+const privateKey = createPrivateKey(fixtures.readKey('rsa_private_2048.pem'));
+const publicKey = createPublicKey(privateKey);
+const der = publicKey.export({ format: 'der', type: 'pkcs1' });
+const pem = publicKey.export({ format: 'pem', type: 'pkcs1' });
+const data = Buffer.from('PKCS#1 public key import');
+const signature = sign('sha256', data, privateKey);
+
+for (const [key, format] of [
+  [der, 'der'],
+  [Buffer.concat([der, Buffer.from('trailing data')]), 'der'],
+  [pem, 'pem'],
+  [`leading data\n${pem}trailing data\n`, 'pem'],
+]) {
+  const imported = createPublicKey({ key, format, type: 'pkcs1' });
+  assert.strictEqual(imported.type, 'public');
+  assert.strictEqual(imported.asymmetricKeyType, 'rsa');
+  assert.deepStrictEqual(imported.asymmetricKeyDetails,
+                         publicKey.asymmetricKeyDetails);
+  assert.deepStrictEqual(imported.export({ format: 'der', type: 'pkcs1' }), der);
+  assert.strictEqual(imported.export({ format: 'pem', type: 'pkcs1' }), pem);
+  assert(verify('sha256', data, imported, signature));
+}
+
+// The public PKCS#1 decoder must reject truncated keys and other DER structures.
+for (const invalid of [
+  der.subarray(0, der.length - 1),
+  publicKey.export({ format: 'der', type: 'spki' }),
+]) {
+  assert.throws(() => createPublicKey({
+    key: invalid, format: 'der', type: 'pkcs1',
+  }), { name: 'Error' });
+  assert.throws(() => createPublicKey(
+    `-----BEGIN RSA PUBLIC KEY-----\n${invalid.toString('base64')}\n` +
+    '-----END RSA PUBLIC KEY-----\n',
+  ), { name: 'Error' });
+}
+
+// Public-key creation continues to recognize PKCS#1 private keys separately.
+const privateDer = privateKey.export({ format: 'der', type: 'pkcs1' });
+assert.deepStrictEqual(createPublicKey({
+  key: privateDer, format: 'der', type: 'pkcs1',
+}).export({ format: 'der', type: 'pkcs1' }), der);
+
+// Preserve the ASN.1 forms accepted by the legacy RSA BIGNUM decoder. These
+// tiny keys exercise parsing only, without performing RSA operations.
+if (!isBoringSSL) {
+  for (const hex of [
+    '30800201110201030000',  // Indefinite-length BER SEQUENCE.
+    '300702020011020103',  // Redundant modulus padding.
+    '300702810111020103',  // Non-minimal INTEGER length encoding.
+    '30800201110201030000ffff',  // BER with trailing data.
+  ]) {
+    const imported = createPublicKey({
+      key: Buffer.from(hex, 'hex'), format: 'der', type: 'pkcs1',
+    });
+    assert.strictEqual(imported.type, 'public');
+    assert.strictEqual(imported.asymmetricKeyType, 'rsa');
+  }
+
+  // OpenSSL 4 rejects empty INTEGERs in both legacy and provider decoders.
+  const emptyExponent = {
+    key: Buffer.from('30050201110200', 'hex'), format: 'der', type: 'pkcs1',
+  };
+  if (hasOpenSSL(4)) {
+    assert.throws(() => createPublicKey(emptyExponent), { name: 'Error' });
+  } else {
+    const imported = createPublicKey(emptyExponent);
+    assert.strictEqual(imported.type, 'public');
+    assert.strictEqual(imported.asymmetricKeyType, 'rsa');
+  }
+}
+
+for (const hex of [
+  '3080020111020103',  // Missing BER end-of-contents marker.
+  '30800201110201030201010000',  // Third INTEGER inside BER SEQUENCE.
+  '3006220111020103',  // Constructed INTEGER.
+  '3006020111040103',  // OCTET STRING in place of the exponent.
+  '3009020111020103020101',  // Third INTEGER inside DER SEQUENCE.
+]) {
+  assert.throws(() => createPublicKey({
+    key: Buffer.from(hex, 'hex'), format: 'der', type: 'pkcs1',
+  }), { name: 'Error' });
+}
diff --git a/test/parallel/test-crypto-rsa-pss-parameters.js b/test/parallel/test-crypto-rsa-pss-parameters.js
new file mode 100644
index 000000000000..cda01e7a16d2
--- /dev/null
+++ b/test/parallel/test-crypto-rsa-pss-parameters.js
@@ -0,0 +1,42 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto) common.skip('missing crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+if (!hasOpenSSL(3) || isBoringSSL)
+  common.skip('requires OpenSSL 3 provider support');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const { createPublicKey } = require('crypto');
+
+const publicKey = createPublicKey(
+  fixtures.readKey('rsa_pss_public_2048_sha256_sha256_16.pem'));
+const der = publicKey.export({ format: 'der', type: 'spki' });
+const saltOffset = der.indexOf(Buffer.from([0xa2, 3, 2, 1, 16]));
+assert.notStrictEqual(saltOffset, -1);
+
+const publicDetails = { modulusLength: 2048, publicExponent: 65537n };
+const restrictedDetails = {
+  ...publicDetails,
+  hashAlgorithm: 'sha256',
+  mgf1HashAlgorithm: 'sha256',
+  saltLength: 16,
+};
+
+function assertDetails(encoded, expected) {
+  const key = createPublicKey({ key: encoded, format: 'der', type: 'spki' });
+  assert.strictEqual(key.asymmetricKeyType, 'rsa-pss');
+  assert.deepStrictEqual(key.asymmetricKeyDetails, expected);
+}
+
+assertDetails(der, restrictedDetails);
+
+for (const saltLength of [0, 32, 127, -1, -128]) {
+  const encoded = Buffer.from(der);
+  encoded.writeInt8(saltLength, saltOffset + 4);
+  assertDetails(encoded, saltLength < 0 ? publicDetails : {
+    ...restrictedDetails,
+    saltLength,
+  });
+}
diff --git a/test/parallel/test-crypto-scrypt.js b/test/parallel/test-crypto-scrypt.js
index 421ee4ce8f34..0f033e05d6d2 100644
--- a/test/parallel/test-crypto-scrypt.js
+++ b/test/parallel/test-crypto-scrypt.js
@@ -5,6 +5,8 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
+const isFips = hasFIPS(3);
 
 if (typeof crypto.scrypt !== 'function' || typeof crypto.scryptSync !== 'function')
   common.skip('no scrypt support');
@@ -159,13 +161,20 @@ const badargs = [
   },
 ];
 
-for (const options of good) {
-  const { pass, salt, keylen, expected } = options;
-  const actual = crypto.scryptSync(pass, salt, keylen, options);
-  assert.strictEqual(actual.toString('hex'), expected);
-  crypto.scrypt(pass, salt, keylen, options, common.mustSucceed((actual) => {
+if (isFips) {
+  const expected = { code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS' };
+  assert.throws(() => crypto.scryptSync('pass', 'salt', 1), expected);
+  assert.throws(
+    () => crypto.scrypt('pass', 'salt', 1, () => {}), expected);
+} else {
+  for (const options of good) {
+    const { pass, salt, keylen, expected } = options;
+    const actual = crypto.scryptSync(pass, salt, keylen, options);
     assert.strictEqual(actual.toString('hex'), expected);
-  }));
+    crypto.scrypt(pass, salt, keylen, options, common.mustSucceed((actual) => {
+      assert.strictEqual(actual.toString('hex'), expected);
+    }));
+  }
 }
 
 for (const options of bad) {
@@ -191,8 +200,10 @@ for (const options of incompatibleOptions) {
 }
 
 for (const options of toobig) {
-  const expected = {
-    message: process.features.openssl_is_boringssl ?
+  const expected = isFips ? {
+    code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS',
+  } : {
+    message: isBoringSSL ?
       /Invalid scrypt params:.*(INVALID_PARAMETERS|MEMORY_LIMIT_EXCEEDED)/ :
       /Invalid scrypt params:.*memory limit exceeded/,
     code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS',
@@ -203,7 +214,7 @@ for (const options of toobig) {
                 expected);
 }
 
-{
+if (!isFips) {
   const defaults = { N: 16384, p: 1, r: 8 };
   const expected = crypto.scryptSync('pass', 'salt', 1, defaults);
   const actual = crypto.scryptSync('pass', 'salt', 1);
@@ -229,10 +240,12 @@ for (const { args, expected } of badargs) {
 {
   // Values for maxmem that do not fit in 32 bits but that are still safe
   // integers should be allowed.
-  crypto.scrypt('', '', 4, { maxmem: 2 ** 52 },
-                common.mustSucceed((actual) => {
-                  assert.strictEqual(actual.toString('hex'), 'd72c87d0');
-                }));
+  if (!isFips) {
+    crypto.scrypt('', '', 4, { maxmem: 2 ** 52 },
+                  common.mustSucceed((actual) => {
+                    assert.strictEqual(actual.toString('hex'), 'd72c87d0');
+                  }));
+  }
 
   // Values that exceed Number.isSafeInteger should not be allowed.
   assert.throws(() => crypto.scryptSync('', '', 0, { maxmem: 2 ** 53 }), {
@@ -240,7 +253,7 @@ for (const { args, expected } of badargs) {
   });
 }
 
-{
+if (!isFips) {
   // Regression test for https://github.com/nodejs/node/issues/28836.
 
   function testParameter(name, value) {
@@ -299,5 +312,11 @@ for (const { args, expected } of badargs) {
     assert.deepStrictEqual(negResult, posResult);
   }
 
-  crypto.scrypt('', '', -0, common.mustCall());
+  if (isFips) {
+    assert.throws(
+      () => crypto.scrypt('', '', -0, () => {}),
+      { code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS' });
+  } else {
+    crypto.scrypt('', '', -0, common.mustCall());
+  }
 }
diff --git a/test/parallel/test-crypto-sec-level.js b/test/parallel/test-crypto-sec-level.js
index f2c0e3900624..ff32b29bb2b7 100644
--- a/test/parallel/test-crypto-sec-level.js
+++ b/test/parallel/test-crypto-sec-level.js
@@ -2,6 +2,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -15,7 +17,7 @@ const assert = require('assert');
 // This test simply validates that we can get some value for the secLevel
 // when needed by tests.
 const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   assert.strictEqual(secLevel, 0);
 } else {
   assert.ok(secLevel >= 0 && secLevel <= 5);
diff --git a/test/parallel/test-crypto-secure-heap.js b/test/parallel/test-crypto-secure-heap.js
index 3845f49a4748..edf4a6d4667f 100644
--- a/test/parallel/test-crypto-secure-heap.js
+++ b/test/parallel/test-crypto-secure-heap.js
@@ -13,14 +13,19 @@ if (common.isASan) {
   common.skip('ASan does not play well with secure heap allocations');
 }
 
-if (process.features.openssl_is_boringssl) {
+const {
+  isBoringSSL,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+if (isBoringSSL) {
   common.skip('BoringSSL does not support secure heap');
 }
 
 const assert = require('assert');
 const { fork } = require('child_process');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
 const {
   secureHeapUsed,
   createDiffieHellman,
@@ -38,7 +43,8 @@ if (process.argv[2] === 'child') {
   assert.strictEqual(a.used, 0);
 
   {
-    const size = getFips() || hasOpenSSL3 ? 1024 : 256;
+    const size = hasFIPS(3) ?
+      2048 : (getFips() === 1 || hasOpenSSL(3) ? 1024 : 256);
     const dh1 = createDiffieHellman(size);
     const p1 = dh1.getPrime('buffer');
     const dh2 = createDiffieHellman(p1, 'buffer');
diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
index 808c8d076a28..22a911f35e52 100644
--- a/test/parallel/test-crypto-sign-verify.js
+++ b/test/parallel/test-crypto-sign-verify.js
@@ -10,13 +10,26 @@ const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
 const {
   hasOpenSSL,
+  hasFIPS,
   opensslCli,
+  isBoringSSL,
 } = require('../common/crypto');
 
 // Test certificates
 const certPem = fixtures.readKey('rsa_cert.crt');
 const keyPem = fixtures.readKey('rsa_private.pem');
 const keySize = 2048;
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+const fips30 = fips3 && !fips35;
+const fipsDigestErrorCode = 'ERR_OSSL_DIGEST_NOT_ALLOWED';
+const signingHash = fips3 ? 'SHA256' : 'SHA1';
+
+if (fips30) {
+  assert.throws(
+    () => crypto.createSign('SHA1').update('Test123').sign(keyPem),
+    { code: fipsDigestErrorCode });
+}
 
 {
   const Sign = crypto.Sign;
@@ -60,7 +73,7 @@ const keySize = 2048;
   Object.defineProperty(Object.prototype, 'opensslErrorStack', errorStack);
 
   assert.throws(() => {
-    crypto.createSign('SHA1')
+    crypto.createSign('SHA256')
       .update('Test123')
       .sign({
         key: keyPem,
@@ -68,7 +81,7 @@ const keySize = 2048;
       });
   }, { message: hasOpenSSL(3) ?
     'error:1C8000A5:Provider routines::illegal or unsupported padding mode' :
-    process.features.openssl_is_boringssl ?
+    isBoringSSL ?
       'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' :
       'bye, bye, error stack' });
 
@@ -99,15 +112,15 @@ assert.throws(
 
 // Test signing and verifying
 {
-  const s1 = crypto.createSign('SHA1')
+  const s1 = crypto.createSign(signingHash)
                    .update('Test123')
                    .sign(keyPem, 'base64');
-  let s1stream = crypto.createSign('SHA1');
+  let s1stream = crypto.createSign(signingHash);
   s1stream.end('Test123');
   s1stream = s1stream.sign(keyPem, 'base64');
   assert.strictEqual(s1, s1stream, `${s1} should equal ${s1stream}`);
 
-  const verified = crypto.createVerify('SHA1')
+  const verified = crypto.createVerify(signingHash)
                          .update('Test')
                          .update('123')
                          .verify(certPem, s1, 'base64');
@@ -138,16 +151,16 @@ assert.throws(
 }
 
 {
-  const s3 = crypto.createSign('SHA1')
+  const s3 = crypto.createSign(signingHash)
                    .update('Test123')
                    .sign(keyPem, 'buffer');
-  let verified = crypto.createVerify('SHA1')
+  let verified = crypto.createVerify(signingHash)
                        .update('Test')
                        .update('123')
                        .verify(certPem, s3);
   assert.strictEqual(verified, true);
 
-  const verStream = crypto.createVerify('SHA1');
+  const verStream = crypto.createVerify(signingHash);
   verStream.write('Tes');
   verStream.write('t12');
   verStream.end('3');
@@ -190,6 +203,17 @@ assert.throws(
 
     const data = Buffer.from('Test123');
 
+    if (fips30) {
+      const streamOptions = {
+        key: keyPem,
+        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: crypto.constants.RSA_PSS_SALTLEN_DIGEST,
+      };
+      assert.throws(
+        () => crypto.createSign(algo).update(data).sign(streamOptions),
+        { code: fipsDigestErrorCode });
+    }
+
     signSaltLengths.forEach((signSaltLength) => {
       if (signSaltLength > max) {
         // If the salt length is too big, an Error should be thrown
@@ -211,20 +235,23 @@ assert.throws(
         }, errMessage);
       } else {
         // Otherwise, a valid signature should be generated
-        const s4 = crypto.createSign(algo)
-                         .update(data)
-                         .sign({
-                           key: keyPem,
-                           padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
-                           saltLength: signSaltLength
-                         });
         const s4_2 = crypto.sign(algo, data, {
           key: keyPem,
           padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
           saltLength: signSaltLength
         });
+        const signatures = [s4_2];
+        if (!fips30) {
+          signatures.unshift(crypto.createSign(algo)
+            .update(data)
+            .sign({
+              key: keyPem,
+              padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+              saltLength: signSaltLength
+            }));
+        }
 
-        [s4, s4_2].forEach((sig) => {
+        signatures.forEach((sig) => {
           let verified;
           verifySaltLengths.forEach((verifySaltLength) => {
             // Verification should succeed if and only if the salt length is
@@ -281,7 +308,8 @@ assert.throws(
     });
   }
 
-  testPSS('SHA1', 20);
+  if (!fips30)
+    testPSS('SHA1', 20);
   testPSS('SHA256', 32);
 }
 
@@ -340,7 +368,7 @@ assert.throws(
     });
 
   assert.throws(() => {
-    crypto.createSign('SHA1')
+    crypto.createSign('SHA256')
       .update('Test123')
       .sign({
         key: keyPem,
@@ -349,7 +377,7 @@ assert.throws(
   }, hasOpenSSL(3) ? {
     code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
     message: /illegal or unsupported padding mode/,
-  } : process.features.openssl_is_boringssl ? {
+  } : isBoringSSL ? {
     code: 'ERR_OSSL_EVP_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
     message: /ILLEGAL_OR_UNSUPPORTED_PADDING_MODE/,
   } : {
@@ -365,7 +393,7 @@ assert.throws(
 // Test throws exception when key options is null
 {
   assert.throws(() => {
-    crypto.createSign('SHA1').update('Test123').sign(null, 'base64');
+    crypto.createSign('SHA256').update('Test123').sign(null, 'base64');
   }, {
     code: 'ERR_CRYPTO_SIGN_KEY_REQUIRED',
     name: 'Error'
@@ -373,8 +401,8 @@ assert.throws(
 }
 
 {
-  const sign = crypto.createSign('SHA1');
-  const verify = crypto.createVerify('SHA1');
+  const sign = crypto.createSign('SHA256');
+  const verify = crypto.createVerify('SHA256');
 
   [1, [], {}, undefined, null, true, Infinity].forEach((input) => {
     const errObj = {
@@ -433,7 +461,7 @@ for (const pair of [
     raw: true },
   { private: fixtures.readKey('ed448_private.pem', 'ascii'),
     public: fixtures.readKey('ed448_public.pem', 'ascii'),
-    skip: process.features.openssl_is_boringssl,
+    skip: isBoringSSL,
     algo: null,
     supportsContext: hasOpenSSL(3, 2),
     sigLen: 114,
@@ -441,7 +469,7 @@ for (const pair of [
   { private: fixtures.readKey('rsa_private_2048.pem', 'ascii'),
     public: fixtures.readKey('rsa_public_2048.pem', 'ascii'),
     skip: false,
-    algo: 'sha1',
+    algo: signingHash,
     sigLen: 256,
     raw: false },
 ]) {
@@ -450,6 +478,7 @@ for (const pair of [
     continue;
   }
   const algo = pair.algo;
+  const keyType = crypto.createPrivateKey(pair.private).asymmetricKeyType;
 
   {
     const data = Buffer.from('Hello world');
@@ -521,15 +550,34 @@ for (const pair of [
       const sig = crypto.sign(algo, data, { key: pair.private, context });
       assert.strictEqual(crypto.verify(algo, data, { key: pair.public }, sig), true);
       assert.strictEqual(crypto.verify(algo, data, { key: pair.public, context }, sig), true);
-      assert.strictEqual(crypto.verify(algo, data, { key: pair.public, context: crypto.randomBytes(30) }, sig), false);
+      const mismatchedContext = { key: pair.public, context: crypto.randomBytes(30) };
+      if (fips35 && keyType === 'ed25519') {
+        assert.throws(() => crypto.verify(algo, data, mismatchedContext, sig), {
+          code: 'ERR_OSSL_INVALID_EDDSA_INSTANCE_FOR_ATTEMPTED_OPERATION',
+        });
+      } else {
+        assert.strictEqual(
+          crypto.verify(algo, data, mismatchedContext, sig), false);
+      }
     }
 
     {
       const context = new Uint8Array(32);
-      const sig = crypto.sign(algo, data, { key: pair.private, context });
-      assert.strictEqual(crypto.verify(algo, data, { key: pair.public }, sig), false);
-      assert.strictEqual(crypto.verify(algo, data, { key: pair.public, context }, sig), true);
-      assert.strictEqual(crypto.verify(algo, data, { key: pair.public, context: crypto.randomBytes(30) }, sig), false);
+      if (fips35 && keyType === 'ed25519') {
+        assert.throws(
+          () => crypto.sign(algo, data, { key: pair.private, context }),
+          { code: 'ERR_OSSL_INVALID_EDDSA_INSTANCE_FOR_ATTEMPTED_OPERATION' });
+      } else {
+        const sig = crypto.sign(algo, data, { key: pair.private, context });
+        assert.strictEqual(
+          crypto.verify(algo, data, { key: pair.public }, sig), false);
+        assert.strictEqual(
+          crypto.verify(algo, data, { key: pair.public, context }, sig), true);
+        assert.strictEqual(crypto.verify(algo, data, {
+          key: pair.public,
+          context: crypto.randomBytes(30),
+        }, sig), false);
+      }
     }
 
     assert.throws(() => crypto.sign(algo, data, { key: pair.private, context: new Uint8Array(256) }), {
@@ -572,20 +620,27 @@ if (hasOpenSSL(3, 2)) {
 
   {
     const context = Buffer.from('my context');
-    const sig = crypto.sign(null, data, { key: privKey, context });
-    assert.strictEqual(sig.length, 64);
+    if (fips35) {
+      assert.throws(() => crypto.sign(null, data, { key: privKey, context }), {
+        code: 'ERR_OSSL_INVALID_EDDSA_INSTANCE_FOR_ATTEMPTED_OPERATION',
+      });
+    } else {
+      const sig = crypto.sign(null, data, { key: privKey, context });
+      assert.strictEqual(sig.length, 64);
 
-    // Verify with matching context succeeds
-    assert.strictEqual(crypto.verify(null, data, { key: pubKey, context }, sig), true);
+      // Verify with matching context succeeds
+      assert.strictEqual(
+        crypto.verify(null, data, { key: pubKey, context }, sig), true);
 
-    // Verify without context fails (Ed25519ctx !== Ed25519 pure)
-    assert.strictEqual(crypto.verify(null, data, { key: pubKey }, sig), false);
+      // Verify without context fails (Ed25519ctx !== Ed25519 pure)
+      assert.strictEqual(crypto.verify(null, data, { key: pubKey }, sig), false);
 
-    // Verify with wrong context fails
-    assert.strictEqual(crypto.verify(null, data, {
-      key: pubKey,
-      context: Buffer.from('wrong'),
-    }, sig), false);
+      // Verify with wrong context fails
+      assert.strictEqual(crypto.verify(null, data, {
+        key: pubKey,
+        context: Buffer.from('wrong'),
+      }, sig), false);
+    }
   }
 
   {
@@ -662,36 +717,39 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
 
 {
   const data = Buffer.from('Hello world');
-  const keys = [['ec-key.pem', 64], ['dsa_private_1025.pem', 40]];
+  const dsaKey = fips3 ?
+    ['dsa_private.pem', 64] : ['dsa_private_1025.pem', 40];
+  const keys = [['ec-key.pem', 64], dsaKey];
 
   for (const [file, length] of keys) {
-    if (process.features.openssl_is_boringssl && file.startsWith('dsa_')) {
+    if (isBoringSSL && file.startsWith('dsa_')) {
       common.printSkipMessage(`Skipping unsupported ${file} test case`);
       continue;
     }
     const privKey = fixtures.readKey(file);
+    const digest = fips3 ? 'sha256' : 'sha1';
     [
-      crypto.createSign('sha1').update(data).sign(privKey),
-      crypto.sign('sha1', data, privKey),
-      crypto.sign('sha1', data, { key: privKey, dsaEncoding: 'der' }),
+      crypto.createSign(digest).update(data).sign(privKey),
+      crypto.sign(digest, data, privKey),
+      crypto.sign(digest, data, { key: privKey, dsaEncoding: 'der' }),
     ].forEach((sig) => {
       // Signature length variability due to DER encoding
       assert(sig.length >= length + 4 && sig.length <= length + 8);
 
       assert.strictEqual(
-        crypto.createVerify('sha1').update(data).verify(privKey, sig),
+        crypto.createVerify(digest).update(data).verify(privKey, sig),
         true
       );
-      assert.strictEqual(crypto.verify('sha1', data, privKey, sig), true);
+      assert.strictEqual(crypto.verify(digest, data, privKey, sig), true);
     });
 
     // Test (EC)DSA signature conversion.
     const opts = { key: privKey, dsaEncoding: 'ieee-p1363' };
-    let sig = crypto.sign('sha1', data, opts);
+    let sig = crypto.sign(digest, data, opts);
     // Unlike DER signatures, IEEE P1363 signatures have a predictable length.
     assert.strictEqual(sig.length, length);
-    assert.strictEqual(crypto.verify('sha1', data, opts, sig), true);
-    assert.strictEqual(crypto.createVerify('sha1')
+    assert.strictEqual(crypto.verify(digest, data, opts, sig), true);
+    assert.strictEqual(crypto.createVerify(digest)
                              .update(data)
                              .verify(opts, sig), true);
 
@@ -700,7 +758,7 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
       sig = crypto.randomBytes(length + i);
       let result;
       try {
-        result = crypto.verify('sha1', data, opts, sig);
+        result = crypto.verify(digest, data, opts, sig);
       } catch (err) {
         assert.match(err.message, /asn1 encoding/);
         assert.strictEqual(err.library, 'asn1 encoding routines');
@@ -735,20 +793,20 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
   }
 
   // Non-(EC)DSA keys should ignore the option.
-  const sig = crypto.sign('sha1', data, {
+  const sig = crypto.sign(signingHash, data, {
     key: keyPem,
     dsaEncoding: 'ieee-p1363'
   });
-  assert.strictEqual(crypto.verify('sha1', data, certPem, sig), true);
+  assert.strictEqual(crypto.verify(signingHash, data, certPem, sig), true);
   assert.strictEqual(
-    crypto.verify('sha1', data, {
+    crypto.verify(signingHash, data, {
       key: certPem,
       dsaEncoding: 'ieee-p1363'
     }, sig),
     true
   );
   assert.strictEqual(
-    crypto.verify('sha1', data, {
+    crypto.verify(signingHash, data, {
       key: certPem,
       dsaEncoding: 'der'
     }, sig),
@@ -757,7 +815,7 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
 
   for (const dsaEncoding of ['foo', null, {}, 5, true, NaN]) {
     assert.throws(() => {
-      crypto.sign('sha1', data, {
+      crypto.sign(signingHash, data, {
         key: certPem,
         dsaEncoding
       });
@@ -776,12 +834,13 @@ if (!opensslCli) {
   const privkey = fixtures.readKey('rsa_private_2048.pem');
 
   const msg = 'Test123';
-  const s5 = crypto.createSign('SHA256')
-    .update(msg)
-    .sign({
-      key: privkey,
-      padding: crypto.constants.RSA_PKCS1_PSS_PADDING
-    });
+  const options = {
+    key: privkey,
+    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+  };
+  const s5 = fips30 ?
+    crypto.sign('SHA256', Buffer.from(msg), options) :
+    crypto.createSign('SHA256').update(msg).sign(options);
 
   const tmpdir = require('../common/tmpdir');
   tmpdir.refresh();
@@ -799,7 +858,7 @@ if (!opensslCli) {
   }));
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // Test RSA-PSS.
   {
     // This key pair does not restrict the message digest algorithm or salt
@@ -811,8 +870,14 @@ if (!process.features.openssl_is_boringssl) {
     const privateKey = crypto.createPrivateKey(privatePem);
 
     for (const key of [privatePem, privateKey]) {
-      // Any algorithm should work.
-      for (const algo of ['sha1', 'sha256']) {
+      if (fips30) {
+        assert.throws(() => crypto.sign('sha1', 'foo', key), {
+          code: fipsDigestErrorCode,
+        });
+      }
+      // Any algorithm should work unless SHA-1 signing is unavailable.
+      const algorithms = fips30 ? ['sha256'] : ['sha1', 'sha256'];
+      for (const algo of algorithms) {
         // Any salt length should work.
         for (const saltLength of [undefined, 8, 10, 12, 16, 18, 20]) {
           const signature = crypto.sign(algo, 'foo', { key, saltLength });
@@ -847,7 +912,9 @@ if (!process.features.openssl_is_boringssl) {
       // Signing with anything other than sha256 should fail.
       assert.throws(() => {
         crypto.sign('sha1', 'foo', key);
-      }, /digest not allowed/);
+      }, fips30 ? {
+        code: fipsDigestErrorCode,
+      } : /digest not allowed/);
 
       // Signing with salt lengths less than 16 bytes should fail.
       for (const saltLength of [8, 10, 12]) {
@@ -895,7 +962,9 @@ if (!process.features.openssl_is_boringssl) {
       for (const algo of ['sha1', 'sha256']) {
         assert.throws(() => {
           crypto.sign(algo, 'foo', key);
-        }, /digest not allowed/);
+        }, fips30 && algo === 'sha1' ? {
+          code: fipsDigestErrorCode,
+        } : /digest not allowed/);
       }
 
       // sha512 should produce a valid signature.
@@ -915,15 +984,24 @@ if (!process.features.openssl_is_boringssl) {
 // The sign function should not swallow OpenSSL errors.
 // Regression test for https://github.com/nodejs/node/issues/40794.
 {
-  assert.throws(() => {
-    const { privateKey } = crypto.generateKeyPairSync('rsa', {
-      modulusLength: 512
+  if (fips3) {
+    assert.throws(() => crypto.generateKeyPairSync('rsa', {
+      modulusLength: 512,
+    }), {
+      name: 'Error',
+      message: 'error:020000AE:rsa routines::invalid modulus',
     });
-    crypto.sign('sha512', 'message', privateKey);
-  }, {
-    code: 'ERR_OSSL_RSA_DIGEST_TOO_BIG_FOR_RSA_KEY',
-    message: /digest too big for rsa key|DIGEST_TOO_BIG_FOR_RSA_KEY/
-  });
+  } else {
+    assert.throws(() => {
+      const { privateKey } = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 512
+      });
+      crypto.sign('sha512', 'message', privateKey);
+    }, {
+      code: 'ERR_OSSL_RSA_DIGEST_TOO_BIG_FOR_RSA_KEY',
+      message: /digest too big for rsa key|DIGEST_TOO_BIG_FOR_RSA_KEY/
+    });
+  }
 }
 
 {
@@ -948,7 +1026,7 @@ if (!process.features.openssl_is_boringssl) {
   // Ed25519 and Ed448 must use the one-shot methods
   const keys = [{ privateKey: fixtures.readKey('ed25519_private.pem', 'ascii'),
                   publicKey: fixtures.readKey('ed25519_public.pem', 'ascii') }];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     keys.push({ privateKey: fixtures.readKey('ed448_private.pem', 'ascii'),
                 publicKey: fixtures.readKey('ed448_public.pem', 'ascii') });
   } else {
diff --git a/test/parallel/test-crypto-stream.js b/test/parallel/test-crypto-stream.js
index ed0916b036a9..9584e48f2cbd 100644
--- a/test/parallel/test-crypto-stream.js
+++ b/test/parallel/test-crypto-stream.js
@@ -28,7 +28,7 @@ if (!common.hasCrypto) {
 const assert = require('assert');
 const stream = require('stream');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 if (!crypto.getFips()) {
   // Small stream to buffer converter
@@ -73,7 +73,7 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
 const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv);
 
 cipher.pipe(decipher)
-  .on('error', common.expectsError((hasOpenSSL3 || process.features.openssl_is_boringssl) ? {
+  .on('error', common.expectsError((hasOpenSSL(3) || isBoringSSL) ? {
     message: /bad[\s_]decrypt/i,
     library: /Provider routines|Cipher functions/,
     reason: /bad[\s_]decrypt/i,
diff --git a/test/parallel/test-crypto-worker-thread.js b/test/parallel/test-crypto-worker-thread.js
index d9030d5cfc11..42027f3f2b44 100644
--- a/test/parallel/test-crypto-worker-thread.js
+++ b/test/parallel/test-crypto-worker-thread.js
@@ -9,6 +9,7 @@ const {
   generateKeySync,
   generateKeyPairSync,
 } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
 const assert = require('assert');
@@ -19,7 +20,7 @@ if (isMainThread) {
   (async () => {
     const secretKey = generateKeySync('aes', { length: 128 });
     const { publicKey, privateKey } = generateKeyPairSync('rsa', {
-      modulusLength: 1024
+      modulusLength: hasFIPS(3) ? 2048 : 1024
     });
     const cryptoKey = await subtle.generateKey(
       { name: 'AES-CBC', length: 128 }, false, ['encrypt']);
diff --git a/test/parallel/test-crypto-x509-brand-check.js b/test/parallel/test-crypto-x509-brand-check.js
new file mode 100644
index 000000000000..a0bd64ed8037
--- /dev/null
+++ b/test/parallel/test-crypto-x509-brand-check.js
@@ -0,0 +1,145 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const { X509Certificate } = require('node:crypto');
+const { readFileSync } = require('node:fs');
+const fixtures = require('../common/fixtures');
+const {
+  isX509Certificate,
+} = require('internal/crypto/x509');
+
+const certData = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
+const cert = new X509Certificate(certData);
+const invalidThis = { code: 'ERR_INVALID_THIS', name: 'TypeError' };
+
+const getterNames = [
+  'subject',
+  'subjectAltName',
+  'issuer',
+  'issuerCertificate',
+  'infoAccess',
+  'validFrom',
+  'validTo',
+  'validFromDate',
+  'validToDate',
+  'fingerprint',
+  'fingerprint256',
+  'fingerprint512',
+  'keyUsage',
+  'serialNumber',
+  'signatureAlgorithm',
+  'signatureAlgorithmOid',
+  'raw',
+  'publicKey',
+  'ca',
+];
+
+const methodNames = [
+  'toString',
+  'toJSON',
+  'checkHost',
+  'checkEmail',
+  'checkIP',
+  'checkIssued',
+  'checkPrivateKey',
+  'verify',
+  'toLegacyObject',
+];
+
+assert.strictEqual(isX509Certificate(cert), true);
+assert.strictEqual(cert instanceof X509Certificate, true);
+assert.strictEqual(Object.getPrototypeOf(X509Certificate.prototype),
+                   Object.prototype);
+for (const name of ['pem', 'checkCA', 'getIssuerCert', 'toLegacy']) {
+  assert.strictEqual(name in cert, false);
+}
+
+for (const value of [
+  {},
+  { __proto__: null },
+  1,
+  null,
+  undefined,
+  Buffer.alloc(1),
+  function() {},
+]) {
+  assert.strictEqual(isX509Certificate(value), false);
+  for (const name of getterNames) {
+    const getter = Object.getOwnPropertyDescriptor(
+      X509Certificate.prototype, name).get;
+    assert.throws(() => getter.call(value), invalidThis);
+  }
+  for (const name of methodNames) {
+    assert.throws(
+      () => X509Certificate.prototype[name].call(value),
+      invalidThis);
+  }
+}
+
+const spoofed = { __proto__: X509Certificate.prototype };
+assert.strictEqual(spoofed instanceof X509Certificate, true);
+assert.strictEqual(isX509Certificate(spoofed), false);
+assert.throws(() => spoofed.subject, invalidThis);
+assert.throws(() => spoofed.toString(), invalidThis);
+
+const originalHasInstance =
+  Object.getOwnPropertyDescriptor(X509Certificate, Symbol.hasInstance);
+Object.defineProperty(X509Certificate, Symbol.hasInstance, {
+  configurable: true,
+  value: () => true,
+});
+try {
+  const buffer = Buffer.alloc(1);
+  assert.strictEqual(buffer instanceof X509Certificate, true);
+  assert.strictEqual(isX509Certificate(buffer), false);
+  assert.throws(() => X509Certificate.prototype.toString.call(buffer),
+                invalidThis);
+} finally {
+  if (originalHasInstance === undefined) {
+    delete X509Certificate[Symbol.hasInstance];
+  } else {
+    Object.defineProperty(
+      X509Certificate, Symbol.hasInstance, originalHasInstance);
+  }
+}
+
+class DerivedX509Certificate extends X509Certificate {}
+const derived = new DerivedX509Certificate(certData);
+assert.strictEqual(derived instanceof DerivedX509Certificate, true);
+assert.strictEqual(derived instanceof X509Certificate, true);
+assert.strictEqual(isX509Certificate(derived), true);
+assert.strictEqual(derived.subject, cert.subject);
+
+function PrimitivePrototype() {}
+PrimitivePrototype.prototype = 1;
+const primitivePrototype = Reflect.construct(
+  X509Certificate, [certData], PrimitivePrototype);
+assert.strictEqual(Object.getPrototypeOf(primitivePrototype), Object.prototype);
+assert.strictEqual(isX509Certificate(primitivePrototype), true);
+assert.strictEqual(
+  Object.getOwnPropertyDescriptor(
+    X509Certificate.prototype, 'subject').get.call(primitivePrototype),
+  cert.subject);
+
+const firstPrototype = { __proto__: X509Certificate.prototype };
+const secondPrototype = { __proto__: X509Certificate.prototype };
+let prototypeReads = 0;
+const ProxyNewTarget = new Proxy(function() {}, {
+  get(target, property, receiver) {
+    if (property === 'prototype') {
+      prototypeReads++;
+      return prototypeReads === 1 ? firstPrototype : secondPrototype;
+    }
+    return Reflect.get(target, property, receiver);
+  },
+});
+const proxyNewTarget = Reflect.construct(
+  X509Certificate, [certData], ProxyNewTarget);
+assert.strictEqual(prototypeReads, 1);
+assert.strictEqual(Object.getPrototypeOf(proxyNewTarget), firstPrototype);
+assert.strictEqual(proxyNewTarget.subject, cert.subject);
diff --git a/test/parallel/test-crypto-x509-clone-transfer.js b/test/parallel/test-crypto-x509-clone-transfer.js
new file mode 100644
index 000000000000..4ab6ea59b5f2
--- /dev/null
+++ b/test/parallel/test-crypto-x509-clone-transfer.js
@@ -0,0 +1,119 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const { once } = require('node:events');
+const {
+  X509Certificate,
+  createPrivateKey,
+} = require('node:crypto');
+const { readFileSync } = require('node:fs');
+const {
+  markAsUncloneable,
+  MessageChannel,
+  Worker,
+} = require('node:worker_threads');
+const fixtures = require('../common/fixtures');
+const {
+  isX509Certificate,
+} = require('internal/crypto/x509');
+
+const certData = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
+const keyData = readFileSync(fixtures.path('keys', 'agent1-key.pem'));
+const caData = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
+
+const cert = new X509Certificate(certData);
+const ca = new X509Certificate(caData);
+const privateKey = createPrivateKey(keyData);
+
+const dataCloneError = {
+  code: 25,
+  name: 'DataCloneError',
+};
+
+{
+  const uncloneable = new X509Certificate(certData);
+  markAsUncloneable(uncloneable);
+  assert.throws(() => structuredClone(uncloneable), dataCloneError);
+
+  const { port1, port2 } = new MessageChannel();
+  assert.throws(() => port1.postMessage(uncloneable), dataCloneError);
+  port1.close();
+  port2.close();
+}
+
+function assertSameCertificate(original, clone) {
+  assert.notStrictEqual(clone, original);
+  assert.strictEqual(clone instanceof X509Certificate, true);
+  assert.strictEqual(isX509Certificate(clone), true);
+  assert.strictEqual(clone.subject, original.subject);
+  assert.strictEqual(clone.issuer, original.issuer);
+  assert.strictEqual(clone.fingerprint256, original.fingerprint256);
+  assert.deepStrictEqual(clone.raw, original.raw);
+  assert.deepStrictEqual(Reflect.ownKeys(clone), []);
+  assert.strictEqual(clone.checkPrivateKey(privateKey), true);
+  assert.strictEqual(clone.checkIssued(ca), true);
+  assert.strictEqual(clone.verify(ca.publicKey), true);
+}
+
+async function roundTripViaMessageChannel(value) {
+  const { port1, port2 } = new MessageChannel();
+  port1.postMessage(value);
+  const [received] = await once(port2, 'message');
+  port1.close();
+  port2.close();
+  return received;
+}
+
+function workerMain() {
+  const {
+    X509Certificate: WorkerX509Certificate,
+  } = require('node:crypto');
+  const { parentPort } = require('node:worker_threads');
+
+  parentPort.once('message', (cert) => {
+    try {
+      if (!(cert instanceof WorkerX509Certificate)) {
+        throw new Error('X509Certificate brand was not preserved');
+      }
+      parentPort.postMessage({
+        cert,
+        ownKeyCount: Reflect.ownKeys(cert).length,
+        subject: cert.subject,
+      });
+    } catch (error) {
+      parentPort.postMessage({ error: error.stack || error.message });
+    }
+  });
+}
+
+async function roundTripViaWorker(value) {
+  const worker = new Worker(
+    `'use strict';(${workerMain.toString()})()`, { eval: true });
+
+  worker.postMessage(value);
+  const [message] = await once(worker, 'message');
+  await worker.terminate();
+  assert.strictEqual(message.error, undefined, message.error);
+  assert.strictEqual(message.ownKeyCount, 0);
+  assert.strictEqual(message.subject, value.subject);
+  return message.cert;
+}
+
+(async () => {
+  const cloned = structuredClone(cert);
+  assertSameCertificate(cert, cloned);
+
+  const viaPort = await roundTripViaMessageChannel(cert);
+  assertSameCertificate(cert, viaPort);
+
+  const clonedAgain = structuredClone(viaPort);
+  assertSameCertificate(cert, clonedAgain);
+
+  const viaWorker = await roundTripViaWorker(cert);
+  assertSameCertificate(cert, viaWorker);
+})().then(common.mustCall());
diff --git a/test/parallel/test-crypto-x509-hidden-slots.js b/test/parallel/test-crypto-x509-hidden-slots.js
new file mode 100644
index 000000000000..fead69935287
--- /dev/null
+++ b/test/parallel/test-crypto-x509-hidden-slots.js
@@ -0,0 +1,117 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const {
+  X509Certificate,
+  createPrivateKey,
+} = require('node:crypto');
+const { readFileSync } = require('node:fs');
+const { inspect } = require('node:util');
+const fixtures = require('../common/fixtures');
+
+const certData = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
+const keyData = readFileSync(fixtures.path('keys', 'agent1-key.pem'));
+const caData = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
+
+const cert = new X509Certificate(certData);
+const ca = new X509Certificate(caData);
+const privateKey = createPrivateKey(keyData);
+const expectedPem = cert.toString();
+const expectedSubject = cert.subject;
+
+function assertNoOwnKeys(value) {
+  assert.deepStrictEqual(Object.getOwnPropertyNames(value), []);
+  assert.deepStrictEqual(Object.getOwnPropertySymbols(value), []);
+  assert.deepStrictEqual(Reflect.ownKeys(value), []);
+}
+
+for (const name of [
+  'subject',
+  'subjectAltName',
+  'issuer',
+  'issuerCertificate',
+  'infoAccess',
+  'validFrom',
+  'validTo',
+  'validFromDate',
+  'validToDate',
+  'fingerprint',
+  'fingerprint256',
+  'fingerprint512',
+  'keyUsage',
+  'serialNumber',
+  'signatureAlgorithm',
+  'signatureAlgorithmOid',
+  'raw',
+  'publicKey',
+  'ca',
+]) {
+  // Populate every private lazy-cache entry before checking reflection.
+  Reflect.get(cert, name);
+}
+cert.toString();
+cert.toJSON();
+assertNoOwnKeys(cert);
+
+const getterNames = [
+  'subject',
+  'subjectAltName',
+  'issuer',
+  'infoAccess',
+  'validFrom',
+  'validTo',
+  'validFromDate',
+  'validToDate',
+  'fingerprint',
+  'fingerprint256',
+  'fingerprint512',
+  'keyUsage',
+  'serialNumber',
+  'signatureAlgorithm',
+  'signatureAlgorithmOid',
+];
+const originals = new Map();
+for (const name of getterNames) {
+  originals.set(name,
+                Object.getOwnPropertyDescriptor(
+                  X509Certificate.prototype, name));
+  Object.defineProperty(X509Certificate.prototype, name, {
+    configurable: true,
+    get() { return `FORGED-${name}`; },
+  });
+}
+const originalToString =
+  Object.getOwnPropertyDescriptor(X509Certificate.prototype, 'toString');
+Object.defineProperty(X509Certificate.prototype, 'toString', {
+  configurable: true,
+  value() { return 'FORGED-PEM'; },
+});
+
+try {
+  assert.strictEqual(cert.subject, 'FORGED-subject');
+  assert.strictEqual(cert.toString(), 'FORGED-PEM');
+
+  const rendered = inspect(cert, { depth: 4 });
+  assert.match(rendered, /CN=agent1/);
+  assert.doesNotMatch(rendered, /FORGED/);
+  assert.strictEqual(cert.toJSON(), expectedPem);
+  assert.strictEqual(JSON.parse(JSON.stringify(cert)), expectedPem);
+
+  assert.strictEqual(cert.checkIssued(ca), true);
+  assert.strictEqual(cert.checkPrivateKey(privateKey), true);
+  assert.strictEqual(cert.verify(ca.publicKey), true);
+  assertNoOwnKeys(cert);
+} finally {
+  for (const [name, descriptor] of originals) {
+    Object.defineProperty(X509Certificate.prototype, name, descriptor);
+  }
+  Object.defineProperty(
+    X509Certificate.prototype, 'toString', originalToString);
+}
+
+assert.strictEqual(cert.subject, expectedSubject);
+assert.strictEqual(cert.toString(), expectedPem);
diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js
index 353699cf9117..c8f44372f975 100644
--- a/test/parallel/test-crypto-x509.js
+++ b/test/parallel/test-crypto-x509.js
@@ -19,7 +19,7 @@ const {
 
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { readFileSync } = require('fs');
 
 const cert = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
@@ -28,8 +28,8 @@ const ca = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
 
 const privateKey = createPrivateKey(key);
 
-if (!process.features.openssl_is_boringssl) {
-  const expectedPubkeys = hasOpenSSL3 ? [
+if (!isBoringSSL) {
+  const expectedPubkeys = hasOpenSSL(3) ? [
     [
       'rsa_pss_cert_2048.pem',
       292,
@@ -88,7 +88,7 @@ emailAddress=ry@tinyclouds.org`;
 
 let infoAccessCheck = `OCSP - URI:http://ocsp.nodejs.org/
 CA Issuers - URI:http://ca.nodejs.org/ca.cert`;
-if (!hasOpenSSL3)
+if (!hasOpenSSL(3))
   infoAccessCheck += '\n';
 
 const der = Buffer.from(
@@ -156,7 +156,7 @@ const der = Buffer.from(
 
   assert.deepStrictEqual(x509.raw, der);
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.deepStrictEqual(x509.validFromDate, new Date('2022-09-03T21:40:37Z'));
     assert.deepStrictEqual(x509.validToDate, new Date('2296-06-17T21:40:37Z'));
   }
@@ -175,9 +175,21 @@ const der = Buffer.from(
 
   assert.strictEqual(x509.checkIP('127.0.0.1'), undefined);
   assert.strictEqual(x509.checkIP('::'), undefined);
-  assert.strictEqual(x509.checkHost('agent1'), 'agent1');
+  // OpenSSL 4.1 no longer checks the subject DN by default.
+  // https://github.com/openssl/openssl/pull/31982
+  for (const options of [undefined, { subject: 'default' }]) {
+    assert.strictEqual(x509.checkHost('agent1', options),
+                       hasOpenSSL(4, 1) ? undefined : 'agent1');
+    assert.strictEqual(x509.checkEmail('ry@tinyclouds.org', options),
+                       hasOpenSSL(4, 1) ? undefined : 'ry@tinyclouds.org');
+  }
+  assert.strictEqual(x509.checkHost('agent1', { subject: 'always' }), 'agent1');
+  assert.strictEqual(x509.checkHost('agent1', { subject: 'never' }), undefined);
   assert.strictEqual(x509.checkHost('agent2'), undefined);
-  assert.strictEqual(x509.checkEmail('ry@tinyclouds.org'), 'ry@tinyclouds.org');
+  assert.strictEqual(x509.checkEmail('ry@tinyclouds.org', { subject: 'always' }),
+                     'ry@tinyclouds.org');
+  assert.strictEqual(x509.checkEmail('ry@tinyclouds.org', { subject: 'never' }),
+                     undefined);
   assert.strictEqual(x509.checkEmail('sally@example.com'), undefined);
   assert.throws(() => x509.checkHost('agent\x001'), {
     code: 'ERR_INVALID_ARG_VALUE'
@@ -399,10 +411,10 @@ tAt3hIKFD1bJt6c6WtMH2Su3syosWxmdmGk5ihslB00lvLpfj/wed8i3bkcB1doq
 UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
 -----END CERTIFICATE-----`;
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     const cert = new X509Certificate(certPem);
     assert.throws(() => cert.publicKey, {
-      message: hasOpenSSL3 ? /decode error/ : /wrong tag/,
+      message: hasOpenSSL(3) ? /decode error/ : /wrong tag/,
       name: 'Error'
     });
 
@@ -446,7 +458,7 @@ UidvpWWipVLZgK+oDks+bKTobcoXGW9oXobiIYqslXPy
 -----END CERTIFICATE-----`.trim();
   const c1 = new X509Certificate(certPemUTCTime);
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.deepStrictEqual(c1.validFromDate, new Date('1949-12-25T23:59:58Z'));
     assert.deepStrictEqual(c1.validToDate, new Date('1950-01-01T23:59:58Z'));
   }
@@ -483,7 +495,7 @@ CWwQO8JZjJqFtqtuzy2n+gLCvqePgG/gmSqHOPm2ZbLW
 -----END CERTIFICATE-----`.trim();
   const c2 = new X509Certificate(certPemGeneralizedTime);
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.deepStrictEqual(c2.validFromDate, new Date('2049-12-26T00:00:01Z'));
     assert.deepStrictEqual(c2.validToDate, new Date('2050-01-02T00:00:01Z'));
   }
diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
index 46f4571b33df..22f3d3e5eb55 100644
--- a/test/parallel/test-crypto.js
+++ b/test/parallel/test-crypto.js
@@ -29,7 +29,8 @@ const assert = require('assert');
 const crypto = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const isFips = hasFIPS(3);
 
 // Test Certificates
 const certPfx = fixtures.readKey('rsa_cert.pfx');
@@ -54,27 +55,35 @@ assert.throws(() => {
 });
 
 // PFX tests
-tls.createSecureContext({ pfx: certPfx, passphrase: 'sample' });
-
-assert.throws(() => {
-  tls.createSecureContext({ pfx: certPfx });
-}, (err) => {
-  // Throws general Error, so there is no opensslErrorStack property.
-  return err instanceof Error &&
-         err.name === 'Error' &&
-         /^Error: (mac verify failure|INCORRECT_PASSWORD)$/.test(err) &&
-         !('opensslErrorStack' in err);
-});
+if (isFips) {
+  for (const passphrase of ['sample', undefined, 'test']) {
+    assert.throws(
+      () => tls.createSecureContext({ pfx: certPfx, passphrase }),
+      { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+  }
+} else {
+  tls.createSecureContext({ pfx: certPfx, passphrase: 'sample' });
+
+  assert.throws(() => {
+    tls.createSecureContext({ pfx: certPfx });
+  }, (err) => {
+    // Throws general Error, so there is no opensslErrorStack property.
+    return err instanceof Error &&
+           err.name === 'Error' &&
+           /^Error: (mac verify failure|INCORRECT_PASSWORD)$/.test(err) &&
+           !('opensslErrorStack' in err);
+  });
 
-assert.throws(() => {
-  tls.createSecureContext({ pfx: certPfx, passphrase: 'test' });
-}, (err) => {
-  // Throws general Error, so there is no opensslErrorStack property.
-  return err instanceof Error &&
-         err.name === 'Error' &&
-         /^Error: (mac verify failure|INCORRECT_PASSWORD)$/.test(err) &&
-         !('opensslErrorStack' in err);
-});
+  assert.throws(() => {
+    tls.createSecureContext({ pfx: certPfx, passphrase: 'test' });
+  }, (err) => {
+    // Throws general Error, so there is no opensslErrorStack property.
+    return err instanceof Error &&
+           err.name === 'Error' &&
+           /^Error: (mac verify failure|INCORRECT_PASSWORD)$/.test(err) &&
+           !('opensslErrorStack' in err);
+  });
+}
 
 assert.throws(() => {
   tls.createSecureContext({ pfx: 'sample', passphrase: 'test' });
@@ -145,7 +154,7 @@ assert(crypto.getHashes().includes('sha1'));
 assert(crypto.getHashes().includes('sha256'));
 assert(!crypto.getHashes().includes('SHA1'));
 assert(!crypto.getHashes().includes('SHA256'));
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   assert(crypto.getHashes().includes('RSA-SHA1'));
   assert(!crypto.getHashes().includes('rsa-sha1'));
 }
@@ -191,7 +200,7 @@ assert.throws(
 );
 
 assert.throws(
-  () => crypto.createHmac('sha256', 'a secret').update('0', 'hex'),
+  () => crypto.createHmac('sha256', '0123456789abcdef').update('0', 'hex'),
   (error) => {
     assert.ok(!('opensslErrorStack' in error));
     assert.throws(() => { throw error; }, encodingError);
@@ -211,7 +220,11 @@ assert.throws(() => {
   ].join('\n');
   crypto.createSign('SHA256').update('test').sign(priv);
 }, (err) => {
-  if (process.features.openssl_is_boringssl) {
+  if (isFips) {
+    assert.throws(() => { throw err; }, {
+      code: 'ERR_OSSL_INVALID_KEY_LENGTH',
+    });
+  } else if (isBoringSSL) {
     // BoringSSL rejects the tiny RSA key while decoding it, before signing.
     assert.throws(() => { throw err; }, {
       name: 'Error',
@@ -225,9 +238,9 @@ assert.throws(() => {
     assert(Array.isArray(err.opensslErrorStack));
     assert(err.opensslErrorStack.length > 0);
   } else {
-    if (!hasOpenSSL3)
+    if (!hasOpenSSL(3))
       assert.ok(!('opensslErrorStack' in err));
-    assert.throws(() => { throw err; }, hasOpenSSL3 ? {
+    assert.throws(() => { throw err; }, hasOpenSSL(3) ? {
       name: 'Error',
       message: 'error:02000070:rsa routines::digest too big for rsa key',
       library: 'rsa routines',
@@ -243,7 +256,7 @@ assert.throws(() => {
   return true;
 });
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   // The correct header inside `rsa_private_pkcs8_bad.pem` should have been
   // -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----
   // instead of
@@ -251,7 +264,7 @@ if (!hasOpenSSL3) {
   const sha1_privateKey = fixtures.readKey('rsa_private_pkcs8_bad.pem',
                                            'ascii');
 
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     // BoringSSL accepts the PKCS#8 payload despite the legacy PEM label.
     const signature = crypto.createSign('sha1').sign(sha1_privateKey);
     assert(Buffer.isBuffer(signature));
diff --git a/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js b/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js
new file mode 100644
index 000000000000..0d7366dd3438
--- /dev/null
+++ b/test/parallel/test-diagnostics-channel-crypto-fips-indicator.js
@@ -0,0 +1,184 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+
+const assert = require('node:assert');
+const diagnosticsChannel = require('node:diagnostics_channel');
+const { once } = require('node:events');
+const { Worker } = require('node:worker_threads');
+const {
+  spawnSyncAndExitWithoutError,
+} = require('../common/child_process');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+const {
+  createHmac,
+  generateKeyPairSync,
+  sign,
+  subtle,
+} = require('node:crypto');
+
+const channelName = 'crypto.fips.indicator';
+
+if (!hasOpenSSL(3, 4)) {
+  common.skip('OpenSSL 3.4 or later is required');
+} else if (!hasFIPS(3, 4)) {
+  common.skip('an active OpenSSL 3.4+ FIPS provider is required');
+} else if (!process.execArgv.includes('--enable-fips-indicator-events')) {
+  spawnSyncAndExitWithoutError(
+    process.execPath,
+    ['--enable-fips-indicator-events', __filename],
+  );
+} else {
+  run().then(common.mustCall());
+}
+
+function nextIndicator() {
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve } = Promise.withResolvers();
+  const subscriber = common.mustCall((event, name) => {
+    assert.strictEqual(name, channelName);
+    clearInterval(keepAlive);
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+    resolve(event);
+  });
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  return promise;
+}
+
+function testUnsubscribeDuringDrain(key, privateKey) {
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve } = Promise.withResolvers();
+  const subscriber = common.mustCall(() => {
+    clearInterval(keepAlive);
+    assert.strictEqual(
+      diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+    setImmediate(common.mustCall(resolve));
+  });
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  createHmac('sha256', key).digest();
+  sign('sha1', Buffer.alloc(0), privateKey);
+  return promise;
+}
+
+async function testNoStaleIndicator(key) {
+  createHmac('sha256', key).digest();
+  const subscriber = common.mustNotCall();
+  diagnosticsChannel.subscribe(channelName, subscriber);
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.strictEqual(
+    diagnosticsChannel.unsubscribe(channelName, subscriber), true);
+}
+
+async function run() {
+  const key = Buffer.alloc(13);
+
+  const keepAlive = setInterval(common.mustNotCall(), 10_000);
+  const { promise, resolve: resolveProbe } = Promise.withResolvers();
+  const probeSubscriber = (event) => {
+    clearInterval(keepAlive);
+    diagnosticsChannel.unsubscribe(channelName, probeSubscriber);
+    resolveProbe(event);
+  };
+  diagnosticsChannel.subscribe(channelName, probeSubscriber);
+
+  let output;
+  try {
+    output = createHmac('sha256', key).digest();
+  } catch (error) {
+    clearInterval(keepAlive);
+    diagnosticsChannel.unsubscribe(channelName, probeSubscriber);
+    assert.match(error.code, /^ERR_OSSL_/);
+    common.printSkipMessage(
+      'the FIPS provider rejects unapproved operations before signaling');
+    return;
+  }
+
+  assert.strictEqual(output.byteLength, 32);
+  assert.deepStrictEqual(await promise, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: false,
+    count: 1,
+    dropped: 0,
+  });
+
+  await testNoStaleIndicator(key);
+
+  let eventPromise = nextIndicator();
+  createHmac('sha256', key).digest();
+  createHmac('sha256', key).digest();
+  assert.deepStrictEqual(await eventPromise, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: false,
+    count: 2,
+    dropped: 0,
+  });
+
+  const secondSubscriber = common.mustCall();
+  diagnosticsChannel.subscribe(channelName, secondSubscriber);
+  eventPromise = nextIndicator();
+  createHmac('sha256', key).digest();
+  await eventPromise;
+  assert.strictEqual(
+    diagnosticsChannel.unsubscribe(channelName, secondSubscriber), true);
+
+  const { privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  await testUnsubscribeDuringDrain(key, privateKey);
+
+  const hmacKey = await subtle.importKey(
+    'raw', Buffer.alloc(13), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  eventPromise = nextIndicator();
+  const [signature, hmacEvent] = await Promise.all([
+    subtle.sign('HMAC', hmacKey, Buffer.alloc(0)),
+    eventPromise,
+  ]);
+  assert.strictEqual(signature.byteLength, 32);
+  assert.strictEqual(hmacEvent.operation, 'HMAC');
+  assert.strictEqual(hmacEvent.reason, 'keysize');
+  assert.strictEqual(hmacEvent.blocked, false);
+
+  eventPromise = nextIndicator();
+  const worker = new Worker(`
+    'use strict';
+    const diagnosticsChannel = require('node:diagnostics_channel');
+    const { parentPort, workerData } = require('node:worker_threads');
+    const { createHmac } = require('node:crypto');
+
+    let indicatorCount = 0;
+    diagnosticsChannel.subscribe('crypto.fips.indicator', () => {
+      indicatorCount++;
+    });
+    const result = createHmac('sha256', workerData.key).digest();
+    setImmediate(() => {
+      parentPort.postMessage({
+        indicatorCount,
+        length: result.byteLength,
+      });
+    });
+  `, {
+    eval: true,
+    workerData: { key },
+  });
+  worker.on('error', common.mustNotCall());
+  const exitPromise = once(worker, 'exit');
+  const [[message], workerEvent] = await Promise.all([
+    once(worker, 'message'),
+    eventPromise,
+  ]);
+  assert.deepStrictEqual(message, { indicatorCount: 0, length: 32 });
+  assert.deepStrictEqual(workerEvent, {
+    operation: 'HMAC',
+    reason: 'keysize',
+    blocked: false,
+    count: 1,
+    dropped: 0,
+  });
+  const [exitCode] = await exitPromise;
+  assert.strictEqual(exitCode, 0);
+}
diff --git a/test/parallel/test-dns-channel-timeout.js b/test/parallel/test-dns-channel-timeout.js
index 1e4dac548973..0c9c7c31caee 100644
--- a/test/parallel/test-dns-channel-timeout.js
+++ b/test/parallel/test-dns-channel-timeout.js
@@ -22,10 +22,11 @@ for (const ctor of [dns.Resolver, dns.promises.Resolver]) {
   for (const timeout of [-1, 0, 1]) new ctor({ timeout });  // OK
 }
 
+// One attempt is enough to exercise the timeout without retry backoff.
 for (const timeout of [0, 1, 2]) {
   const server = dgram.createSocket('udp4');
   server.bind(0, '127.0.0.1', common.mustCall(() => {
-    const resolver = new dns.Resolver({ timeout });
+    const resolver = new dns.Resolver({ timeout, tries: 1 });
     resolver.setServers([`127.0.0.1:${server.address().port}`]);
     resolver.resolve4('nodejs.org', common.mustCall((err) => {
       assert.throws(() => { throw err; }, {
@@ -40,7 +41,7 @@ for (const timeout of [0, 1, 2]) {
 for (const timeout of [0, 1, 2]) {
   const server = dgram.createSocket('udp4');
   server.bind(0, '127.0.0.1', common.mustCall(() => {
-    const resolver = new dns.promises.Resolver({ timeout });
+    const resolver = new dns.promises.Resolver({ timeout, tries: 1 });
     resolver.setServers([`127.0.0.1:${server.address().port}`]);
     resolver.resolve4('nodejs.org').catch(common.mustCall((err) => {
       assert.throws(() => { throw err; }, {
diff --git a/test/parallel/test-dns-resolver-max-timeout.js b/test/parallel/test-dns-resolver-max-timeout.js
index 7abac39323e1..1a4aaef96c96 100644
--- a/test/parallel/test-dns-resolver-max-timeout.js
+++ b/test/parallel/test-dns-resolver-max-timeout.js
@@ -52,9 +52,11 @@ server.bind(0, common.mustCall(async () => {
 
   // Test that maxTimeout is effective.
   // Without maxTimeout, the timeout will keep increasing when retrying.
-  const timeout1 = await timeout(address, { timeout: 500, tries: 3 });
-  // With maxTimeout, the timeout will always be 500 when retrying.
-  const timeout2 = await timeout(address, { timeout: 500, tries: 3, maxTimeout: 500 });
+  // Expired tries are only noticed on the resolver's `timeout` ms timer tick,
+  // so use enough tries that the doubling run cannot overlap the capped one.
+  const timeout1 = await timeout(address, { timeout: 100, tries: 5 });
+  // With maxTimeout, the timeout will always be 100 when retrying.
+  const timeout2 = await timeout(address, { timeout: 100, tries: 5, maxTimeout: 100 });
   console.log(`timeout1: ${timeout1}, timeout2: ${timeout2}`);
   assert.strictEqual(timeout1 !== undefined && timeout2 !== undefined, true);
   assert.strictEqual(timeout1 > timeout2, true);
diff --git a/test/parallel/test-error-value-type-detection.mjs b/test/parallel/test-error-value-type-detection.mjs
index e44b19297a96..cb794514ed39 100644
--- a/test/parallel/test-error-value-type-detection.mjs
+++ b/test/parallel/test-error-value-type-detection.mjs
@@ -209,3 +209,58 @@ assert.strictEqual(
   determineSpecificType(new WeakSet()),
   'an instance of WeakSet',
 );
+
+// Anonymous classes have an empty `name`, so the value is inspected instead.
+// `inspect(..., { depth: -1 })` prints this one as `{}` because it has no own
+// properties; the values below carry a `constructor` property of their own and
+// print as `[Object]`.
+assert.strictEqual(
+  determineSpecificType(new (class {})()),
+  '{}',
+);
+
+// `constructor` is an ordinary, user-controlled property that need not be a
+// function. Describing such a value must not throw.
+assert.strictEqual(
+  determineSpecificType(JSON.parse('{"constructor": 5}')),
+  '[Object]',
+);
+
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: '' } }),
+  '[Object]',
+);
+
+// A `constructor.name` that is not a usable string must not be interpolated
+// into the message.
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: Symbol('x') } }),
+  '[Object]',
+);
+
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: 42 } }),
+  '[Object]',
+);
+
+// `constructor` and its `name` are each read once. Both may be accessors, so
+// repeated reads are observable, and a `name` validated by one read and
+// interpolated from another need not be the same value twice.
+let constructorReads = 0;
+let nameReads = 0;
+const named = {
+  get constructor() {
+    constructorReads++;
+    return { get name() { nameReads++; return 'Foo'; } };
+  },
+};
+assert.strictEqual(determineSpecificType(named), 'an instance of Foo');
+assert.strictEqual(constructorReads, 1);
+assert.strictEqual(nameReads, 1);
+
+// Building the error must not fail when `constructor` is a truthy primitive.
+assert.strictEqual(
+  new errorsModule.codes.ERR_INVALID_ARG_TYPE(
+    'arg', 'string', JSON.parse('{"constructor": 5}')).code,
+  'ERR_INVALID_ARG_TYPE',
+);
diff --git a/test/parallel/test-eslint-no-crypto-class-instanceof.js b/test/parallel/test-eslint-no-crypto-class-instanceof.js
new file mode 100644
index 000000000000..379b133b3818
--- /dev/null
+++ b/test/parallel/test-eslint-no-crypto-class-instanceof.js
@@ -0,0 +1,55 @@
+'use strict';
+
+const common = require('../common');
+common.skipIfEslintMissing();
+
+const RuleTester = require('../../tools/eslint/node_modules/eslint').RuleTester;
+const rule = require('../../tools/eslint-rules/no-crypto-class-instanceof');
+
+new RuleTester().run('no-crypto-class-instanceof', rule, {
+  valid: [
+    'value instanceof Buffer;',
+    'value instanceof KeyObject;',
+    `
+    const { isKeyObject } = require('internal/crypto/keys');
+    isKeyObject(key);
+    `,
+    `
+    function isCryptoKey(value, CryptoKey) {
+      return value instanceof CryptoKey;
+    }
+    `,
+    `
+    function isCryptoKey(value, globalThis) {
+      return value instanceof globalThis.CryptoKey;
+    }
+    `,
+  ],
+  invalid: [
+    {
+      code: `
+      const { KeyObject: KO } = require('internal/crypto/keys');
+      key instanceof KO;
+      `,
+      errors: [{ messageId: 'noKeyObjectInstanceof' }],
+    },
+    {
+      code: `
+      const webcrypto = require('internal/crypto/webcrypto');
+      key instanceof webcrypto.CryptoKey;
+      `,
+      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
+    },
+    {
+      code: 'key instanceof globalThis.CryptoKey;',
+      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
+    },
+    {
+      code: `
+      const { X509Certificate } = require('internal/crypto/x509');
+      cert instanceof X509Certificate;
+      `,
+      errors: [{ messageId: 'noX509CertificateInstanceof' }],
+    },
+  ],
+});
diff --git a/test/parallel/test-eslint-no-keyobject-cryptokey-instanceof.js b/test/parallel/test-eslint-no-keyobject-cryptokey-instanceof.js
deleted file mode 100644
index 29b70c9ec58a..000000000000
--- a/test/parallel/test-eslint-no-keyobject-cryptokey-instanceof.js
+++ /dev/null
@@ -1,78 +0,0 @@
-'use strict';
-
-const common = require('../common');
-common.skipIfEslintMissing();
-
-const RuleTester = require('../../tools/eslint/node_modules/eslint').RuleTester;
-const rule = require('../../tools/eslint-rules/no-keyobject-cryptokey-instanceof');
-
-new RuleTester().run('no-keyobject-cryptokey-instanceof', rule, {
-  valid: [
-    'key instanceof Buffer;',
-    'key instanceof KeyObject;',
-    `
-    const { isKeyObject } = require('internal/crypto/keys');
-    isKeyObject(key);
-    `,
-    `
-    const { isCryptoKey } = require('internal/crypto/keys');
-    isCryptoKey(key);
-    `,
-  ],
-  invalid: [
-    {
-      code: `
-      const { KeyObject } = require('internal/crypto/keys');
-      key instanceof KeyObject;
-      `,
-      errors: [{ messageId: 'noKeyObjectInstanceof' }],
-    },
-    {
-      code: `
-      const { KeyObject: KO } = require('internal/crypto/keys');
-      key instanceof KO;
-      `,
-      errors: [{ messageId: 'noKeyObjectInstanceof' }],
-    },
-    {
-      code: `
-      const keys = require('internal/crypto/keys');
-      key instanceof keys.KeyObject;
-      `,
-      errors: [{ messageId: 'noKeyObjectInstanceof' }],
-    },
-    {
-      code: `
-      key instanceof CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      const { CryptoKey } = require('internal/crypto/keys');
-      key instanceof CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      const { CryptoKey: CK } = require('internal/crypto/webcrypto');
-      key instanceof CK;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      const webcrypto = require('internal/crypto/webcrypto');
-      key instanceof webcrypto.CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-    {
-      code: `
-      key instanceof globalThis.CryptoKey;
-      `,
-      errors: [{ messageId: 'noCryptoKeyInstanceof' }],
-    },
-  ],
-});
diff --git a/test/parallel/test-eventtarget.js b/test/parallel/test-eventtarget.js
index d0b3ad03a1df..fbfdcf586f6e 100644
--- a/test/parallel/test-eventtarget.js
+++ b/test/parallel/test-eventtarget.js
@@ -685,7 +685,21 @@ let asyncTest = Promise.resolve();
     et.dispatchEvent(new Event('foo'));
   });
 }
-
+{
+  // Two listeners sharing the same retainer key must NOT evict each
+  // other from the weak retention map — both must survive a GC cycle
+  // and both must be removable independently.
+  // Regression test for https://github.com/nodejs/node/issues/63954
+  const et = new EventTarget();
+  const aCalled = common.mustNotCall();
+  const bCalled = common.mustCall();
+  et.addEventListener('a', aCalled, { [kWeakHandler]: et });
+  et.addEventListener('b', bCalled, { [kWeakHandler]: et });
+  globalThis.gc();
+  et.removeEventListener('a', aCalled);
+  et.dispatchEvent(new Event('a'));
+  et.dispatchEvent(new Event('b'));
+}
 {
   const et = new EventTarget();
 
diff --git a/test/parallel/test-fastutf8stream-destroy.js b/test/parallel/test-fastutf8stream-destroy.js
index bdf401f330ef..04f7cad8088f 100644
--- a/test/parallel/test-fastutf8stream-destroy.js
+++ b/test/parallel/test-fastutf8stream-destroy.js
@@ -34,8 +34,11 @@ function getTempFile() {
 
   assert.throws(() => stream.write('hello world\n'), Error);
 
-  readFile(dest, 'utf8', common.mustSucceed((data) => {
-    assert.strictEqual(data, 'hello world\n');
+  // Reading now would race the fs.write() still in flight.
+  stream.once('write', common.mustCall(() => {
+    readFile(dest, 'utf8', common.mustSucceed((data) => {
+      assert.strictEqual(data, 'hello world\n');
+    }));
   }));
 
   stream.on('finish', common.mustNotCall());
diff --git a/test/parallel/test-fastutf8stream-reopen.js b/test/parallel/test-fastutf8stream-reopen.js
index d706a737c2cd..99c62ca267ac 100644
--- a/test/parallel/test-fastutf8stream-reopen.js
+++ b/test/parallel/test-fastutf8stream-reopen.js
@@ -8,6 +8,7 @@ const {
   openSync,
   readFile,
   renameSync,
+  write,
 } = require('node:fs');
 const { Utf8Stream } = require('node:fs');
 const { join } = require('node:path');
@@ -27,6 +28,47 @@ function getTempFile() {
 runTests(false);
 runTests(true);
 
+// A write started by a 'ready' listener after reopen() must complete before
+// 'drain' is emitted. Deferring the reopened file's write by one setImmediate
+// makes the write land after the nextTick on which reopen() used to emit a
+// premature 'drain'. Async mode only: sync mode writes before 'ready'.
+{
+  const dest = getTempFile();
+  const after = dest + '-new';
+  const stream = new Utf8Stream({
+    dest,
+    minLength: 0,
+    sync: false,
+    fs: {
+      write(fd, buf, enc, cb) {
+        if (stream.file === after) {
+          setImmediate(() => write(fd, buf, enc, cb));
+          return;
+        }
+        return write(fd, buf, enc, cb);
+      },
+    },
+  });
+
+  assert.ok(stream.write('hello world\n'));
+
+  stream.once('drain', common.mustCall(() => {
+    stream.reopen(after);
+
+    stream.once('ready', common.mustCall(() => {
+      assert.ok(stream.write('after reopen\n'));
+
+      stream.once('drain', common.mustCall(() => {
+        assert.strictEqual(stream.writing, false);
+        readFile(after, 'utf8', common.mustSucceed((data) => {
+          assert.strictEqual(data, 'after reopen\n');
+          stream.end();
+        }));
+      }));
+    }));
+  }));
+}
+
 function runTests(sync) {
 
   {
@@ -43,9 +85,9 @@ function runTests(sync) {
       stream.reopen();
 
       stream.once('ready', common.mustCall(() => {
-        assert.ok(stream.write('after reopen\n'));
-
-        stream.once('drain', common.mustCall(() => {
+        // 'drain' can come from reopen() before this write completes. 'write'
+        // is emitted synchronously in sync mode, so attach before writing.
+        stream.once('write', common.mustCall(() => {
           readFile(after, 'utf8', common.mustSucceed((data) => {
             assert.strictEqual(data, 'hello world\nsomething else\n');
             readFile(dest, 'utf8', common.mustSucceed((data) => {
@@ -54,6 +96,8 @@ function runTests(sync) {
             }));
           }));
         }));
+
+        assert.ok(stream.write('after reopen\n'));
       }));
     }));
   }
@@ -85,9 +129,8 @@ function runTests(sync) {
       assert.strictEqual(stream.file, after);
 
       stream.once('ready', common.mustCall(() => {
-        assert.ok(stream.write('after reopen\n'));
-
-        stream.once('drain', common.mustCall(() => {
+        // As above: 'drain' can come from reopen() before the write completes.
+        stream.once('write', common.mustCall(() => {
           readFile(dest, 'utf8', common.mustSucceed((data) => {
             assert.strictEqual(data, 'hello world\nsomething else\n');
             readFile(after, 'utf8', common.mustSucceed((data) => {
@@ -96,6 +139,8 @@ function runTests(sync) {
             }));
           }));
         }));
+
+        assert.ok(stream.write('after reopen\n'));
       }));
     }));
   }
diff --git a/test/parallel/test-filehandle-readablestream.js b/test/parallel/test-filehandle-readablestream.js
index 46ad53a20018..1e2eb1c6b0e2 100644
--- a/test/parallel/test-filehandle-readablestream.js
+++ b/test/parallel/test-filehandle-readablestream.js
@@ -114,6 +114,37 @@ const check = readFileSync(__filename, { encoding: 'utf8' });
   await file.close();
 })().then(common.mustCall());
 
+// Make sure 'byob' reader works with views into
+// different parts of a single ArrayBuffer
+(async () => {
+  const file = await open(__filename);
+  const dec = new TextDecoder();
+  const readable = file.readableWebStream();
+  const reader = readable.getReader({ mode: 'byob' });
+  const size = (await file.stat()).size;
+
+  let buff = new ArrayBuffer(size);
+  let offset = 0;
+  let result;
+  do {
+    result = await reader.read(new DataView(buff, offset, Math.min(100, buff.byteLength - offset)));
+    if (result.value !== undefined) {
+      buff = result.value.buffer;
+      offset += result.value.byteLength;
+      assert.ok(result.value.byteLength <= 100);
+    }
+  } while (!result.done && (offset < buff.byteLength));
+  const data = dec.decode(new Uint8Array(buff));
+
+  assert.strictEqual(check, data);
+
+  assert.throws(() => file.readableWebStream(), {
+    code: 'ERR_INVALID_STATE',
+  });
+
+  await file.close();
+})().then(common.mustCall());
+
 // Make sure a warning is logged if a non-'bytes' type is passed.
 (async () => {
   const file = await open(__filename);
diff --git a/test/parallel/test-fs-cp-async-preserve-timestamps-dir.mjs b/test/parallel/test-fs-cp-async-preserve-timestamps-dir.mjs
new file mode 100644
index 000000000000..ae93a7427e8a
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-preserve-timestamps-dir.mjs
@@ -0,0 +1,43 @@
+// This tests that cp() preserves directory timestamps
+// when preserveTimestamps is true.
+import { mustCall } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { cp, mkdirSync, writeFileSync, utimesSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+
+// Build a source tree with a known past timestamp on directories.
+const src = nextdir();
+mkdirSync(join(src, 'subdir'), { recursive: true });
+writeFileSync(join(src, 'subdir', 'file.txt'), 'hello');
+
+const pastDate = new Date('2020-01-01T00:00:00Z');
+utimesSync(join(src, 'subdir', 'file.txt'), pastDate, pastDate);
+utimesSync(join(src, 'subdir'), pastDate, pastDate);
+utimesSync(src, pastDate, pastDate);
+
+// Copy with preserveTimestamps.
+const dest = nextdir();
+cp(src, dest, {
+  recursive: true,
+  preserveTimestamps: true,
+}, mustCall((err) => {
+  assert.strictEqual(err, null);
+
+  // Verify file timestamps are preserved (existing behaviour).
+  const srcFileStat = statSync(join(src, 'subdir', 'file.txt'));
+  const destFileStat = statSync(join(dest, 'subdir', 'file.txt'));
+  assert.strictEqual(srcFileStat.mtime.getTime(), destFileStat.mtime.getTime());
+
+  // Verify directory timestamps are preserved (the bug fix).
+  const srcDirStat = statSync(join(src, 'subdir'));
+  const destDirStat = statSync(join(dest, 'subdir'));
+  assert.strictEqual(srcDirStat.mtime.getTime(), destDirStat.mtime.getTime());
+
+  const srcRootStat = statSync(src);
+  const destRootStat = statSync(dest);
+  assert.strictEqual(srcRootStat.mtime.getTime(), destRootStat.mtime.getTime());
+}));
diff --git a/test/parallel/test-fs-cp-sync-dir-exists-error-on-exist.mjs b/test/parallel/test-fs-cp-sync-dir-exists-error-on-exist.mjs
new file mode 100644
index 000000000000..bcc95476a9f6
--- /dev/null
+++ b/test/parallel/test-fs-cp-sync-dir-exists-error-on-exist.mjs
@@ -0,0 +1,32 @@
+// This tests that cpSync() throws if errorOnExist is true, force is false,
+// and the destination directory already exists (even if contents don't
+// conflict), matching the asynchronous cp() behavior.
+
+import '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { cpSync, mkdirSync, writeFileSync } from 'node:fs';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+
+const src = nextdir();
+const dest = nextdir();
+
+// Create source directory with a file
+mkdirSync(src);
+writeFileSync(`${src}/file.txt`, 'test');
+
+// Create destination directory with a different (non-conflicting) file
+mkdirSync(dest);
+writeFileSync(`${dest}/other.txt`, 'existing');
+
+// Should throw because dest directory already exists
+assert.throws(
+  () => cpSync(src, dest, {
+    recursive: true,
+    errorOnExist: true,
+    force: false,
+  }),
+  { code: 'ERR_FS_CP_EEXIST' },
+);
diff --git a/test/parallel/test-fs-cp-sync-directory-mode.mjs b/test/parallel/test-fs-cp-sync-directory-mode.mjs
new file mode 100644
index 000000000000..f022af268f1e
--- /dev/null
+++ b/test/parallel/test-fs-cp-sync-directory-mode.mjs
@@ -0,0 +1,64 @@
+// This tests that cpSync gives the directories it creates the mode of the
+// corresponding source directory, as cp does.
+import { mustNotMutateObjectDeep, isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, statSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import { isMainThread } from 'node:worker_threads';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('directory modes are not meaningful on Windows');
+if (!isMainThread)
+  skip('process.umask() is not available in workers');
+
+tmpdir.refresh();
+const mask = process.umask(0o022);
+
+const src = nextdir();
+mkdirSync(join(src, 'private', 'inner'), { recursive: true, mode: 0o700 });
+mkdirSync(join(src, 'shared'), { mode: 0o775 });
+writeFileSync(join(src, 'private', 'inner', 'file'), 'x', { mode: 0o600 });
+
+function modes(root) {
+  return ['.', 'private', 'private/inner', 'shared', 'private/inner/file']
+    .map((p) => (statSync(join(root, p)).mode & 0o777).toString(8));
+}
+
+const destSync = nextdir();
+cpSync(src, destSync, mustNotMutateObjectDeep({ recursive: true }));
+assert.deepStrictEqual(modes(destSync), modes(src));
+
+const destAsync = nextdir();
+await promises.cp(src, destAsync, { recursive: true });
+assert.deepStrictEqual(modes(destAsync), modes(src));
+
+// A read-only source directory can still be copied; its copy ends up read-only too.
+{
+  const roSrc = nextdir();
+  mkdirSync(join(roSrc, 'sub'), { recursive: true });
+  writeFileSync(join(roSrc, 'sub', 'file'), 'x');
+  chmodSync(join(roSrc, 'sub'), 0o555);
+  chmodSync(roSrc, 0o555);
+  const readOnly = [roSrc, join(roSrc, 'sub')];
+  for (const copy of [(dest) => cpSync(roSrc, dest, { recursive: true }),
+                      (dest) => promises.cp(roSrc, dest, { recursive: true })]) {
+    const dest = nextdir();
+    await copy(dest);
+    assert.strictEqual(statSync(join(dest, 'sub', 'file')).size, 1);
+    assert.deepStrictEqual(
+      [dest, join(dest, 'sub')].map((p) => (statSync(p).mode & 0o777).toString(8)), ['555', '555']);
+    readOnly.push(dest, join(dest, 'sub'));
+  }
+  // Let tmpdir clean up.
+  for (const dir of readOnly) chmodSync(dir, 0o755);
+}
+
+// An existing destination directory keeps its own mode.
+const existing = nextdir();
+mkdirSync(existing, { mode: 0o711 });
+cpSync(src, existing, mustNotMutateObjectDeep({ recursive: true }));
+assert.strictEqual((statSync(existing).mode & 0o777).toString(8), '711');
+assert.deepStrictEqual(modes(existing).slice(1), modes(src).slice(1));
+process.umask(mask);
diff --git a/test/parallel/test-fs-cp-sync-preserve-timestamps-dir.mjs b/test/parallel/test-fs-cp-sync-preserve-timestamps-dir.mjs
new file mode 100644
index 000000000000..20d889075988
--- /dev/null
+++ b/test/parallel/test-fs-cp-sync-preserve-timestamps-dir.mjs
@@ -0,0 +1,42 @@
+// This tests that cpSync with a filter preserves directory timestamps
+// when preserveTimestamps is true.
+import '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { cpSync, mkdirSync, writeFileSync, utimesSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+
+// Build a source tree with a known past timestamp on directories.
+const src = nextdir();
+mkdirSync(join(src, 'subdir'), { recursive: true });
+writeFileSync(join(src, 'subdir', 'file.txt'), 'hello');
+
+const pastDate = new Date('2020-01-01T00:00:00Z');
+utimesSync(join(src, 'subdir', 'file.txt'), pastDate, pastDate);
+utimesSync(join(src, 'subdir'), pastDate, pastDate);
+utimesSync(src, pastDate, pastDate);
+
+// Copy with preserveTimestamps and a filter (to exercise the JS fallback path).
+const dest = nextdir();
+cpSync(src, dest, {
+  recursive: true,
+  preserveTimestamps: true,
+  filter: () => true,
+});
+
+// Verify file timestamps are preserved (existing behaviour).
+const srcFileStat = statSync(join(src, 'subdir', 'file.txt'));
+const destFileStat = statSync(join(dest, 'subdir', 'file.txt'));
+assert.strictEqual(srcFileStat.mtime.getTime(), destFileStat.mtime.getTime());
+
+// Verify directory timestamps are preserved (the bug fix).
+const srcDirStat = statSync(join(src, 'subdir'));
+const destDirStat = statSync(join(dest, 'subdir'));
+assert.strictEqual(srcDirStat.mtime.getTime(), destDirStat.mtime.getTime());
+
+const srcRootStat = statSync(src);
+const destRootStat = statSync(dest);
+assert.strictEqual(srcRootStat.mtime.getTime(), destRootStat.mtime.getTime());
diff --git a/test/parallel/test-fs-glob-no-follow-symlink-globstar.mjs b/test/parallel/test-fs-glob-no-follow-symlink-globstar.mjs
new file mode 100644
index 000000000000..b1b3cda8d016
--- /dev/null
+++ b/test/parallel/test-fs-glob-no-follow-symlink-globstar.mjs
@@ -0,0 +1,81 @@
+import * as common from '../common/index.mjs';
+import tmpdir from '../common/tmpdir.js';
+import assert from 'node:assert';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { glob as globPromise, mkdir, symlink, writeFile } from 'node:fs/promises';
+import { globSync, glob as asyncGlob } from 'node:fs';
+
+if (common.isWindows) {
+  // Directory symlinks require elevated privileges on Windows.
+  common.skip('symlinks are unreliable on Windows');
+}
+
+tmpdir.refresh();
+
+// Layout:
+//   root/visible.txt
+//   root/link  ->  outside   (outside/ holds files that must NOT be listed)
+const base = tmpdir.resolve('globstar-symlink');
+const root = path.resolve(base, 'workspace');
+const outside = path.resolve(base, 'outside');
+const outsideNested = path.resolve(outside, 'nested');
+
+await mkdir(root, { recursive: true });
+await mkdir(outsideNested, { recursive: true });
+await writeFile(path.resolve(root, 'visible.txt'), 'visible');
+await writeFile(path.resolve(outside, 'secret-one.txt'), 'secret one');
+await writeFile(path.resolve(outsideNested, 'secret-two.txt'), 'secret two');
+await symlink(outside, path.resolve(root, 'link'), 'dir');
+
+const expected = ['link', 'visible.txt'].map((e) => e.replaceAll('/', path.sep)).sort();
+
+// `**/*` must not descend into the symlinked directory, neither by default nor
+// with followSymlinks explicitly disabled.
+assert.deepStrictEqual(globSync('**/*', { cwd: root }).sort(), expected);
+assert.deepStrictEqual(
+  globSync('**/*', { cwd: root, followSymlinks: false }).sort(),
+  expected,
+);
+
+const promiseMatches = [];
+for await (const entry of globPromise('**/*', { cwd: root, followSymlinks: false })) {
+  promiseMatches.push(entry);
+}
+assert.deepStrictEqual(promiseMatches.sort(), expected);
+
+const callbackMatches = await new Promise((resolve, reject) => {
+  asyncGlob('**/*', { cwd: root, followSymlinks: false }, (err, matches) => {
+    if (err) reject(err);
+    else resolve(matches);
+  });
+});
+assert.deepStrictEqual(callbackMatches.sort(), expected);
+
+// Under the permission model, `**/*` must not expose entries from a symlink
+// target that is outside the granted read set.
+if (common.hasCrypto) {
+  const child = `
+    const assert = require('node:assert');
+    const fs = require('node:fs');
+    const path = require('node:path');
+    const root = ${JSON.stringify(root)};
+    const outside = ${JSON.stringify(outside)};
+    const expected = ['link', 'visible.txt'].map((e) => e.replaceAll('/', path.sep)).sort();
+    assert.strictEqual(process.permission.has('fs.read', root), true);
+    assert.strictEqual(process.permission.has('fs.read', outside), false);
+    assert.throws(() => fs.readdirSync(outside), { code: 'ERR_ACCESS_DENIED' });
+    assert.deepStrictEqual(fs.globSync('**/*', { cwd: root }).sort(), expected);
+    assert.deepStrictEqual(
+      fs.globSync('**/*', { cwd: root, followSymlinks: false }).sort(),
+      expected,
+    );
+  `;
+  const { status, stdout, stderr } = spawnSync(process.execPath, [
+    '--permission',
+    `--allow-fs-read=${root}`,
+    '-e',
+    child,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(status, 0, stderr || stdout);
+}
diff --git a/test/parallel/test-fs-glob.mjs b/test/parallel/test-fs-glob.mjs
index 9226e491358d..869fbcac0deb 100644
--- a/test/parallel/test-fs-glob.mjs
+++ b/test/parallel/test-fs-glob.mjs
@@ -119,7 +119,7 @@ const patterns = {
     'a/x',
     'a/z',
   ],
-  './**/a': common.isWindows ? ['a'] : ['a', 'a/symlink/a', 'a/symlink/a/b/c/a'],
+  './**/a': common.isWindows ? ['a'] : ['a', 'a/symlink/a'],
   './**/a/**/': [
     'a',
     'a/abcdef',
@@ -139,10 +139,6 @@ const patterns = {
       'a/symlink',
       'a/symlink/a',
       'a/symlink/a/b',
-      'a/symlink/a/b/c',
-      'a/symlink/a/b/c/a',
-      'a/symlink/a/b/c/a/b',
-      'a/symlink/a/b/c/a/b/c',
     ]),
     'a/x',
     'a/z',
@@ -173,9 +169,6 @@ const patterns = {
       'a/symlink/a',
       'a/symlink/a/b',
       'a/symlink/a/b/c',
-      'a/symlink/a/b/c/a',
-      'a/symlink/a/b/c/a/b',
-      'a/symlink/a/b/c/a/b/c',
     ]),
     'a/x',
     'a/z',
@@ -183,13 +176,6 @@ const patterns = {
   './**/a/**/a/**/': common.isWindows ? [] : [
     'a/symlink/a',
     'a/symlink/a/b',
-    'a/symlink/a/b/c',
-    'a/symlink/a/b/c/a',
-    'a/symlink/a/b/c/a/b',
-    'a/symlink/a/b/c/a/b/c',
-    'a/symlink/a/b/c/a/b/c/a',
-    'a/symlink/a/b/c/a/b/c/a/b',
-    'a/symlink/a/b/c/a/b/c/a/b/c',
   ],
   '+(a|b|c)/a{/,bc*}/**': [
     'a/abcdef',
@@ -268,7 +254,6 @@ const patterns = {
   'a/symlink/a/**/*': common.isWindows ? [] : [
     'a/symlink/a/b',
     'a/symlink/a/b/c',
-    'a/symlink/a/b/c/a',
   ],
   'a/!(symlink)/**/..': [
     'a',
@@ -745,3 +730,31 @@ describe('glob - seen cache', function() {
     assert.strictEqual(child.status, 0, child.stderr || child.stdout);
   });
 });
+
+// gh-58991: exclude patterns must apply the same case-sensitivity as include
+// patterns. On case-insensitive filesystems include patterns match entries
+// regardless of case, so literal exclude patterns must match that behavior.
+const skipCaseTests = { skip: !common.isWindows && !common.isMacOS };
+describe('glob - exclude case-insensitive consistency', skipCaseTests, function() {
+  test('literal exclude ignores case (sync)', () => {
+    assert.deepStrictEqual(
+      globSync('a/b', { cwd: fixtureDir, exclude: ['A/B'] }), []);
+  });
+  test('literal exclude matches differently-cased results (sync)', () => {
+    assert.deepStrictEqual(
+      globSync('A/b', { cwd: fixtureDir, exclude: ['a/b'] }), []);
+  });
+  test('literal exclude ignores case (async)', async () => {
+    const promisified = promisify(glob);
+    assert.deepStrictEqual(
+      await promisified('a/b', { cwd: fixtureDir, exclude: ['A/B'] }), []);
+  });
+  test('literal exclude ignores case (promise)', async () => {
+    const actual = [];
+    for await (const entry of asyncGlob(
+      'a/b', { cwd: fixtureDir, exclude: ['A/B'] })) {
+      actual.push(entry);
+    }
+    assert.deepStrictEqual(actual, []);
+  });
+});
diff --git a/test/parallel/test-fs-promises-file-handle-read.js b/test/parallel/test-fs-promises-file-handle-read.js
index 423f1778bf63..2974c9d4d575 100644
--- a/test/parallel/test-fs-promises-file-handle-read.js
+++ b/test/parallel/test-fs-promises-file-handle-read.js
@@ -112,6 +112,27 @@ async function validateReadLength(len) {
   }
 }
 
+async function validateReadLengthCoercedFromString() {
+  // Align with fs.read / fs.readSync (`length |= 0`). A non-number length
+  // must not reach node::fs::Read (CHECK args[3]->IsInt32()).
+  const buf = Buffer.alloc(4);
+  const filePath = fixtures.path('x.txt');
+  const fileHandle = await open(filePath, 'r');
+  try {
+    const { bytesRead } = await fileHandle.read(buf, 0, '1', 0);
+    assert.strictEqual(bytesRead, 1);
+    const { bytesRead: bytesReadOptions } = await fileHandle.read({
+      buffer: buf,
+      offset: 0,
+      length: '1',
+      position: 0,
+    });
+    assert.strictEqual(bytesReadOptions, 1);
+  } finally {
+    await fileHandle.close();
+  }
+}
+
 async function validateReadWithNoOptions(byte) {
   const buf = Buffer.alloc(byte);
   const filePath = fixtures.path('x.txt');
@@ -144,6 +165,7 @@ async function validateReadWithNoOptions(byte) {
   await validateReadWithPositionZero();
   await validateReadLength(0);
   await validateReadLength(1);
+  await validateReadLengthCoercedFromString();
   await validateReadWithNoOptions(0);
   await validateReadWithNoOptions(1);
 })().then(common.mustCall());
diff --git a/test/parallel/test-fs-rm.js b/test/parallel/test-fs-rm.js
index e92bf8c07971..1d0578e3004d 100644
--- a/test/parallel/test-fs-rm.js
+++ b/test/parallel/test-fs-rm.js
@@ -631,3 +631,30 @@ if (isGitPresent) {
     }
   }
 }
+
+{
+  // Test that rmSync can delete read-only files (and directories containing read-only files recursively)
+  const dirname = nextDirPath();
+  const filePath = path.join(dirname, 'readonly-file.txt');
+  const recursiveDir = path.join(dirname, 'subdir');
+  const recursiveFilePath = path.join(recursiveDir, 'readonly-nested.txt');
+
+  fs.mkdirSync(recursiveDir, { recursive: true });
+  fs.writeFileSync(filePath, 'hello');
+  fs.writeFileSync(recursiveFilePath, 'world');
+
+  // Make files read-only
+  fs.chmodSync(filePath, 0o444);
+  fs.chmodSync(recursiveFilePath, 0o444);
+
+  // rmSync without recursive option on a file
+  fs.rmSync(filePath);
+  assert.strictEqual(fs.existsSync(filePath), false);
+
+  // rmSync with recursive option on a directory containing a read-only file
+  fs.rmSync(recursiveDir, { recursive: true });
+  assert.strictEqual(fs.existsSync(recursiveDir), false);
+
+  // Clean up parent directory
+  fs.rmSync(dirname, { recursive: true, force: true });
+}
diff --git a/test/parallel/test-fs-rmSync-special-char-additional-error.js b/test/parallel/test-fs-rmSync-special-char-additional-error.js
new file mode 100644
index 000000000000..9b4de3c84d62
--- /dev/null
+++ b/test/parallel/test-fs-rmSync-special-char-additional-error.js
@@ -0,0 +1,69 @@
+'use strict';
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const { execSync } = require('child_process');
+
+tmpdir.refresh(); // Prepare a clean temporary directory
+
+function countOccurrences(haystack, needle) {
+  let count = 0;
+  let offset = 0;
+
+  while ((offset = haystack.indexOf(needle, offset)) !== -1) {
+    count++;
+    offset += needle.length;
+  }
+
+  return count;
+}
+
+const dirPath = path.join(tmpdir.path, '速_dir');
+const filePath = path.join(dirPath, 'test_file.txt');
+
+// Create a directory and a file within it
+fs.mkdirSync(dirPath, { recursive: true });
+fs.writeFileSync(filePath, 'This is a test file.');
+
+// Set permissions to simulate a permission denied scenario
+if (process.platform === 'win32') {
+  // Windows: Deny delete permissions
+  execSync(`icacls "${filePath}" /deny Everyone:(D)`);
+} else {
+  // Unix/Linux: Remove write permissions from the directory
+  fs.chmodSync(dirPath, 0o555); // Read and execute permissions only
+}
+
+try {
+  // Attempt to delete the directory which should now fail
+  assert.throws(() => {
+    fs.rmSync(dirPath, { recursive: true });
+  }, (err) => {
+    // Verify that the error is due to permission restrictions
+    let expectedCode = 'EACCES';
+    if (common.isMacOS) {
+      expectedCode = 'ENOTEMPTY';
+    } else if (common.isWindows) {
+      expectedCode = 'EPERM';
+    }
+    assert.strictEqual(err.code, expectedCode);
+    assert.strictEqual(err.syscall, 'rm');
+    assert.strictEqual(err.path, dirPath);
+    assert.strictEqual(countOccurrences(err.message, dirPath), 1);
+    return true;
+  });
+} finally {
+  // Cleanup - resetting permissions and removing the directory safely
+  if (process.platform === 'win32') {
+    // Remove the explicit permissions before attempting to delete
+    execSync(`icacls "${filePath}" /remove:d Everyone`);
+  } else {
+    // Reset permissions to allow deletion
+    fs.chmodSync(dirPath, 0o755); // Restore full permissions to the directory
+  }
+
+  // Attempt to clean up
+  fs.rmSync(dirPath, { recursive: true }); // This should now succeed
+}
diff --git a/test/parallel/test-fs-watch-enoent.js b/test/parallel/test-fs-watch-enoent.js
index e363b3e9325c..2a4befa72b3c 100644
--- a/test/parallel/test-fs-watch-enoent.js
+++ b/test/parallel/test-fs-watch-enoent.js
@@ -17,6 +17,8 @@ const {
   UV_ENODEV,
   UV_ENOENT
 } = internalBinding('uv');
+const { FSWatcher: RecursiveFSWatcher } = require('internal/fs/recursive_watch');
+const { kFSWatchStart } = require('internal/fs/watchers');
 
 tmpdir.refresh();
 
@@ -66,6 +68,60 @@ tmpdir.refresh();
   }
 }
 
+{
+  assert.throws(
+    () => fs.watch(nonexistentFile, {
+      recursive: true,
+      throwIfNoEntry: true,
+    }, common.mustNotCall()),
+    {
+      path: nonexistentFile,
+      filename: nonexistentFile,
+      code: 'ENOENT',
+    },
+  );
+}
+
+{
+  const watcher = fs.watch(nonexistentFile, {
+    recursive: true,
+    throwIfNoEntry: false,
+  }, common.mustNotCall());
+  watcher.close();
+}
+
+{
+  const directory = tmpdir.resolve('recursive-watch-error');
+  const expected = new Error('recursive watcher failed');
+  const originalWatch = fs.watch;
+  const watcher = new RecursiveFSWatcher({ recursive: true });
+  const close = common.mustCall();
+  let calls = 0;
+
+  expected.code = 'ENOSPC';
+  fs.mkdirSync(`${directory}/subdirectory`, { recursive: true });
+  fs.watch = common.mustCall(() => {
+    if (calls++ === 0) {
+      return { close };
+    }
+    throw expected;
+  }, 2);
+
+  try {
+    assert.throws(
+      () => watcher[kFSWatchStart](directory),
+      (error) => {
+        assert.strictEqual(error, expected);
+        assert.strictEqual(error.filename, directory);
+        return true;
+      },
+    );
+  } finally {
+    fs.watch = originalWatch;
+    watcher.close();
+  }
+}
+
 {
   if (common.isMacOS || common.isWindows) {
     const file = tmpdir.resolve('file-to-watch');
diff --git a/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js b/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
new file mode 100644
index 000000000000..2573f582a312
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
@@ -0,0 +1,53 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (!common.isAIX)
+  common.skip('AIX-specific ENODEV handling');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('preserve-watch-error');
+const originalStatSync = fs.statSync;
+const originalWatch = fs.watch;
+const expected = new Error('watch failed');
+const verificationError = new Error('stat failed');
+const watcher = new FSWatcher({ recursive: true, throwIfNoEntry: false });
+const failVerification = common.mustCall(() => {
+  throw verificationError;
+});
+
+expected.code = 'ENODEV';
+verificationError.code = 'EIO';
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  throw expected;
+});
+fs.statSync = (filename, options) => {
+  if (filename === directory && options?.throwIfNoEntry === false) {
+    return failVerification();
+  }
+  return Reflect.apply(originalStatSync, fs, [filename, options]);
+};
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    (error) => {
+      assert.strictEqual(error, expected);
+      return true;
+    },
+  );
+} finally {
+  watcher.close();
+  fs.statSync = originalStatSync;
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-linux-directory-watchers.js b/test/parallel/test-fs-watch-recursive-linux-directory-watchers.js
new file mode 100644
index 000000000000..bb68893f2d40
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-linux-directory-watchers.js
@@ -0,0 +1,108 @@
+'use strict';
+const common = require('../common');
+
+// This tests the JavaScript recursive fs.watch() implementation (used where
+// there is no native one, e.g. Linux): handle count, event reporting, ref/unref.
+
+if (!common.isLinux)
+  common.skip('the recursive watcher is native on this platform');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { setTimeout: wait } = require('timers/promises');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+const delay = () => wait(common.platformTimeout(100));
+
+function countFSEventHandles() {
+  return process.getActiveResourcesInfo().filter((type) => type === 'FSEventWrap').length;
+}
+
+// Collects events until `done(events)` returns true, then closes the watcher.
+function watchUntil(target, done) {
+  return new Promise((resolve) => {
+    const events = [];
+    const watcher = fs.watch(target, { recursive: true });
+    watcher.on('change', (eventType, filename) => {
+      events.push(`${eventType} ${filename}`);
+      if (done(events)) {
+        watcher.close();
+        resolve(events);
+      }
+    });
+  });
+}
+
+(async () => {
+  const root = tmpdir.resolve('root');
+  fs.mkdirSync(path.join(root, 'sub'), { recursive: true });
+  for (let i = 0; i < 20; i++) {
+    fs.writeFileSync(path.join(root, `file-${i}.txt`), 'x');
+    fs.writeFileSync(path.join(root, 'sub', `file-${i}.txt`), 'x');
+  }
+  fs.symlinkSync(path.join(root, 'sub', 'file-1.txt'), path.join(root, 'link'));
+
+  {
+    // One handle per directory (root, sub) plus one for the symbolic link.
+    const before = countFSEventHandles();
+    const watcher = fs.watch(root, { recursive: true });
+    assert.strictEqual(countFSEventHandles() - before, 3);
+    watcher.unref();
+    watcher.ref();
+    watcher.close();
+  }
+
+  {
+    // A file replaced by rename() keeps being reported.
+    const file = path.join(root, 'sub', 'file-0.txt');
+    const changed = `change ${path.join('sub', 'file-0.txt')}`;
+    const events = watchUntil(root, (seen) => seen.filter((e) => e === changed).length === 2);
+    await delay();
+    fs.writeFileSync(`${file}.tmp`, 'replaced');
+    fs.renameSync(`${file}.tmp`, file);
+    await delay();
+    fs.appendFileSync(file, ' and modified');
+    await events;
+  }
+
+  {
+    // A write behind a symbolic link is reported as a rename of the link, and
+    // touching a known subdirectory itself does not throw or emit.
+    const events = watchUntil(root, (seen) => seen.includes('rename link'));
+    await delay();
+    fs.chmodSync(path.join(root, 'sub'), 0o775);
+    fs.appendFileSync(path.join(root, 'sub', 'file-1.txt'), 'more');
+    assert.ok(!(await events).some((e) => e.endsWith(' sub')));
+  }
+
+  {
+    // Removing the watched root directory is reported.
+    const doomed = tmpdir.resolve('doomed');
+    fs.mkdirSync(doomed);
+    fs.writeFileSync(path.join(doomed, 'inside'), 'x');
+    const events = watchUntil(doomed, (seen) => seen.includes('rename '));
+    await delay();
+    fs.rmSync(doomed, { recursive: true });
+    await events;
+  }
+
+  {
+    // So is removing a watched root that is a file (with an empty filename,
+    // as before).
+    const lone = tmpdir.resolve('lone.txt');
+    fs.writeFileSync(lone, 'x');
+    const events = watchUntil(lone, (seen) => seen.includes('rename '));
+    await delay();
+    fs.rmSync(lone);
+    await events;
+  }
+
+  {
+    const watcher = fs.watch(root, { recursive: true });
+    watcher.unref();
+    // The process exits although this watcher is never closed.
+    process.on('exit', () => assert.ok(watcher));
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
new file mode 100644
index 000000000000..b91dbe625aeb
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
@@ -0,0 +1,54 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('retry-directory-disappears-before-read');
+const child = path.join(directory, 'child');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let childWatchCalls = 0;
+let directoryListener;
+let staleWatcherCloseCalls = 0;
+
+fs.mkdirSync(child, { recursive: true });
+fs.watch = common.mustCall((filename, options, listener) => {
+  if (filename === directory) {
+    directoryListener = listener;
+    return createWatcher();
+  }
+
+  assert.strictEqual(filename, child);
+  childWatchCalls++;
+  if (childWatchCalls === 1) {
+    fs.rmSync(child, { recursive: true });
+    return { close: () => staleWatcherCloseCalls++ };
+  }
+  return createWatcher();
+}, 3);
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.strictEqual(childWatchCalls, 1);
+  assert.strictEqual(staleWatcherCloseCalls, 1);
+
+  fs.mkdirSync(child);
+  directoryListener('rename', null);
+
+  assert.strictEqual(childWatchCalls, 2);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
new file mode 100644
index 000000000000..8f570180a855
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
@@ -0,0 +1,66 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('retry-directory-disappears-before-watch');
+const child = path.join(directory, 'child');
+const originalWatch = fs.watch;
+const changes = [];
+const watcher = new FSWatcher({ recursive: true });
+let childWatchCalls = 0;
+let directoryListener;
+let watchError;
+
+fs.mkdirSync(child, { recursive: true });
+watcher.on('change', (eventType, filename) => changes.push([eventType, filename]));
+fs.watch = common.mustCall((filename, options, listener) => {
+  if (filename === directory) {
+    directoryListener = listener;
+    return createWatcher();
+  }
+
+  assert.strictEqual(filename, child);
+  childWatchCalls++;
+  if (childWatchCalls === 1) {
+    fs.rmSync(child, { recursive: true });
+    try {
+      return Reflect.apply(originalWatch, fs, [filename, options, listener]);
+    } catch (error) {
+      watchError = error;
+      throw error;
+    }
+  }
+  return createWatcher();
+}, 3);
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.strictEqual(childWatchCalls, 1);
+  assert.match(watchError?.code, /^(ENOENT|ENODEV)$/);
+
+  fs.mkdirSync(child);
+  directoryListener('rename', null);
+
+  assert.strictEqual(childWatchCalls, 2);
+  assert.deepStrictEqual(changes, [['rename', 'child']]);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
new file mode 100644
index 000000000000..7692c86a3abe
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
@@ -0,0 +1,37 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-read');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let closeCalls = 0;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  return { close: () => closeCalls++ };
+});
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    {
+      code: 'ENOENT',
+      filename: directory,
+    },
+  );
+  assert.strictEqual(closeCalls, 1);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
new file mode 100644
index 000000000000..c43f3e275184
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
@@ -0,0 +1,40 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-watch-no-throw');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true, throwIfNoEntry: false });
+let watchError;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  try {
+    return Reflect.apply(originalWatch, fs, [filename, ...args]);
+  } catch (error) {
+    watchError = error;
+    throw error;
+  }
+});
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.match(watchError?.code, /^(ENOENT|ENODEV)$/);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
new file mode 100644
index 000000000000..917489004650
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
@@ -0,0 +1,46 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-watch');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let watchError;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  try {
+    return Reflect.apply(originalWatch, fs, [filename, ...args]);
+  } catch (error) {
+    watchError = error;
+    throw error;
+  }
+});
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    (error) => {
+      assert.strictEqual(error, watchError);
+      assert.match(error.code, /^(ENOENT|ENODEV)$/);
+      return true;
+    },
+  );
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-watch-before-read.js b/test/parallel/test-fs-watch-recursive-watch-before-read.js
new file mode 100644
index 000000000000..4faeb5b8efbe
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-watch-before-read.js
@@ -0,0 +1,42 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('watch-before-read');
+const originalReaddirSync = fs.readdirSync;
+const originalWatch = fs.watch;
+const operations = [];
+const watcher = new FSWatcher({ recursive: true });
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  operations.push('watch');
+  return createWatcher();
+});
+fs.readdirSync = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  operations.push('read');
+  return Reflect.apply(originalReaddirSync, fs, [filename, ...args]);
+});
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.deepStrictEqual(operations, ['watch', 'read']);
+} finally {
+  watcher.close();
+  fs.readdirSync = originalReaddirSync;
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-http-1.0.js b/test/parallel/test-http-1.0.js
index 639bd228df00..2df00633eafb 100644
--- a/test/parallel/test-http-1.0.js
+++ b/test/parallel/test-http-1.0.js
@@ -127,9 +127,12 @@ function test(handler, request_generator, response_validator) {
     assert.strictEqual(req.httpVersionMinor, 1);
     res.sendDate = false;
     res.writeHead(200, { 'Content-Type': 'text/plain' });
-    res.write('Hello, '); res._send('');
+    assert.throws(() => res.write('ignored', 'invalid'), {
+      code: 'ERR_UNKNOWN_ENCODING',
+    });
+    res.write('Hello, ', common.mustCall()); res._send('');
     res.write('world!'); res._send('');
-    res.end();
+    process.nextTick(() => res.end('X'));
   }
 
   function request_generator() {
@@ -148,10 +151,10 @@ function test(handler, request_generator, response_validator) {
                               'Connection: close\r\n' +
                               'Transfer-Encoding: chunked\r\n' +
                               '\r\n' +
-                              '7\r\n' +
-                              'Hello, \r\n' +
-                              '6\r\n' +
-                              'world!\r\n' +
+                              'd\r\n' +
+                              'Hello, world!\r\n' +
+                              '1\r\n' +
+                              'X\r\n' +
                               '0\r\n' +
                               '\r\n';
 
diff --git a/test/parallel/test-http-buffer-sanity.js b/test/parallel/test-http-buffer-sanity.js
index a235f3793a4f..e122976f0e3f 100644
--- a/test/parallel/test-http-buffer-sanity.js
+++ b/test/parallel/test-http-buffer-sanity.js
@@ -55,6 +55,7 @@ const server = http.Server(common.mustCallAtLeast(function(req, res) {
 
 server.listen(0, common.mustCall(() => {
   const req = http.request({
+    agent: false,
     port: server.address().port,
     method: 'POST',
     path: '/',
diff --git a/test/parallel/test-http-byteswritten.js b/test/parallel/test-http-byteswritten.js
index 32495613afa6..475176e6c976 100644
--- a/test/parallel/test-http-byteswritten.js
+++ b/test/parallel/test-http-byteswritten.js
@@ -44,12 +44,12 @@ const httpServer = http.createServer(common.mustCall(function(req, res) {
     res.write(bchunk);
     res.write(chunk, 'hex');
   }
-  // Get .bytesWritten while buffer is not empty
-  assert(res.connection.bytesWritten > 0);
-
   res.end(body);
+
+  // Get .bytesWritten while the socket buffer is not empty.
+  assert(res.connection.bytesWritten > 0);
 }));
 
 httpServer.listen(0, function() {
-  http.get({ port: this.address().port });
+  http.get({ port: this.address().port, agent: false });
 });
diff --git a/test/parallel/test-http-catch-uncaughtexception.js b/test/parallel/test-http-catch-uncaughtexception.js
index 1366b6e26ea3..e9a78332925a 100644
--- a/test/parallel/test-http-catch-uncaughtexception.js
+++ b/test/parallel/test-http-catch-uncaughtexception.js
@@ -14,7 +14,7 @@ const server = http.createServer(function(req, res) {
   res.writeHead(200, { 'Content-Type': 'text/plain' });
   res.end('bye');
 }).listen(0, function() {
-  http.get({ port: this.address().port }, function(res) {
+  http.get({ port: this.address().port, agent: false }, function(res) {
     res.resume();
     throw new Error('get did fail');
   }).on('close', function() {
diff --git a/test/parallel/test-http-client-abort-completed-keepalive.js b/test/parallel/test-http-client-abort-completed-keepalive.js
new file mode 100644
index 000000000000..78d2f366bd7c
--- /dev/null
+++ b/test/parallel/test-http-client-abort-completed-keepalive.js
@@ -0,0 +1,57 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const http = require('http');
+
+// Aborting a request whose exchange has already completed must not destroy the
+// socket that is being released to the agent. socketErrorListener has been
+// removed by responseKeepAlive() at that point, so the error would be emitted
+// on a socket with no 'error' listener and crash the process.
+// Refs: https://github.com/nodejs/node/issues/65938
+
+const agent = new http.Agent({ keepAlive: true });
+
+const server = http.createServer((req, res) => {
+  res.end('x');
+});
+
+server.listen(0, '127.0.0.1', common.mustCall(() => {
+  const controller = new AbortController();
+
+  const req = http.get({
+    port: server.address().port,
+    host: '127.0.0.1',
+    agent,
+    signal: controller.signal,
+  }, common.mustCall(async (res) => {
+    res.on('error', common.mustNotCall());
+
+    for await (const chunk of res) {
+      assert.strictEqual(chunk.length, 1);
+      assert.strictEqual(res.complete, true);
+      assert.strictEqual(req.writableFinished, true);
+      controller.abort(new Error('stop reading'));
+      break;
+    }
+
+    // The socket must survive the abort and go back to the pool, and a
+    // subsequent request must be able to reuse it.
+    const res2 = await new Promise((resolve, reject) => {
+      const req2 = http.get({
+        port: server.address().port,
+        host: '127.0.0.1',
+        agent,
+      }, resolve);
+      req2.on('error', reject);
+    });
+
+    let body = '';
+    for await (const chunk of res2) body += chunk;
+    assert.strictEqual(body, 'x');
+
+    agent.destroy();
+    server.close();
+  }));
+
+  req.on('error', common.mustNotCall());
+}));
diff --git a/test/parallel/test-http-client-check-http-token.js b/test/parallel/test-http-client-check-http-token.js
index ef2445ec66e5..7ab9aa83d761 100644
--- a/test/parallel/test-http-client-check-http-token.js
+++ b/test/parallel/test-http-client-check-http-token.js
@@ -29,6 +29,6 @@ server.listen(0, common.mustCall(() => {
   });
 
   expectedSuccesses.forEach((method) => {
-    http.request({ method, port: server.address().port }).end();
+    http.request({ method, port: server.address().port, agent: false }).end();
   });
 }));
diff --git a/test/parallel/test-http-client-encoding.js b/test/parallel/test-http-client-encoding.js
index a4701cdbd0ab..253496307286 100644
--- a/test/parallel/test-http-client-encoding.js
+++ b/test/parallel/test-http-client-encoding.js
@@ -29,6 +29,7 @@ const server = http.createServer((req, res) => {
   server.close();
 }).listen(0, common.mustCall(() => {
   http.request({
+    agent: false,
     port: server.address().port,
     encoding: 'utf8'
   }, common.mustCall((res) => {
diff --git a/test/parallel/test-http-client-response-domain.js b/test/parallel/test-http-client-response-domain.js
index 9975ca3f9498..da3d3a09ff0f 100644
--- a/test/parallel/test-http-client-response-domain.js
+++ b/test/parallel/test-http-client-response-domain.js
@@ -49,6 +49,7 @@ function test() {
   }));
 
   const req = http.get({
+    agent: false,
     socketPath: common.PIPE,
     headers: { 'Content-Length': '1' },
     method: 'POST',
diff --git a/test/parallel/test-http-decoded-auth.js b/test/parallel/test-http-decoded-auth.js
index 076c056253b6..4f7847133f58 100644
--- a/test/parallel/test-http-decoded-auth.js
+++ b/test/parallel/test-http-decoded-auth.js
@@ -43,6 +43,6 @@ for (const testCase of testCases) {
   server.listen(0, function() {
     // make the request
     const url = new URL(`http://${testCase.username}:${testCase.password}@localhost:${this.address().port}`);
-    http.request(url).end();
+    http.request(url, { agent: false }).end();
   });
 }
diff --git a/test/parallel/test-http-default-port.js b/test/parallel/test-http-default-port.js
index 2005487502fe..874affcdf23c 100644
--- a/test/parallel/test-http-default-port.js
+++ b/test/parallel/test-http-default-port.js
@@ -44,7 +44,6 @@ for (const { mod, createServer } of [
     assert.strictEqual(req.headers['x-port'], `${server.address().port}`);
     res.writeHead(200);
     res.end('ok');
-    server.close();
   })).listen(0, common.mustCall(() => {
     mod.globalAgent.defaultPort = server.address().port;
     mod.get({
@@ -54,6 +53,7 @@ for (const { mod, createServer } of [
         'x-port': server.address().port
       }
     }, common.mustCall((res) => {
+      res.on('end', common.mustCall(() => server.close()));
       res.resume();
     }));
   }));
diff --git a/test/parallel/test-http-dont-set-default-headers-with-setHost.js b/test/parallel/test-http-dont-set-default-headers-with-setHost.js
index e2a4e39c24b8..418051127859 100644
--- a/test/parallel/test-http-dont-set-default-headers-with-setHost.js
+++ b/test/parallel/test-http-dont-set-default-headers-with-setHost.js
@@ -14,6 +14,7 @@ const server = http.createServer(common.mustCall(function(req, res) {
 }));
 server.listen(0, common.localhostIPv4, function() {
   http.request({
+    agent: false,
     method: 'POST',
     host: common.localhostIPv4,
     port: this.address().port,
diff --git a/test/parallel/test-http-dont-set-default-headers.js b/test/parallel/test-http-dont-set-default-headers.js
index 3f73c11e5112..0b8e4c58f56b 100644
--- a/test/parallel/test-http-dont-set-default-headers.js
+++ b/test/parallel/test-http-dont-set-default-headers.js
@@ -17,6 +17,7 @@ const server = http.createServer(common.mustCall(function(req, res) {
 }));
 server.listen(0, common.localhostIPv4, function() {
   http.request({
+    agent: false,
     method: 'POST',
     host: common.localhostIPv4,
     port: this.address().port,
diff --git a/test/parallel/test-http-early-hints-invalid-argument.js b/test/parallel/test-http-early-hints-invalid-argument.js
index edf613614bc7..b426ca3e840f 100644
--- a/test/parallel/test-http-early-hints-invalid-argument.js
+++ b/test/parallel/test-http-early-hints-invalid-argument.js
@@ -38,7 +38,7 @@ const testResBody = 'response content\n';
 
   server.listen(0, common.mustCall(() => {
     const req = http.request({
-      port: server.address().port, path: '/'
+      port: server.address().port, path: '/', agent: false
     });
 
     req.end();
@@ -79,7 +79,7 @@ const testResBody = 'response content\n';
 
   server.listen(0, common.mustCall(() => {
     const req = http.request({
-      port: server.address().port, path: '/'
+      port: server.address().port, path: '/', agent: false
     });
 
     req.end();
diff --git a/test/parallel/test-http-flush-headers.js b/test/parallel/test-http-flush-headers.js
index aaff80971c47..c155720ef9d1 100644
--- a/test/parallel/test-http-flush-headers.js
+++ b/test/parallel/test-http-flush-headers.js
@@ -16,5 +16,6 @@ server.listen(0, '127.0.0.1', common.mustCall(function() {
     port: this.address().port,
   });
   req.setHeader('foo', 'bar');
+  req.setHeader('Connection', 'close');
   req.flushHeaders();
 }));
diff --git a/test/parallel/test-http-head-request.js b/test/parallel/test-http-head-request.js
index 26d490d357dc..a9fcb2c166b3 100644
--- a/test/parallel/test-http-head-request.js
+++ b/test/parallel/test-http-head-request.js
@@ -35,6 +35,7 @@ function test(headers) {
 
   server.listen(0, common.mustCall(function() {
     const request = http.request({
+      agent: false,
       port: this.address().port,
       method: 'HEAD',
       path: '/'
diff --git a/test/parallel/test-http-hex-write.js b/test/parallel/test-http-hex-write.js
index a3cbec6b36c0..4162811276d9 100644
--- a/test/parallel/test-http-hex-write.js
+++ b/test/parallel/test-http-hex-write.js
@@ -34,7 +34,7 @@ http.createServer(function(q, s) {
   s.end();
   this.close();
 }).listen(0, common.mustCall(function() {
-  http.request({ port: this.address().port })
+  http.request({ port: this.address().port, agent: false })
     .on('response', common.mustCall(function(res) {
       let data = '';
 
diff --git a/test/parallel/test-http-insecure-parser.js b/test/parallel/test-http-insecure-parser.js
index 5262c3230870..8a7c1eae3182 100644
--- a/test/parallel/test-http-insecure-parser.js
+++ b/test/parallel/test-http-insecure-parser.js
@@ -11,6 +11,11 @@ const server = http.createServer(common.mustCallAtLeast((req, res) => {
   req.pipe(res);
 }));
 
+// The malformed request intentionally has no valid Connection header.
+// So we have to set an explicitly shorter-than-default timeout.
+server.keepAliveTimeout = common.platformTimeout(100);
+server.keepAliveTimeoutBuffer = 0;
+
 server.listen(0, common.mustCall(function() {
   const bufs = [];
   const client = net.connect(
diff --git a/test/parallel/test-http-keep-alive-drop-requests.js b/test/parallel/test-http-keep-alive-drop-requests.js
index a69497a0c1a0..8b1260c3b352 100644
--- a/test/parallel/test-http-keep-alive-drop-requests.js
+++ b/test/parallel/test-http-keep-alive-drop-requests.js
@@ -24,12 +24,20 @@ server.on('dropRequest', common.mustCall((request, socket) => {
 
 server.listen(0, common.mustCall(() => {
   const socket = net.connect(server.address().port);
+  let response = '';
   socket.on('connect', common.mustCall(() => {
     request(socket);
     request(socket);
   }));
-  socket.on('data', common.mustCallAtLeast());
-  socket.on('close', common.mustCall());
+  socket.on('data', common.mustCallAtLeast((chunk) => {
+    response += chunk;
+    if (response.includes('HTTP/1.1 503 Service Unavailable'))
+      socket.end();
+  }));
+  socket.on('close', common.mustCall(() => {
+    assert.match(response, /HTTP\/1\.1 200 OK/);
+    assert.match(response, /HTTP\/1\.1 503 Service Unavailable/);
+  }));
 }));
 
 server.maxRequestsPerSocket = 1;
diff --git a/test/parallel/test-http-outgoing-destroyed.js b/test/parallel/test-http-outgoing-destroyed.js
index b60b6594c765..e6f533d22448 100644
--- a/test/parallel/test-http-outgoing-destroyed.js
+++ b/test/parallel/test-http-outgoing-destroyed.js
@@ -66,6 +66,9 @@ const { OutgoingMessage } = require('http');
       });
     }));
     const err = new Error('Destroy test');
+    res.write('x', common.mustCall((writeErr) => {
+      assert.strictEqual(writeErr, err);
+    }));
     res.destroy(err);
     assert.strictEqual(res.errored, err);
   })).listen(0, common.mustCall(() => {
diff --git a/test/parallel/test-http-outgoing-end-types.js b/test/parallel/test-http-outgoing-end-types.js
index 20b443bff2c1..48372a98e81b 100644
--- a/test/parallel/test-http-outgoing-end-types.js
+++ b/test/parallel/test-http-outgoing-end-types.js
@@ -14,5 +14,5 @@ const httpServer = http.createServer(common.mustCall(function(req, res) {
 }));
 
 httpServer.listen(0, common.mustCall(function() {
-  http.get({ port: this.address().port });
+  http.get({ port: this.address().port, agent: false });
 }));
diff --git a/test/parallel/test-http-outgoing-finish-writable.js b/test/parallel/test-http-outgoing-finish-writable.js
index e3c870164bac..e0d9b73702cf 100644
--- a/test/parallel/test-http-outgoing-finish-writable.js
+++ b/test/parallel/test-http-outgoing-finish-writable.js
@@ -25,6 +25,7 @@ server.listen(0);
 
 server.on('listening', common.mustCall(function() {
   const clientRequest = http.request({
+    agent: false,
     port: server.address().port,
     method: 'GET',
     path: '/'
diff --git a/test/parallel/test-http-outgoing-finish.js b/test/parallel/test-http-outgoing-finish.js
index 0f71cccdf810..f2378d9e05b2 100644
--- a/test/parallel/test-http-outgoing-finish.js
+++ b/test/parallel/test-http-outgoing-finish.js
@@ -33,6 +33,7 @@ http.createServer(function(req, res) {
   this.close();
 }).listen(0, function() {
   const req = http.request({
+    agent: false,
     port: this.address().port,
     method: 'PUT'
   });
diff --git a/test/parallel/test-http-outgoing-properties.js b/test/parallel/test-http-outgoing-properties.js
index 85c5b659a36d..a831765322b8 100644
--- a/test/parallel/test-http-outgoing-properties.js
+++ b/test/parallel/test-http-outgoing-properties.js
@@ -36,6 +36,7 @@ const OutgoingMessage = http.OutgoingMessage;
 
   server.on('listening', common.mustCall(function() {
     const clientRequest = http.request({
+      agent: false,
       port: server.address().port,
       method: 'GET',
       path: '/'
@@ -62,6 +63,7 @@ const OutgoingMessage = http.OutgoingMessage;
 
   server.on('listening', common.mustCall(() => {
     const req = http.request({
+      agent: false,
       port: server.address().port,
       method: 'GET',
       path: '/'
diff --git a/test/parallel/test-http-outgoing-write-types.js b/test/parallel/test-http-outgoing-write-types.js
index 6257b87eea8e..0f2c686d5a7a 100644
--- a/test/parallel/test-http-outgoing-write-types.js
+++ b/test/parallel/test-http-outgoing-write-types.js
@@ -20,5 +20,5 @@ const httpServer = http.createServer(common.mustCall(function(req, res) {
 }));
 
 httpServer.listen(0, common.mustCall(function() {
-  http.get({ port: this.address().port });
+  http.get({ port: this.address().port, agent: false });
 }));
diff --git a/test/parallel/test-http-pipeline-assertionerror-finish.js b/test/parallel/test-http-pipeline-assertionerror-finish.js
index 7721cb7fea3b..60915dd60699 100644
--- a/test/parallel/test-http-pipeline-assertionerror-finish.js
+++ b/test/parallel/test-http-pipeline-assertionerror-finish.js
@@ -27,7 +27,8 @@ const server = http
   .listen(0, function() {
     const s = net.connect(this.address().port);
 
-    const big = 'GET / HTTP/1.1\r\nHost: example.com\r\n\r\n'.repeat(COUNT);
+    const big = 'GET / HTTP/1.1\r\nHost: example.com\r\n\r\n'.repeat(COUNT - 1) +
+                'GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n';
 
     s.write(big);
     s.resume();
diff --git a/test/parallel/test-http-req-res-close.js b/test/parallel/test-http-req-res-close.js
index 8a0a9e5ab3fc..34312731d26b 100644
--- a/test/parallel/test-http-req-res-close.js
+++ b/test/parallel/test-http-req-res-close.js
@@ -40,7 +40,7 @@ const assert = require('assert');
   }));
 
   server.listen(0, common.mustCall(() => {
-    http.get({ port: server.address().port }, common.mustCall());
+    http.get({ port: server.address().port, agent: false }, common.mustCall());
   }));
 }
 
@@ -81,7 +81,7 @@ const assert = require('assert');
   }));
 
   server.listen(0, common.mustCall(() => {
-    http.get({ port: server.address().port }, common.mustCall());
+    http.get({ port: server.address().port, agent: false }, common.mustCall());
   }));
 }
 
@@ -126,6 +126,6 @@ const assert = require('assert');
   }));
 
   server.listen(0, common.mustCall(() => {
-    http.get({ port: server.address().port }, common.mustCall());
+    http.get({ port: server.address().port, agent: false }, common.mustCall());
   }));
 }
diff --git a/test/parallel/test-http-request-arguments.js b/test/parallel/test-http-request-arguments.js
index 5cdd514fd506..b08da9bc5256 100644
--- a/test/parallel/test-http-request-arguments.js
+++ b/test/parallel/test-http-request-arguments.js
@@ -18,7 +18,7 @@ const http = require('http');
     common.mustCall(() => {
       http.get(
         'http://example.com/testpath',
-        { hostname: 'localhost', port: server.address().port },
+        { hostname: 'localhost', port: server.address().port, agent: false },
         common.mustCall((res) => {
           res.resume();
         })
diff --git a/test/parallel/test-http-request-large-payload.js b/test/parallel/test-http-request-large-payload.js
index 3be100b74041..08fada1381f2 100644
--- a/test/parallel/test-http-request-large-payload.js
+++ b/test/parallel/test-http-request-large-payload.js
@@ -16,6 +16,7 @@ const server = http.createServer(function(req, res) {
 
 server.listen(0, function() {
   const req = http.request({
+    agent: false,
     method: 'POST',
     port: this.address().port
   });
diff --git a/test/parallel/test-http-server-connection-list-when-close-deferred.js b/test/parallel/test-http-server-connection-list-when-close-deferred.js
new file mode 100644
index 000000000000..af87e3561618
--- /dev/null
+++ b/test/parallel/test-http-server-connection-list-when-close-deferred.js
@@ -0,0 +1,35 @@
+'use strict';
+
+const common = require('../common');
+const http = require('http');
+
+// Keep this case in a separate process from the immediate-close case so
+// their modified parsers cannot be reused across cases.
+
+function request(server) {
+  http.get({
+    agent: false,
+    port: server.address().port,
+    path: '/',
+  }, (res) => {
+    res.resume();
+  });
+}
+
+const server = http.createServer(common.mustCallAtLeast((req, res) => {
+  // See `freeParser` in _http_common.js
+  const { parser } = req.socket;
+  parser.free = common.mustCall(() => {
+    setImmediate(common.mustCall(() => {
+      parser.close();
+    }));
+  });
+  req.socket.on('close', common.mustCall(() => {
+    setImmediate(common.mustCall(() => {
+      server.close();
+    }));
+  }));
+  res.end('ok');
+})).listen(0, common.mustCall(() => {
+  request(server);
+}));
diff --git a/test/parallel/test-http-server-connection-list-when-close.js b/test/parallel/test-http-server-connection-list-when-close.js
index a530b710c490..305755b14eb3 100644
--- a/test/parallel/test-http-server-connection-list-when-close.js
+++ b/test/parallel/test-http-server-connection-list-when-close.js
@@ -5,6 +5,7 @@ const http = require('http');
 
 function request(server) {
   http.get({
+    agent: false,
     port: server.address().port,
     path: '/',
   }, (res) => {
@@ -12,36 +13,14 @@ function request(server) {
   });
 }
 
-{
-  const server = http.createServer(common.mustCallAtLeast((req, res) => {
-    //  Hack to not remove parser out of server.connectionList
-    //  See `freeParser` in _http_common.js
-    req.socket.parser.free = common.mustCall();
-    req.socket.on('close', common.mustCall(() => {
-      server.close();
-    }));
-    res.end('ok');
-  })).listen(0, common.mustCall(() => {
-    request(server);
+const server = http.createServer(common.mustCallAtLeast((req, res) => {
+  //  Hack to not remove parser out of server.connectionList
+  //  See `freeParser` in _http_common.js
+  req.socket.parser.free = common.mustCall();
+  req.socket.on('close', common.mustCall(() => {
+    server.close();
   }));
-}
-
-{
-  const server = http.createServer(common.mustCallAtLeast((req, res) => {
-    // See `freeParser` in _http_common.js
-    const { parser } = req.socket;
-    parser.free = common.mustCall(() => {
-      setImmediate(common.mustCall(() => {
-        parser.close();
-      }));
-    });
-    req.socket.on('close', common.mustCall(() => {
-      setImmediate(common.mustCall(() => {
-        server.close();
-      }));
-    }));
-    res.end('ok');
-  })).listen(0, common.mustCall(() => {
-    request(server);
-  }));
-}
+  res.end('ok');
+})).listen(0, common.mustCall(() => {
+  request(server);
+}));
diff --git a/test/parallel/test-http-server-delete-parser.js b/test/parallel/test-http-server-delete-parser.js
index 4215ee2f9df7..6b5a3e13f503 100644
--- a/test/parallel/test-http-server-delete-parser.js
+++ b/test/parallel/test-http-server-delete-parser.js
@@ -14,6 +14,7 @@ const server = http.createServer(common.mustCall((req, res) => {
 
 server.listen(0, '127.0.0.1', common.mustCall(() => {
   const req = http.request({
+    agent: false,
     port: server.address().port,
     host: '127.0.0.1',
     method: 'GET',
diff --git a/test/parallel/test-http-server-multiheaders.js b/test/parallel/test-http-server-multiheaders.js
index fea84a8d4a7e..e15dbd0fcaed 100644
--- a/test/parallel/test-http-server-multiheaders.js
+++ b/test/parallel/test-http-server-multiheaders.js
@@ -48,6 +48,7 @@ const server = http.createServer(common.mustCall((req, res) => {
 
 server.listen(0, function() {
   http.get({
+    agent: false,
     host: 'localhost',
     port: this.address().port,
     path: '/',
diff --git a/test/parallel/test-http-server-multiheaders2.js b/test/parallel/test-http-server-multiheaders2.js
index 0408afa1b13e..85f2fb09f931 100644
--- a/test/parallel/test-http-server-multiheaders2.js
+++ b/test/parallel/test-http-server-multiheaders2.js
@@ -100,6 +100,7 @@ const headers = []
 
 server.listen(0, function() {
   http.get({
+    agent: false,
     host: 'localhost',
     port: this.address().port,
     path: '/',
diff --git a/test/parallel/test-http-set-timeout-server.js b/test/parallel/test-http-set-timeout-server.js
index 4a381ec92cd0..28a941ef8c56 100644
--- a/test/parallel/test-http-set-timeout-server.js
+++ b/test/parallel/test-http-set-timeout-server.js
@@ -192,7 +192,6 @@ test(function fastTimeout(cb) {
 
   const server = http.createServer(common.mustCall((req, res) => {
     req.on('timeout', common.mustNotCall());
-    res.end();
     connectionHandlerInvoked = true;
     invokeCallbackIfDone();
   }));
diff --git a/test/parallel/test-http-url.parse-auth-with-header-in-request.js b/test/parallel/test-http-url.parse-auth-with-header-in-request.js
index ea5793ee18ae..e4834c32a644 100644
--- a/test/parallel/test-http-url.parse-auth-with-header-in-request.js
+++ b/test/parallel/test-http-url.parse-auth-with-header-in-request.js
@@ -41,6 +41,7 @@ const server = http.createServer(function(request, response) {
 server.listen(0, function() {
   const testURL =
     url.parse(`http://asdf:qwer@localhost:${this.address().port}`);
+  testURL.agent = false;
   // The test here is if you set a specific authorization header in the
   // request we should not override that with basic auth
   testURL.headers = {
diff --git a/test/parallel/test-http-url.parse-auth.js b/test/parallel/test-http-url.parse-auth.js
index 2bb531158645..287c27b9eb91 100644
--- a/test/parallel/test-http-url.parse-auth.js
+++ b/test/parallel/test-http-url.parse-auth.js
@@ -42,6 +42,7 @@ server.listen(0, function() {
   const port = this.address().port;
   // username = "user", password = "pass:"
   const testURL = url.parse(`http://user:pass%3A@localhost:${port}`);
+  testURL.agent = false;
 
   // make the request
   http.request(testURL).end();
diff --git a/test/parallel/test-http-url.parse-basic.js b/test/parallel/test-http-url.parse-basic.js
index d0c230977178..223d1d7af25a 100644
--- a/test/parallel/test-http-url.parse-basic.js
+++ b/test/parallel/test-http-url.parse-basic.js
@@ -43,7 +43,6 @@ const server = http.createServer(function(request, response) {
   check(request);
   response.writeHead(200, {});
   response.end('ok');
-  server.close();
 });
 
 server.listen(0, common.mustCall(function() {
@@ -54,5 +53,9 @@ server.listen(0, common.mustCall(function() {
   // Since there is a little magic with the agent
   // make sure that an http request uses the http.Agent
   assert.ok(clientRequest.agent instanceof http.Agent);
+  clientRequest.on('response', common.mustCall((response) => {
+    response.on('end', common.mustCall(() => server.close()));
+    response.resume();
+  }));
   clientRequest.end();
 }));
diff --git a/test/parallel/test-http-url.parse-https.request.js b/test/parallel/test-http-url.parse-https.request.js
index ff819adc2b84..e20c3a0ec7bc 100644
--- a/test/parallel/test-http-url.parse-https.request.js
+++ b/test/parallel/test-http-url.parse-https.request.js
@@ -45,7 +45,6 @@ const server = https.createServer(httpsOptions, function(request, response) {
   check(request);
   response.writeHead(200, {});
   response.end('ok');
-  server.close();
 });
 
 server.listen(0, common.mustCall(function() {
@@ -57,5 +56,9 @@ server.listen(0, common.mustCall(function() {
   // Since there is a little magic with the agent
   // make sure that the request uses the https.Agent
   assert.ok(clientRequest.agent instanceof https.Agent);
+  clientRequest.on('response', common.mustCall((response) => {
+    response.on('end', common.mustCall(() => server.close()));
+    response.resume();
+  }));
   clientRequest.end();
 }));
diff --git a/test/parallel/test-http-url.parse-path.js b/test/parallel/test-http-url.parse-path.js
index 25e4838c4afa..04fe12a4ff1f 100644
--- a/test/parallel/test-http-url.parse-path.js
+++ b/test/parallel/test-http-url.parse-path.js
@@ -40,6 +40,7 @@ const server = http.createServer(function(request, response) {
 
 server.listen(0, function() {
   const testURL = url.parse(`http://localhost:${this.address().port}/asdf`);
+  testURL.agent = false;
 
   // make the request
   http.request(testURL).end();
diff --git a/test/parallel/test-http-url.parse-post.js b/test/parallel/test-http-url.parse-post.js
index db5ee78fe6eb..447a1b6a3fdc 100644
--- a/test/parallel/test-http-url.parse-post.js
+++ b/test/parallel/test-http-url.parse-post.js
@@ -47,6 +47,7 @@ const server = http.createServer(function(request, response) {
 
 server.listen(0, function() {
   testURL = url.parse(`http://localhost:${this.address().port}/asdf?qwer=zxcv`);
+  testURL.agent = false;
   testURL.method = 'POST';
 
   // make the request
diff --git a/test/parallel/test-http-url.parse-search.js b/test/parallel/test-http-url.parse-search.js
index 0759c779d3ff..80f435a6789a 100644
--- a/test/parallel/test-http-url.parse-search.js
+++ b/test/parallel/test-http-url.parse-search.js
@@ -41,6 +41,7 @@ const server = http.createServer(function(request, response) {
 server.listen(0, function() {
   const port = this.address().port;
   const testURL = url.parse(`http://localhost:${port}/asdf?qwer=zxcv`);
+  testURL.agent = false;
 
   // make the request
   http.request(testURL).end();
diff --git a/test/parallel/test-http-write-callbacks.js b/test/parallel/test-http-write-callbacks.js
index 1f90e5135be6..3b29f7c2f5d6 100644
--- a/test/parallel/test-http-write-callbacks.js
+++ b/test/parallel/test-http-write-callbacks.js
@@ -71,6 +71,7 @@ server.on('checkContinue', common.mustCall((req, res) => {
 
 server.listen(0, common.mustCall(function() {
   const req = http.request({
+    agent: false,
     port: this.address().port,
     method: 'PUT',
     headers: { 'expect': '100-continue' }
diff --git a/test/parallel/test-http-write-empty-string.js b/test/parallel/test-http-write-empty-string.js
index 88eff08f7666..05e97a4865c3 100644
--- a/test/parallel/test-http-write-empty-string.js
+++ b/test/parallel/test-http-write-empty-string.js
@@ -39,7 +39,7 @@ const server = http.createServer(function(request, response) {
 });
 
 server.listen(0, common.mustCall(() => {
-  http.get({ port: server.address().port }, common.mustCall((res) => {
+  http.get({ port: server.address().port, agent: false }, common.mustCall((res) => {
     let response = '';
 
     assert.strictEqual(res.statusCode, 200);
diff --git a/test/parallel/test-http-zero-length-write.js b/test/parallel/test-http-zero-length-write.js
index dfaa7b92fb7d..92905fd9755a 100644
--- a/test/parallel/test-http-zero-length-write.js
+++ b/test/parallel/test-http-zero-length-write.js
@@ -75,7 +75,7 @@ const server = http.createServer(common.mustCall((req, res) => {
 }));
 
 server.listen(0, common.mustCall(function() {
-  const req = http.request({ port: this.address().port, method: 'POST' });
+  const req = http.request({ port: this.address().port, method: 'POST', agent: false });
   let actual = '';
   req.on('response', common.mustCall((res) => {
     res.setEncoding('utf8');
diff --git a/test/parallel/test-http2-async-local-storage.js b/test/parallel/test-http2-async-local-storage.js
index 22ed71388d59..76e42fea1570 100644
--- a/test/parallel/test-http2-async-local-storage.js
+++ b/test/parallel/test-http2-async-local-storage.js
@@ -10,46 +10,56 @@ const async_hooks = require('async_hooks');
 const storage = new async_hooks.AsyncLocalStorage();
 
 const {
-  HTTP2_HEADER_CONTENT_TYPE,
   HTTP2_HEADER_PATH,
   HTTP2_HEADER_STATUS,
 } = http2.constants;
 
-const server = http2.createServer();
-server.on('stream', (stream) => {
-  stream.respond({
-    [HTTP2_HEADER_CONTENT_TYPE]: 'text/plain; charset=utf-8',
-    [HTTP2_HEADER_STATUS]: 200
-  });
-  stream.on('error', common.mustNotCall());
+function runTest(serverHandler) {
+  const server = http2.createServer();
+  server.on('stream', serverHandler);
+
+  server.listen(0, common.mustCall(() => {
+    const client = storage.run({ id: 0 }, () =>
+      http2.connect(`http://localhost:${server.address().port}`));
+
+    let ended = 0;
+    function doReq(id) {
+      const req = client.request({ [HTTP2_HEADER_PATH]: '/' });
+
+      req.on('response', common.mustCall((headers) => {
+        assert.strictEqual(headers[HTTP2_HEADER_STATUS], 200);
+        assert.strictEqual(storage.getStore().id, id);
+      }));
+      req.on('data', common.mustCall(() => {
+        assert.strictEqual(storage.getStore().id, id);
+      }));
+      req.on('end', common.mustCall(() => {
+        assert.strictEqual(storage.getStore().id, id);
+        if (++ended === 2) {
+          server.close();
+          client.close();
+        }
+      }));
+    }
+
+    storage.run({ id: 1 }, () => doReq(1));
+    storage.run({ id: 2 }, () => doReq(2));
+  }));
+}
+
+// Response without trailers: END_STREAM on the DATA frame.
+runTest((stream) => {
+  stream.respond({ [HTTP2_HEADER_STATUS]: 200 });
   stream.end('data');
 });
 
-server.listen(0, common.mustCall(async () => {
-  const client = storage.run({ id: 0 }, () => http2.connect(`http://localhost:${server.address().port}`));
-
-  async function doReq(id) {
-    const req = client.request({ [HTTP2_HEADER_PATH]: '/' });
-
-    req.on('response', common.mustCall((headers) => {
-      assert.strictEqual(headers[HTTP2_HEADER_STATUS], 200);
-      assert.strictEqual(id, storage.getStore().id);
-    }));
-    req.on('data', common.mustCall((data) => {
-      assert.strictEqual(data.toString(), 'data');
-      assert.strictEqual(id, storage.getStore().id);
-    }));
-    req.on('end', common.mustCall(() => {
-      assert.strictEqual(id, storage.getStore().id);
-      server.close();
-      client.close();
-    }));
-  }
-
-  function doReqWith(id) {
-    storage.run({ id }, () => doReq(id));
-  }
-
-  doReqWith(1);
-  doReqWith(2);
-}));
+// Response with trailers (as gRPC uses): END_STREAM on the trailing HEADERS
+// frame. The 'end' event must still run in the request's context.
+runTest((stream) => {
+  stream.respond({ [HTTP2_HEADER_STATUS]: 200 }, { waitForTrailers: true });
+  stream.on('wantTrailers', () => {
+    stream.sendTrailers({ 'grpc-status': '0' });
+  });
+  stream.write('data');
+  stream.end();
+});
diff --git a/test/parallel/test-http2-bidirectional-write-deadlock.js b/test/parallel/test-http2-bidirectional-write-deadlock.js
new file mode 100644
index 000000000000..306dce021cb0
--- /dev/null
+++ b/test/parallel/test-http2-bidirectional-write-deadlock.js
@@ -0,0 +1,109 @@
+'use strict';
+
+// Regression test against deadlocks between two HTTP/2 peers that are both
+// writing at the same time.
+//
+// To bound how much it buffered while output was backed up, an Http2Session
+// used to stop reading from its socket whenever a write was in flight, and
+// resume only once that write completed. When the peer was itself blocked
+// writing, that write never completed, so the session never read again and
+// the connection hung forever with no error and no timeout.
+//
+// Rather than relying on kernel socket buffers filling up - which depends on
+// the platform and configured window sizes - this models one half of that
+// cycle directly. The client's socket forwards a write but does not report it
+// as complete, substituting for a write blocked because the peer is not
+// reading. Only after that write is stalled does the server send its response
+// body. A session that stops reading while writing never sees it.
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+const net = require('net');
+const { Duplex } = require('stream');
+
+const BODY = 'the response body';
+
+const heldCallbacks = [];
+let serverStream;
+
+let stallWrites = false;
+
+// Client-side socket that forwards writes to a real connection, but can leave
+// their completion callbacks pending to model a transport-blocked write.
+class StalledClientSocket extends Duplex {
+  constructor(port) {
+    super();
+    this.inner = net.connect(port, common.localhostIPv4);
+    this.inner.on('data', (chunk) => this.push(chunk));
+    this.inner.on('end', () => this.push(null));
+  }
+  _read() {
+    // Incoming data is pushed as it arrives.
+  }
+  _write(chunk, encoding, callback) {
+    this.inner.write(chunk, encoding);
+    if (stallWrites) {
+      heldCallbacks.push(callback);
+      // Avoid writing from the server re-entrantly inside _write(). The
+      // ordering is still explicit: this callback is already held.
+      setImmediate(() => serverStream.end(BODY));
+      return;
+    }
+    callback();
+  }
+  _final(callback) {
+    this.inner.end(callback);
+  }
+  _destroy(err, callback) {
+    this.inner.destroy();
+    callback(err);
+  }
+}
+
+const server = http2.createServer();
+
+server.on('stream', common.mustCall((stream) => {
+  // Send headers first. Their response event starts the stalled client write.
+  stream.respond();
+  serverStream = stream;
+}));
+
+server.listen(0, common.mustCall(() => {
+  const port = server.address().port;
+
+  const client = http2.connect(`http://${common.localhostIPv4}:${port}`, {
+    createConnection: () => new StalledClientSocket(port),
+  });
+
+  const req = client.request({ ':method': 'POST' });
+
+  let received = '';
+
+  req.on('response', common.mustCall(() => {
+    // _write() will schedule the response body only after it has retained the
+    // callback, guaranteeing that the native write is still in progress.
+    stallWrites = true;
+    req.write(Buffer.alloc(256));
+  }));
+
+  req.on('data', (chunk) => {
+    received += chunk;
+  });
+
+  req.on('end', common.mustCall(() => {
+    assert.strictEqual(received, BODY);
+    assert.ok(heldCallbacks.length > 0,
+              'test did not actually stall a socket write');
+
+    // Let the stalled writes complete so that everything can shut down.
+    stallWrites = false;
+    for (const callback of heldCallbacks) callback();
+
+    req.end();
+    client.close();
+    server.close();
+  }));
+}));
diff --git a/test/parallel/test-http2-close-while-writing.js b/test/parallel/test-http2-close-while-writing.js
index c0a05c4a8da2..f83950025805 100644
--- a/test/parallel/test-http2-close-while-writing.js
+++ b/test/parallel/test-http2-close-while-writing.js
@@ -7,6 +7,7 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
+const assert = require('assert');
 const http2 = require('http2');
 
 const key = fixtures.readKey('agent8-key.pem', 'binary');
@@ -23,11 +24,24 @@ let client_stream;
 
 server.on('session', common.mustCall(function(session) {
   session.on('stream', common.mustCall(function(stream) {
-    stream.resume();
+    // Client destroys mid-stream without END_STREAM (clean RST code).
+    // Peer reset before END_STREAM surfaces as ERR_HTTP2_STREAM_ABORTED.
+    stream.on('error', common.mustNotCall());
+
+    // Every write dispatched before close must have its callback invoked.
+    let writes = 0;
+    let writeCallbacks = 0;
     stream.on('data', function() {
-      this.write(Buffer.alloc(1));
+      writes++;
+      this.write(Buffer.alloc(1), () => {
+        writeCallbacks++;
+      });
       process.nextTick(() => client_stream.destroy());
     });
+    stream.on('close', common.mustCall(() => {
+      assert.strictEqual(writeCallbacks, writes);
+    }));
+    stream.resume();
   }));
 }));
 
diff --git a/test/parallel/test-http2-reset-buffered-read.js b/test/parallel/test-http2-reset-buffered-read.js
new file mode 100644
index 000000000000..0f3cafc768cb
--- /dev/null
+++ b/test/parallel/test-http2-reset-buffered-read.js
@@ -0,0 +1,46 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+
+// A clean peer reset must retain 26.x's buffered reads and readable 'end',
+// rather than introducing the reset errors and immediate destroy from main.
+const body = 'buffered response';
+const server = http2.createServer();
+server.on('stream', common.mustCall((stream) => {
+  stream.on('error', common.mustNotCall());
+  stream.resume();
+  stream.respond();
+  stream.write(body, common.mustCall(() => stream.close()));
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = http2.connect(`http://localhost:${server.address().port}`);
+  const request = client.request({ ':method': 'POST' });
+  request.write('request body');
+  request.pause();
+  request.read(0);
+  request.on('response', common.mustCall());
+  request.on('error', common.mustNotCall());
+  request.on('aborted', common.mustCall(() => {
+    setImmediate(common.mustCall(() => {
+      assert.strictEqual(request.destroyed, false);
+      assert.strictEqual(request.readableLength, Buffer.byteLength(body));
+      let received = '';
+      request.on('data', (chunk) => { received += chunk; });
+      request.on('end', common.mustCall(() => {
+        assert.strictEqual(received, body);
+      }));
+      request.resume();
+    }));
+  }));
+  request.on('close', common.mustCall(() => {
+    assert.strictEqual(request.readableEnded, true);
+    assert.strictEqual(request.rstCode, http2.constants.NGHTTP2_NO_ERROR);
+    client.close();
+    server.close();
+  }));
+}));
diff --git a/test/parallel/test-http2-reset-pending-write.js b/test/parallel/test-http2-reset-pending-write.js
new file mode 100644
index 000000000000..ddb5dcd918ff
--- /dev/null
+++ b/test/parallel/test-http2-reset-pending-write.js
@@ -0,0 +1,67 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+
+// A peer reset may leave a write unfinished. Preserve the clean readable
+// end in 26.x, but do not wait for writable 'finish' to destroy the stream.
+for (const compat of [false, true]) {
+  const server = http2.createServer();
+  let client;
+  let request;
+
+  function onRequest(readable, writable, stream) {
+    readable.on('error', common.mustNotCall());
+    if (writable !== readable)
+      writable.on('error', common.mustNotCall());
+    stream.on('error', common.mustNotCall());
+    readable.resume();
+    readable.on('end', common.mustCall());
+    stream.on('aborted', common.mustCall());
+    stream.on('finish', common.mustNotCall());
+    if (compat) {
+      // The compat response retains its existing finish-on-close behavior.
+      writable.on('finish', common.mustCall());
+    }
+    stream.on('close', common.mustCall(() => {
+      assert.strictEqual(stream.rstCode, http2.constants.NGHTTP2_NO_ERROR);
+      assert.strictEqual(stream.readableEnded, true);
+      assert.strictEqual(stream.writableFinished, false);
+      assert.strictEqual(stream.destroyed, true);
+      client.close();
+      server.close();
+    }));
+
+    writable.write('first response', common.mustCall(() => {
+      // Model a write whose callback cannot finish after the peer resets.
+      // Start the reset only once the write is pending.
+      stream._write = common.mustCall(() => {
+        setImmediate(() => request.destroy());
+      });
+      writable.write('pending response');
+    }));
+  }
+
+  if (compat) {
+    server.on('request', common.mustCall((req, res) => {
+      onRequest(req, res, req.stream);
+    }));
+  } else {
+    server.on('stream', common.mustCall((stream) => {
+      stream.respond();
+      onRequest(stream, stream, stream);
+    }));
+  }
+
+  server.listen(0, common.mustCall(() => {
+    client = http2.connect(`http://localhost:${server.address().port}`);
+    request = client.request({ ':method': 'POST' });
+    request.on('close', common.mustCall());
+    request.on('error', common.mustNotCall());
+    request.resume();
+    request.write('request body');
+  }));
+}
diff --git a/test/parallel/test-http2-session-destroy-stream-handler.js b/test/parallel/test-http2-session-destroy-stream-handler.js
new file mode 100644
index 000000000000..35c5b16471ef
--- /dev/null
+++ b/test/parallel/test-http2-session-destroy-stream-handler.js
@@ -0,0 +1,60 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const http2 = require('http2');
+
+// Regression test for https://github.com/nodejs/node/issues/64850
+//
+// Destroying the session from a 'stream' handler runs (via nextTick drained
+// from MakeCallback) while nghttp2 is still inside mem_recv. Close is deferred
+// for that window; later HEADERS/DATA in the same buffer must not abort with
+// Assertion failed: onread->IsFunction().
+
+const STREAMS = 8;
+const BODY = Buffer.alloc(2048, 'a');
+const ROUNDS = 40;
+
+const server = http2.createServer({
+  settings: { maxConcurrentStreams: 4 },
+});
+
+server.on('session', (session) => session.on('error', () => {}));
+
+server.on('stream', (stream) => {
+  stream.on('error', () => {});
+  stream.session.destroy();
+});
+
+server.listen(0, '127.0.0.1', common.mustCall(() => {
+  const port = server.address().port;
+  const origin = `http://127.0.0.1:${port}`;
+  let remaining = ROUNDS;
+
+  const round = () => {
+    if (remaining-- <= 0) {
+      server.close();
+      return;
+    }
+
+    const session = http2.connect(origin);
+    session.on('error', () => {});
+    session.on('close', () => setImmediate(round));
+
+    session.on('connect', () => {
+      for (let i = 0; i < STREAMS; i++) {
+        const stream = session.request({
+          ':path': `/${i}`,
+          ':method': 'POST',
+        });
+        stream.on('error', () => {});
+        stream.resume();
+        stream.end(BODY);
+      }
+    });
+  };
+
+  round();
+}));
diff --git a/test/parallel/test-http2-stream-backpressure-unread-peer.js b/test/parallel/test-http2-stream-backpressure-unread-peer.js
new file mode 100644
index 000000000000..543aba02eba2
--- /dev/null
+++ b/test/parallel/test-http2-stream-backpressure-unread-peer.js
@@ -0,0 +1,133 @@
+'use strict';
+
+// CVE-2019-9517 describes a peer that offers HTTP/2 flow-control credit
+// but then doesn't read from its TCP connection (blocking TCP flow).
+// A streaming response must stop producing data when the resulting server
+// write becomes blocked by the transport.
+
+// We use a raw client here to directly control the flow of requests and
+// stall responses to deterministically reproduce this on all platforms.
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const assert = require('assert');
+const http2 = require('http2');
+const { Duplex, Readable } = require('stream');
+
+const { MAX_INITIAL_WINDOW_SIZE } = http2.constants;
+
+const FRAME_HEADERS = 1;
+const FRAME_SETTINGS = 4;
+const FRAME_WINDOW_UPDATE = 8;
+const FLAG_END_STREAM = 1;
+const FLAG_END_HEADERS = 4;
+const INITIAL_CONNECTION_WINDOW_SIZE = 65_535;
+
+const preface = Buffer.from('PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n');
+
+function frame(type, flags, streamID, payload = Buffer.alloc(0)) {
+  const header = Buffer.alloc(9);
+  header.writeUIntBE(payload.length, 0, 3);
+  header[3] = type;
+  header[4] = flags;
+  header.writeUInt32BE(streamID, 5);
+  return Buffer.concat([header, payload]);
+}
+
+function settings() {
+  const payload = http2.getPackedSettings({
+    initialWindowSize: MAX_INITIAL_WINDOW_SIZE,
+  });
+  return frame(FRAME_SETTINGS, 0, 0, payload);
+}
+
+function connectionWindowUpdate() {
+  const payload = Buffer.alloc(4);
+  payload.writeUInt32BE(
+    MAX_INITIAL_WINDOW_SIZE - INITIAL_CONNECTION_WINDOW_SIZE, 0);
+  return frame(FRAME_WINDOW_UPDATE, 0, 0, payload);
+}
+
+function request() {
+  return frame(
+    FRAME_HEADERS,
+    FLAG_END_HEADERS | FLAG_END_STREAM,
+    1,
+    Buffer.from([
+      0x82,  // :method: GET
+      0x86,  // :scheme: http
+      0x84,  // :path: /
+      0x41, 0x01, 0x78,  // :authority: x
+    ]));
+}
+
+let onWriteStalled;
+const socket = new Duplex({
+  read() {},
+  write(_data, _encoding, callback) {
+    if (onWriteStalled === undefined) {
+      callback();
+      return;
+    }
+
+    // Leave the write pending to model a peer that has stopped reading.
+    onWriteStalled();
+  },
+});
+
+// The 1MB body is well within the client's stream and connection windows
+// (2^31-1), so HTTP/2 flow control will not limit the response.
+const CHUNK_SIZE = 16 * 1024;
+const RESPONSE_SIZE = 1024 * 1024;
+const chunk = Buffer.alloc(CHUNK_SIZE);
+
+const serverSession = http2.performServerHandshake(socket);
+serverSession.on('stream', common.mustCall((stream) => {
+  let produced = 0;
+
+  // A datasource that produces chunks on demand
+  const source = new Readable({
+    highWaterMark: CHUNK_SIZE,
+    read() {
+      if (produced === RESPONSE_SIZE) {
+        this.push(null);
+        return;
+      }
+      produced += CHUNK_SIZE;
+      this.push(chunk);
+    },
+  });
+
+  // We set this once the stream opens, to stall all future writes once the
+  // initial preface & SETTINGS dance is completed.
+  onWriteStalled = common.mustCall(() => {
+    setImmediate(common.mustCall(() => {
+      // Backpressure should have been applied to the source when the
+      // socket writable writes stalled, even though there is still
+      // H2 flow-control credit available:
+      assert(source.isPaused());
+      assert(stream.writableNeedDrain);
+
+      // Exact amount produced depends on platform-specific variables but
+      // backpressure must stop the source well before it completes:
+      assert.ok(produced <= RESPONSE_SIZE / 4,
+                `produced ${produced} of ${RESPONSE_SIZE} bytes`);
+
+      serverSession.destroy();
+      socket.destroy();
+      source.destroy();
+    }));
+  });
+
+  stream.respond();
+  source.pipe(stream);
+}));
+
+// Manually send a single request with all required preamble:
+socket.push(Buffer.concat([
+  preface,
+  settings(),
+  connectionWindowUpdate(),
+  request(),
+]));
diff --git a/test/parallel/test-https-agent-additional-options.js b/test/parallel/test-https-agent-additional-options.js
index 000cb9d3d0c2..eca5f147a419 100644
--- a/test/parallel/test-https-agent-additional-options.js
+++ b/test/parallel/test-https-agent-additional-options.js
@@ -6,17 +6,20 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const https = require('https');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
 
 const options = {
   key: fixtures.readKey('agent1-key.pem'),
   cert: fixtures.readKey('agent1-cert.pem'),
   ca: fixtures.readKey('ca1-cert.pem'),
-  minVersion: 'TLSv1.1',
+  minVersion: fips3 ? 'TLSv1.2' : 'TLSv1.1',
 };
 
-if (!process.features.openssl_is_boringssl) {
-  options.ciphers = 'ALL@SECLEVEL=0';
+if (!isBoringSSL) {
+  options.ciphers = fips3 ?
+    'ECDHE-RSA-AES256-GCM-SHA384' : 'ALL@SECLEVEL=0';
 }
 
 const server = https.Server(options, (req, res) => {
@@ -33,8 +36,9 @@ function getBaseOptions(port) {
     servername: 'agent1',
   };
 
-  if (!process.features.openssl_is_boringssl) {
-    baseOptions.ciphers = 'ALL@SECLEVEL=0';
+  if (!isBoringSSL) {
+    baseOptions.ciphers = fips3 ?
+      'ECDHE-RSA-AES256-GCM-SHA384' : 'ALL@SECLEVEL=0';
   }
 
   return baseOptions;
@@ -44,10 +48,11 @@ const updatedValues = new Map([
   ['dhparam', fixtures.readKey('dh2048.pem')],
   ['ecdhCurve', 'secp384r1'],
   ['honorCipherOrder', true],
-  ['minVersion', 'TLSv1.1'],
+  ['minVersion', fips3 ? 'TLSv1.2' : 'TLSv1.1'],
   ['maxVersion', 'TLSv1.3'],
   ['secureOptions', crypto.constants.SSL_OP_CIPHER_SERVER_PREFERENCE],
-  ['secureProtocol', 'TLSv1_1_method'],
+  ['secureProtocol', fips3 ?
+    'TLSv1_2_method' : 'TLSv1_1_method'],
   ['sessionIdContext', 'sessionIdContext'],
 ]);
 
diff --git a/test/parallel/test-https-agent-pfx-object-array-reuse.js b/test/parallel/test-https-agent-pfx-object-array-reuse.js
index 95134855e971..758c32e54008 100644
--- a/test/parallel/test-https-agent-pfx-object-array-reuse.js
+++ b/test/parallel/test-https-agent-pfx-object-array-reuse.js
@@ -6,21 +6,57 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const https = require('https');
+const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+
+const onRequest = (req, res) => {
+  res.end(req.socket.getPeerCertificate().subject.CN);
+};
+const requestHandler = fips3 && !fips35 ?
+  common.mustNotCall() :
+  common.mustCall(onRequest, fips3 ? 1 : 2);
 
 const server = https.createServer({
   key: fixtures.readKey('agent2-key.pem'),
   cert: fixtures.readKey('agent2-cert.pem'),
   requestCert: true,
   rejectUnauthorized: false,
-}, common.mustCall((req, res) => {
-  res.end(req.socket.getPeerCertificate().subject.CN);
-}, 2));
+}, requestHandler);
 
 server.listen(0, common.mustCall(async () => {
   const agent = new https.Agent({ keepAlive: true, maxSockets: 1 });
   const port = server.address().port;
 
+  if (fips3) {
+    await assert.rejects(request({
+      agent,
+      port,
+      pfx: [{ buf: fixtures.readKey('agent1.pfx'), passphrase: 'sample' }],
+    }, false), { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION' });
+
+    if (!fips35) {
+      agent.destroy();
+      server.close();
+      return;
+    }
+
+    const result = await request({
+      agent,
+      port,
+      pfx: [{
+        buf: fixtures.readKey('agent1-fips.pfx'),
+        passphrase: 'password',
+      }],
+    });
+    assert.strictEqual(result.body, 'agent1');
+    assert.strictEqual(result.reusedSocket, false);
+    agent.destroy();
+    server.close();
+    return;
+  }
+
   const first = await request({
     agent,
     port,
@@ -41,19 +77,20 @@ server.listen(0, common.mustCall(async () => {
   server.close();
 }));
 
-function request(options) {
+function request(options, expectResponse = true) {
   return new Promise((resolve, reject) => {
-    const req = https.get({
-      ...options,
-      rejectUnauthorized: false,
-    }, common.mustCall((res) => {
+    const onResponse = expectResponse ? common.mustCall((res) => {
       let body = '';
       res.setEncoding('utf8');
       res.on('data', (chunk) => body += chunk);
       res.on('end', common.mustCall(() => {
         resolve({ body, reusedSocket: req.reusedSocket });
       }));
-    }));
+    }) : common.mustNotCall();
+    const req = https.get({
+      ...options,
+      rejectUnauthorized: false,
+    }, onResponse);
     req.on('error', reject);
   });
 }
diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
index de2790e0d0a3..c4edc5b33db3 100644
--- a/test/parallel/test-https-agent-session-eviction.js
+++ b/test/parallel/test-https-agent-session-eviction.js
@@ -8,10 +8,11 @@ if (!common.hasCrypto) {
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const https = require('https');
-const { SSL_OP_NO_TICKET } = require('crypto').constants;
+const { constants: { SSL_OP_NO_TICKET } } = require('crypto');
+const fips3 = hasFIPS(3);
 
 const options = {
   key: fixtures.readKey('agent1-key.pem'),
@@ -19,11 +20,17 @@ const options = {
   secureOptions: SSL_OP_NO_TICKET,
 };
 
-if (!process.features.openssl_is_boringssl) {
-  options.ciphers = 'RSA@SECLEVEL=0';
+if (fips3) {
+  options.minVersion = 'TLSv1.3';
+  options.maxVersion = 'TLSv1.3';
 }
 
-// Create TLS1.2 server
+if (!isBoringSSL) {
+  options.ciphers = fips3 ?
+    'ECDHE-RSA-AES256-GCM-SHA384' : 'RSA@SECLEVEL=0';
+}
+
+// Create the initial server and cache a session from it.
 https.createServer(options, function(req, res) {
   res.writeHead(200, { 'Connection': 'close' });
   res.end('ohai');
@@ -47,9 +54,14 @@ function first(server) {
   req.end();
 }
 
-// Create TLS1 server
+// Create a server constrained to a different TLS version.
 function faultyServer(port) {
-  options.secureProtocol = 'TLSv1_method';
+  if (fips3) {
+    options.minVersion = 'TLSv1.2';
+    options.maxVersion = 'TLSv1.2';
+  } else {
+    options.secureProtocol = 'TLSv1_method';
+  }
   https.createServer(options, function(req, res) {
     res.writeHead(200, { 'Connection': 'close' });
     res.end('hello faulty');
@@ -62,14 +74,15 @@ function faultyServer(port) {
 function second(server, session) {
   const req = https.request({
     port: server.address().port,
-    ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+    ciphers: fips3 ? 'ECDHE-RSA-AES256-GCM-SHA384' :
+      (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
     rejectUnauthorized: false
   }, function(res) {
     res.resume();
   });
 
-  // Although we have a TLS 1.2 session to offer to the TLS 1.0 server,
-  // connection to the TLS 1.0 server should work.
+  // Offering the cached session to a server using another TLS version should
+  // not prevent a fresh connection.
   req.on('response', common.mustCall(function(res) {
     // The test is now complete for OpenSSL 1.1.0.
     server.close();
diff --git a/test/parallel/test-https-agent-session-reuse.js b/test/parallel/test-https-agent-session-reuse.js
index c5b7b78b8e02..da110e4aeb73 100644
--- a/test/parallel/test-https-agent-session-reuse.js
+++ b/test/parallel/test-https-agent-session-reuse.js
@@ -1,11 +1,13 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testTls13SessionTicketSemanticsDiffer();
   return;
 }
diff --git a/test/parallel/test-https-client-renegotiation-limit.js b/test/parallel/test-https-client-renegotiation-limit.js
index 729176b7c1aa..ee83c21c8762 100644
--- a/test/parallel/test-https-client-renegotiation-limit.js
+++ b/test/parallel/test-https-client-renegotiation-limit.js
@@ -20,12 +20,14 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testRenegotiationUnsupported();
   return;
 }
diff --git a/test/parallel/test-https-drain.js b/test/parallel/test-https-drain.js
index 5d7bf9736458..b9a5c3d3bda8 100644
--- a/test/parallel/test-https-drain.js
+++ b/test/parallel/test-https-drain.js
@@ -45,6 +45,7 @@ const server = https.createServer(options, function(req, res) {
 server.listen(0, common.mustCall(function() {
   let resumed = false;
   const req = https.request({
+    agent: false,
     method: 'POST',
     port: this.address().port,
     rejectUnauthorized: false
diff --git a/test/parallel/test-https-keep-alive-drop-requests.js b/test/parallel/test-https-keep-alive-drop-requests.js
index cf22a4a2811a..7eb9aacd3b39 100644
--- a/test/parallel/test-https-keep-alive-drop-requests.js
+++ b/test/parallel/test-https-keep-alive-drop-requests.js
@@ -39,11 +39,19 @@ server.listen(0, common.mustCall(() => {
       rejectUnauthorized: false
     },
     common.mustCall(() => {
+      let response = '';
       request(socket);
       request(socket);
       socket.on('error', common.mustNotCall());
-      socket.on('data', common.mustCallAtLeast());
-      socket.on('close', common.mustCall());
+      socket.on('data', common.mustCallAtLeast((chunk) => {
+        response += chunk;
+        if (response.includes('HTTP/1.1 503 Service Unavailable'))
+          socket.end();
+      }));
+      socket.on('close', common.mustCall(() => {
+        assert.match(response, /HTTP\/1\.1 200 OK/);
+        assert.match(response, /HTTP\/1\.1 503 Service Unavailable/);
+      }));
     })
   );
 }));
diff --git a/test/parallel/test-https-options-boolean-check.js b/test/parallel/test-https-options-boolean-check.js
index fa02a165b80f..776e966211c7 100644
--- a/test/parallel/test-https-options-boolean-check.js
+++ b/test/parallel/test-https-options-boolean-check.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -41,7 +43,7 @@ const certDataView = toDataView(certBuff);
 const caArrDataView = toDataView(caCert);
 
 function filterBoringSSLKeyCertArrayCases(options, setName) {
-  if (!process.features.openssl_is_boringssl)
+  if (!isBoringSSL)
     return options;
 
   // The array-valued cases exercise multi-identity key/cert handling.
diff --git a/test/parallel/test-https-pfx.js b/test/parallel/test-https-pfx.js
index 3c0aa82b3dbe..2be91887207d 100644
--- a/test/parallel/test-https-pfx.js
+++ b/test/parallel/test-https-pfx.js
@@ -29,6 +29,8 @@ const fixtures = require('../common/fixtures');
 
 const assert = require('assert');
 const https = require('https');
+const { hasFIPS } = require('../common/crypto');
+const fips3 = hasFIPS(3);
 
 const pfx = fixtures.readKey('rsa_cert.pfx');
 
@@ -42,10 +44,23 @@ const options = {
   rejectUnauthorized: false
 };
 
+if (fips3) {
+  assert.throws(() => https.createServer(options), {
+    code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+  });
+
+  if (!hasFIPS(3, 5)) {
+    return;
+  }
+
+  options.pfx = fixtures.readKey('agent1-fips.pfx');
+  options.passphrase = 'password';
+}
+
 const server = https.createServer(options, common.mustCallAtLeast((req, res) => {
-  assert.strictEqual(req.socket.authorized, false); // not a client cert
-  assert.strictEqual(req.socket.authorizationError,
-                     'DEPTH_ZERO_SELF_SIGNED_CERT');
+  assert.strictEqual(req.socket.authorized, fips3);
+  assert.strictEqual(req.socket.authorizationError, fips3 ?
+    null : 'DEPTH_ZERO_SELF_SIGNED_CERT');
   res.writeHead(200);
   res.end('OK');
 }));
diff --git a/test/parallel/test-https-request-arguments.js b/test/parallel/test-https-request-arguments.js
index 9dc80094be0d..e68f757be81b 100644
--- a/test/parallel/test-https-request-arguments.js
+++ b/test/parallel/test-https-request-arguments.js
@@ -32,6 +32,7 @@ const options = {
         'https://example.com/testpath',
 
         {
+          agent: false,
           hostname: 'localhost',
           port: server.address().port,
           rejectUnauthorized: false
diff --git a/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js b/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js
index 667be03d58ce..ec1b8dda8ca1 100644
--- a/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js
+++ b/test/parallel/test-https-selfsigned-no-keycertsign-no-crash.js
@@ -13,9 +13,10 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const crypto = require('crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 // See #37990 for details on why this is problematic with FIPS.
-if (process.config.variables.openssl_is_fips)
+if (crypto.getFips() === 1 && !hasOpenSSL(3))
   common.skip('Skipping as test uses non-fips compliant EC curve');
 
 // This test will fail for OpenSSL < 1.1.1h
diff --git a/test/parallel/test-https-set-timeout-server.js b/test/parallel/test-https-set-timeout-server.js
index e1b833611a1f..a7e188c8d96a 100644
--- a/test/parallel/test-https-set-timeout-server.js
+++ b/test/parallel/test-https-set-timeout-server.js
@@ -216,7 +216,6 @@ test(function fastTimeout(cb) {
   const server = https.createServer(serverOptions, common.mustCall(
     (req, res) => {
       req.on('timeout', common.mustNotCall());
-      res.end();
       connectionHandlerInvoked = true;
       invokeCallbackIfDone();
     }
diff --git a/test/parallel/test-https-truncate.js b/test/parallel/test-https-truncate.js
index beed36cd7c08..eaaedea1afc7 100644
--- a/test/parallel/test-https-truncate.js
+++ b/test/parallel/test-https-truncate.js
@@ -47,7 +47,7 @@ function httpsTest() {
   });
 
   server.listen(0, function() {
-    const opts = { port: this.address().port, rejectUnauthorized: false };
+    const opts = { port: this.address().port, rejectUnauthorized: false, agent: false };
     https.get(opts).on('response', function(res) {
       test(res);
     });
diff --git a/test/parallel/test-https-unix-socket-self-signed.js b/test/parallel/test-https-unix-socket-self-signed.js
index 9db92ac2aed4..5a3b76e11794 100644
--- a/test/parallel/test-https-unix-socket-self-signed.js
+++ b/test/parallel/test-https-unix-socket-self-signed.js
@@ -21,6 +21,7 @@ const server = https.createServer(options, common.mustCall((req, res) => {
 
 server.listen(common.PIPE, common.mustCall(() => {
   https.get({
+    agent: false,
     socketPath: common.PIPE,
     rejectUnauthorized: false
   });
diff --git a/test/parallel/test-inspect-async-hook-setup-at-inspect.js b/test/parallel/test-inspect-async-hook-setup-at-inspect.js
index 4b43fea96ab3..5d1f276ca5e1 100644
--- a/test/parallel/test-inspect-async-hook-setup-at-inspect.js
+++ b/test/parallel/test-inspect-async-hook-setup-at-inspect.js
@@ -25,6 +25,17 @@ async function waitForInitialSetup(session) {
   await session.waitForBreakOnLine(2, '[eval]');
 }
 
+// Sent only once the target is paused. While the target runs JS the command
+// is dispatched from a V8 interrupt, where Agent::SyncAsyncHookState() cannot
+// call into JS and defers enabling the async hook to an immediate that the
+// pause then blocks, answering the command anyway. Dispatching from the paused
+// message loop enables the hook inline, so the response is a real barrier.
+async function enableAsyncStackTraces(session) {
+  console.error('[test]', 'Enabling async stack traces');
+  await session.send({ 'method': 'Debugger.setAsyncCallStackDepth',
+                       'params': { 'maxDepth': 10 } });
+}
+
 async function setupTimeoutForStackTrace(session) {
   console.error('[test]', 'Setting up timeout for async stack trace');
   await session.send([
@@ -50,13 +61,12 @@ async function runTests() {
   await session.send([
     { 'method': 'Runtime.enable' },
     { 'method': 'Debugger.enable' },
-    { 'method': 'Debugger.setAsyncCallStackDepth',
-      'params': { 'maxDepth': 10 } },
     { 'method': 'Debugger.setBlackboxPatterns',
       'params': { 'patterns': [] } },
   ]);
 
   await waitForInitialSetup(session);
+  await enableAsyncStackTraces(session);
   await setupTimeoutForStackTrace(session);
   await checkAsyncStackTrace(session);
 
diff --git a/test/parallel/test-internal-net-isLoopback.js b/test/parallel/test-internal-net-isLoopback.js
index df63bfc262ea..d54533ec0dd5 100644
--- a/test/parallel/test-internal-net-isLoopback.js
+++ b/test/parallel/test-internal-net-isLoopback.js
@@ -10,7 +10,9 @@ const loopback = [
   '127.0.0.255',
   '127.1.2.3',
   '[::1]',
+  '::1',
   '[0:0:0:0:0:0:0:1]',
+  '0:0:0:0:0:0:0:1',
 ];
 
 const loopbackNot = [
@@ -21,6 +23,10 @@ const loopbackNot = [
   '[2001:db8::1]',
   '[fe80::1]',
   '8.8.8.8',
+  '::2',
+  '[::2]',
+  '0:0:0:0:0:0:0:2',
+  '[0:0:0:0:0:0:0:2]',
 ];
 
 for (const address of loopback) {
diff --git a/test/parallel/test-internal-webidl-buffer-source.js b/test/parallel/test-internal-webidl-buffer-source.js
index 9e522d7d7b8a..b3158bd7d348 100644
--- a/test/parallel/test-internal-webidl-buffer-source.js
+++ b/test/parallel/test-internal-webidl-buffer-source.js
@@ -1,7 +1,7 @@
-// Flags: --expose-internals
+// Flags: --expose-internals --experimental-wasm-rab-integration
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const { test } = require('node:test');
 const vm = require('vm');
@@ -272,6 +272,92 @@ test('AllowSharedBufferSource handles growable shared buffers with explicit ' +
   }
 });
 
+test('Shared buffer growability checks do not read JavaScript properties', () => {
+  for (const [buffer, growable] of [
+    [new SharedArrayBuffer(8), false],
+    [new SharedArrayBuffer(8, { maxByteLength: 8 }), true],
+    [new SharedArrayBuffer(8, { maxByteLength: 16 }), true],
+    [vm.runInNewContext('new SharedArrayBuffer(8)'), false],
+    [vm.runInNewContext('new SharedArrayBuffer(8, { maxByteLength: 16 })'), true],
+  ]) {
+    const view = new Uint8Array(buffer);
+    const dataView = new DataView(buffer);
+    for (const mode of ['shadow', 'getter', 'prototype']) {
+      if (mode === 'shadow') {
+        Object.defineProperty(buffer, 'growable', {
+          value: !growable,
+          configurable: true,
+        });
+      } else if (mode === 'getter') {
+        Object.defineProperty(buffer, 'growable', {
+          get: common.mustNotCall('Unexpected growable getter'),
+          configurable: true,
+        });
+      } else {
+        delete buffer.growable;
+        Object.setPrototypeOf(buffer, null);
+      }
+
+      for (const value of [buffer, view, dataView]) {
+        if (growable) {
+          assert.throws(() => converters.AllowSharedBufferSource(value), {
+            code: 'ERR_INVALID_ARG_TYPE',
+          });
+        } else {
+          assert.strictEqual(converters.AllowSharedBufferSource(value), value);
+        }
+        assert.strictEqual(converters.AllowSharedBufferSource(value, {
+          allowResizable: true,
+        }), value);
+      }
+
+      if (growable) {
+        assert.throws(() => converters.Uint8Array(view, { allowShared: true }), {
+          code: 'ERR_INVALID_ARG_TYPE',
+        });
+      } else {
+        assert.strictEqual(converters.Uint8Array(view, { allowShared: true }), view);
+      }
+      assert.strictEqual(converters.Uint8Array(view, {
+        allowShared: true,
+        allowResizable: true,
+      }), view);
+    }
+  }
+});
+
+test('Shared WebAssembly buffer growability is checked per buffer', {
+  skip: typeof WebAssembly === 'undefined',
+}, () => {
+  const memory = new WebAssembly.Memory({ initial: 1, maximum: 2, shared: true });
+  for (const [buffer, growable] of [
+    [memory.buffer, false],
+    [memory.toResizableBuffer(), true],
+    [memory.toFixedLengthBuffer(), false],
+  ]) {
+    for (const value of [buffer, new Uint8Array(buffer), new DataView(buffer)]) {
+      if (growable) {
+        assert.throws(() => converters.AllowSharedBufferSource(value), {
+          code: 'ERR_INVALID_ARG_TYPE',
+        });
+      } else {
+        assert.strictEqual(converters.AllowSharedBufferSource(value), value);
+      }
+      assert.strictEqual(converters.AllowSharedBufferSource(value, {
+        allowResizable: true,
+      }), value);
+    }
+    const view = new Uint8Array(buffer);
+    if (growable) {
+      assert.throws(() => converters.Uint8Array(view, { allowShared: true }), {
+        code: 'ERR_INVALID_ARG_TYPE',
+      });
+    } else {
+      assert.strictEqual(converters.Uint8Array(view, { allowShared: true }), view);
+    }
+  }
+});
+
 test('BufferSource rejects objects with a forged @@toStringTag', () => {
   const fake = { [Symbol.toStringTag]: 'Uint8Array' };
   assert.throws(
diff --git a/test/parallel/test-internal-webidl-dictionary.js b/test/parallel/test-internal-webidl-dictionary.js
new file mode 100644
index 000000000000..fcc6f3e28127
--- /dev/null
+++ b/test/parallel/test-internal-webidl-dictionary.js
@@ -0,0 +1,67 @@
+'use strict';
+
+// Flags: --expose-internals
+
+const common = require('../common');
+const assert = require('node:assert/strict');
+const { createDictionaryConverter } = require('internal/webidl');
+
+const groups = [
+  [{ key: 'z', converter: String }, { key: 'b', converter: String }],
+  [{ key: 'c', converter: String }, { key: 'a', converter: String }],
+];
+let convert;
+Object.defineProperty(Array.prototype, 2, {
+  configurable: true,
+  get: common.mustNotCall(),
+  set: common.mustNotCall(),
+});
+try {
+  convert = createDictionaryConverter('Derived', groups);
+} finally {
+  delete Array.prototype[2];
+}
+
+const first = convert(null);
+const second = convert(undefined, new Proxy({}, { get: common.mustNotCall() }));
+assert.deepStrictEqual(first, { __proto__: null });
+assert.deepStrictEqual(second, first);
+assert.notStrictEqual(first, second);
+
+const trace = [];
+const input = {
+  __proto__: { c: 'inherited' },
+  b: {
+    toString: common.mustCall(() => {
+      trace.push('convert b');
+      input.z = 'changed';
+      return 'b';
+    }),
+  },
+  z: 'original',
+  a: 'a',
+};
+const result = convert(new Proxy(input, {
+  get(target, key) { trace.push(key); return target[key]; },
+}));
+assert.deepStrictEqual(trace, ['b', 'convert b', 'z', 'a', 'c']);
+assert.deepStrictEqual(result, { __proto__: null, b: 'b', z: 'changed', a: 'a', c: 'inherited' });
+
+trace.length = 0;
+convert(new Proxy({}, { get(target, key) { trace.push(key); } }));
+assert.deepStrictEqual(trace, ['b', 'z', 'a', 'c']);
+
+const defaults = createDictionaryConverter('Defaults', [[{
+  key: 'z', converter: common.mustNotCall(), defaultValue: common.mustCall(() => [], 2),
+}]]);
+assert.notStrictEqual(defaults(null).z, defaults(undefined).z);
+
+const required = createDictionaryConverter('Required', [[{
+  key: 'z', converter: common.mustNotCall(), defaultValue: common.mustCall(() => 'default', 2),
+}], [
+  { key: 'a', converter: common.mustNotCall(), required: true },
+  { key: 'b', converter: common.mustNotCall(), defaultValue: common.mustNotCall() },
+]]);
+for (const value of [null, undefined]) {
+  assert.throws(() => required(value), { code: 'ERR_MISSING_OPTION' });
+}
diff --git a/test/parallel/test-internal-webidl.js b/test/parallel/test-internal-webidl.js
index bd08648549be..f52896d5210f 100644
--- a/test/parallel/test-internal-webidl.js
+++ b/test/parallel/test-internal-webidl.js
@@ -1,7 +1,7 @@
 // Flags: --expose-internals
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const vm = require('vm');
 const webidl = require('internal/webidl');
@@ -510,11 +510,50 @@ assert.throws(() => webidl.requiredArguments(1, 2, opts), {
   }), []);
 }
 
+for (const [prototype, value] of [
+  [Number.prototype, 1],
+  [String.prototype, 'iterator'],
+  [Boolean.prototype, true],
+  [BigInt.prototype, 1n],
+  [Symbol.prototype, Symbol()],
+]) {
+  let nextReads = 0;
+  Object.defineProperty(prototype, 'next', {
+    configurable: true,
+    get() {
+      nextReads++;
+      return () => ({ done: true });
+    },
+  });
+  try {
+    const iterable = { [Symbol.iterator]: () => value };
+    assertInvalidArgType(() => converters['sequence<DOMString>'](iterable));
+    assertInvalidArgType(() => structuredClone(null, { transfer: iterable }));
+    assert.strictEqual(nextReads, 0);
+  } finally {
+    delete prototype.next;
+  }
+}
+
 {
-  class Example {}
+  function iterator() {}
+  iterator.next = () => ({ done: true });
+  assert.deepStrictEqual(converters['sequence<DOMString>']({
+    [Symbol.iterator]: () => iterator,
+  }), []);
+}
+
+{
+  class Example {
+    #brand;
+
+    static is(value) {
+      return typeof value === 'object' && value !== null && #brand in value;
+    }
+  }
   const converter = webidl.createInterfaceConverter(
     'Example',
-    Example.prototype);
+    Example.is);
   const example = new Example();
 
   assert.strictEqual(converter(example), example);
@@ -523,6 +562,42 @@ assert.throws(() => webidl.requiredArguments(1, 2, opts), {
     code: 'ERR_INVALID_ARG_TYPE',
     message: 'Prefix: Context is not of type Example.',
   });
+  assertInvalidArgType(() => converter({ __proto__: Example.prototype }));
+  assertInvalidArgType(() => converter(new Proxy(example, {})));
+  Object.setPrototypeOf(example, null);
+  assert.strictEqual(converter(example), example);
+}
+
+{
+  const signal = AbortSignal.abort('reason');
+  for (const value of [
+    Object.create(AbortSignal.prototype, { aborted: { value: false } }),
+    { __proto__: signal },
+    Object.create(AbortSignal.prototype, Object.getOwnPropertyDescriptors(signal)),
+    new Proxy(signal, {}),
+  ]) {
+    assertInvalidArgType(() => converters.AbortSignal(value));
+    assertInvalidArgType(() => AbortSignal.any([value]));
+  }
+
+  Object.setPrototypeOf(signal, null);
+  assert.strictEqual(converters.AbortSignal(signal), signal);
+  const composite = AbortSignal.any([signal]);
+  assert.strictEqual(composite.aborted, true);
+  assert.strictEqual(composite.reason, 'reason');
+}
+
+{
+  const controller = new AbortController();
+  Object.defineProperties(controller.signal, {
+    aborted: { get: common.mustNotCall('Unexpected aborted getter') },
+    reason: { get: common.mustNotCall('Unexpected reason getter') },
+  });
+  const composite = AbortSignal.any([controller.signal]);
+  assert.strictEqual(composite.aborted, false);
+  controller.abort('reason');
+  assert.strictEqual(composite.aborted, true);
+  assert.strictEqual(composite.reason, 'reason');
 }
 
 {
diff --git a/test/parallel/test-mark-promise-handled.js b/test/parallel/test-mark-promise-handled.js
new file mode 100644
index 000000000000..c2c789310bbf
--- /dev/null
+++ b/test/parallel/test-mark-promise-handled.js
@@ -0,0 +1,25 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const { markPromiseAsHandled } = require('node:util');
+
+process.on('unhandledRejection', common.mustNotCall());
+
+markPromiseAsHandled(Promise.reject(123));
+
+{
+  const { promise, reject } = Promise.withResolvers();
+  markPromiseAsHandled(promise);
+  reject(123);
+}
+
+{
+  const { promise, reject } = Promise.withResolvers();
+  reject(123);
+  markPromiseAsHandled(promise);
+}
+
+assert.throws(() => markPromiseAsHandled(123), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
diff --git a/test/parallel/test-net-boundsocket-transfer-worker.js b/test/parallel/test-net-boundsocket-transfer-worker.js
new file mode 100644
index 000000000000..054be55d7343
--- /dev/null
+++ b/test/parallel/test-net-boundsocket-transfer-worker.js
@@ -0,0 +1,64 @@
+'use strict';
+
+// This test verifies that an un-adopted net.BoundSocket can be transferred to
+// a worker thread via worker_threads postMessage()'s transferList. The parent
+// thread binds synchronously to reserve the port, then hands the bound socket
+// off; the worker adopts it via server.listen() and accepts connections.
+
+const common = require('../common');
+
+const assert = require('assert');
+const net = require('net');
+const {
+  Worker,
+  parentPort,
+  threadId,
+  workerData,
+} = require('worker_threads');
+
+if (workerData?.role === 'server') {
+  parentPort.on('message', common.mustCall(({ bound, port }) => {
+    assert.ok(bound instanceof net.BoundSocket);
+    // The bound address survives the transfer.
+    assert.strictEqual(bound.address().port, port);
+
+    const server = net.createServer((socket) => {
+      socket.end(`served-by:${threadId}`);
+    });
+    server.listen(bound, common.mustCall(() => {
+      assert.strictEqual(server.address().port, port);
+      // Adoption consumed the bound socket.
+      assert.throws(() => bound.address(), {
+        code: 'ERR_SOCKET_HANDLE_ADOPTED',
+      });
+      parentPort.postMessage('listening');
+    }));
+  }));
+  return;
+}
+
+const worker = new Worker(__filename, { workerData: { role: 'server' } });
+
+const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+const { port } = bound.address();
+
+// Move the bound socket to the worker thread.
+worker.postMessage({ bound, port }, [bound]);
+
+// The source is left in the adopted state; further use throws.
+assert.throws(() => bound.address(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.fd(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.close(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+
+worker.on('message', common.mustCall((msg) => {
+  assert.strictEqual(msg, 'listening');
+  const client = net.connect(port, '127.0.0.1');
+  client.setEncoding('utf8');
+  let response = '';
+  client.on('data', (chunk) => { response += chunk; });
+  client.on('end', common.mustCall(() => {
+    assert.match(response, /^served-by:\d+$/);
+    assert.notStrictEqual(response, `served-by:${threadId}`);
+    worker.terminate();
+  }));
+}));
diff --git a/test/parallel/test-net-transfer-guards.js b/test/parallel/test-net-transfer-guards.js
index 0879ec9da81a..d9b836deafbd 100644
--- a/test/parallel/test-net-transfer-guards.js
+++ b/test/parallel/test-net-transfer-guards.js
@@ -1,17 +1,31 @@
 'use strict';
 
-// This test verifies the guards that reject transferring a net.Socket or
-// net.Server that is not in a clean, movable state. Serialization is triggered
-// with a MessageChannel, so no worker thread is required.
+// This test verifies the guards that reject transferring a net.Socket,
+// net.Server or net.BoundSocket that is not in a clean, movable state.
+// Serialization is triggered with a MessageChannel, so no worker thread is
+// required.
 
 const common = require('../common');
 
 const assert = require('assert');
 const net = require('net');
 const { MessageChannel } = require('worker_threads');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
 
 const { port1 } = new MessageChannel();
 
+// A pipe BoundSocket is not transferable; only TCP binds can move between
+// event loops.
+{
+  const bound = new net.BoundSocket({ path: common.PIPE });
+  assert.throws(() => port1.postMessage({ bound }, [bound]), {
+    code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+  });
+  bound.close();
+}
+
 // A Server that is not listening (no handle) cannot be transferred.
 {
   const server = net.createServer();
@@ -20,6 +34,25 @@ const { port1 } = new MessageChannel();
   });
 }
 
+// A closed BoundSocket no longer owns a handle and cannot be transferred.
+{
+  const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+  bound.close();
+  assert.throws(() => port1.postMessage({ bound }, [bound]), {
+    code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+  });
+}
+
+// An adopted BoundSocket no longer owns a handle and cannot be transferred.
+{
+  const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+  const socket = new net.Socket({ handle: bound });
+  assert.throws(() => port1.postMessage({ bound }, [bound]), {
+    code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+  });
+  socket.destroy();
+}
+
 // A Socket that has already consumed data cannot be transferred, because that
 // buffered data would be lost on the sending side.
 {
diff --git a/test/parallel/test-node-run.js b/test/parallel/test-node-run.js
index ef9cd5a0f805..57faa80b9f82 100644
--- a/test/parallel/test-node-run.js
+++ b/test/parallel/test-node-run.js
@@ -5,8 +5,11 @@ common.requireNoPackageJSONAbove();
 
 const { it, describe } = require('node:test');
 const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
 
 const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
 const envSuffix = common.isWindows ? '-windows' : '';
 
 describe('node --run [command]', { concurrency: !process.env.TEST_PARALLEL }, () => {
@@ -223,6 +226,45 @@ describe('node --run [command]', { concurrency: !process.env.TEST_PARALLEL }, ()
     assert.strictEqual(child.code, 0);
   });
 
+  it('handles package paths outside the active Windows code page',
+     { skip: !common.isWindows }, async () => {
+       tmpdir.refresh();
+
+       const projectDir = path.join(tmpdir.path, 'node-run-\u{20BB7}');
+       const packageJsonPath = path.join(projectDir, 'package.json');
+       const nodeModulesBin = path.join(projectDir, 'node_modules', '.bin');
+       const checkScript = path.join(projectDir, 'check.js');
+
+       fs.mkdirSync(nodeModulesBin, { recursive: true });
+       fs.writeFileSync(packageJsonPath, JSON.stringify({
+         scripts: {
+           unicode: `"${process.execPath}" check.js`,
+         },
+       }));
+       fs.writeFileSync(checkScript, `
+         'use strict';
+         console.log(JSON.stringify({
+           cwd: process.cwd(),
+           packageJsonPath: process.env.NODE_RUN_PACKAGE_JSON_PATH,
+           path: process.env.PATH,
+         }));
+       `);
+
+       const child = await common.spawnPromisified(
+         process.execPath,
+         [ '--run', 'unicode'],
+         { cwd: projectDir },
+       );
+
+       assert.strictEqual(child.stderr, '');
+       assert.strictEqual(child.code, 0);
+
+       const output = JSON.parse(child.stdout);
+       assert.strictEqual(output.cwd, projectDir);
+       assert.strictEqual(output.packageJsonPath, packageJsonPath);
+       assert.strictEqual(output.path.split(path.delimiter)[0], nodeModulesBin);
+     });
+
   it('returns error on unparsable file', async () => {
     const child = await common.spawnPromisified(
       process.execPath,
@@ -259,4 +301,39 @@ describe('node --run [command]', { concurrency: !process.env.TEST_PARALLEL }, ()
     assert.strictEqual(child.stderr, '');
     assert.strictEqual(child.code, 0);
   });
+
+  it('lists available scripts when no command is given', async () => {
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run'],
+      { cwd: fixtures.path('run-script') },
+    );
+    assert.match(child.stderr, /Available scripts are:/);
+    assert.match(child.stderr, /test: echo "Error: no test specified" && exit 1/);
+    assert.strictEqual(child.stdout, '');
+    assert.strictEqual(child.code, 9);
+  });
+
+  it('does not consume a following flag as the script name', async () => {
+    // `--run` followed by a flag lists scripts rather than treating the flag
+    // as a script name.
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run', '--no-warnings'],
+      { cwd: fixtures.path('run-script') },
+    );
+    assert.match(child.stderr, /Available scripts are:/);
+    assert.strictEqual(child.code, 9);
+  });
+
+  it('errors when listing scripts without a package.json', async () => {
+    const child = await common.spawnPromisified(
+      process.execPath,
+      [ '--run'],
+      { cwd: __dirname },
+    );
+    assert.match(child.stderr, /Can't find package\.json/);
+    assert.strictEqual(child.stdout, '');
+    assert.strictEqual(child.code, 1);
+  });
 });
diff --git a/test/parallel/test-perf-hooks-histogram-analysis.js b/test/parallel/test-perf-hooks-histogram-analysis.js
index acc2b5a7eb2d..7069ec92ac92 100644
--- a/test/parallel/test-perf-hooks-histogram-analysis.js
+++ b/test/parallel/test-perf-hooks-histogram-analysis.js
@@ -229,7 +229,24 @@ const { inspect } = require('util');
   const unsorted = h.percentilesAt([99, 50, 90]);
   assert.strictEqual(unsorted.get(50), h.percentile(50));
 
-  // Validation
+  // Validation: non-array input must throw the same error regardless of how
+  // the check is implemented internally.
+  for (const [value, received] of [
+    ['x', "type string ('x')"],
+    [123, 'type number (123)'],
+    [{}, 'an instance of Object'],
+    [null, 'null'],
+    [undefined, 'undefined'],
+    [1n, 'type bigint (1n)'],
+    [true, 'type boolean (true)'],
+  ]) {
+    assert.throws(() => h.percentilesAt(value), {
+      code: 'ERR_INVALID_ARG_TYPE',
+      name: 'TypeError',
+      message: 'The "percentiles" argument must be an instance of Array. ' +
+               `Received ${received}`,
+    });
+  }
   assert.throws(() => h.percentilesAt('not array'),
                 { code: 'ERR_INVALID_ARG_TYPE' });
   assert.throws(() => h.percentilesAt([0]),
diff --git a/test/parallel/test-perf-hooks-histogram-qrde-oracle.js b/test/parallel/test-perf-hooks-histogram-qrde-oracle.js
new file mode 100644
index 000000000000..2a53db3d7693
--- /dev/null
+++ b/test/parallel/test-perf-hooks-histogram-qrde-oracle.js
@@ -0,0 +1,157 @@
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const { createHistogram } = require('perf_hooks');
+
+const oracle = JSON.parse(fixtures.readSync('qrde-r-oracle.json', 'utf8'));
+
+function buildHistogram(entries, options = {}) {
+  const histogram = createHistogram(options);
+  for (const [value, count] of entries) {
+    if (count === 1) {
+      histogram.record(value);
+      continue;
+    }
+
+    const block = createHistogram(options);
+    block.record(value);
+    let remaining = count;
+    while (remaining > 0) {
+      if (remaining % 2 === 1) histogram.add(block);
+      remaining = Math.floor(remaining / 2);
+      if (remaining > 0) block.add(block);
+    }
+  }
+  return histogram;
+}
+
+function assertMatchesOracle(definition, result) {
+  const expected = oracle.cases[definition.name];
+  const span = result.quantiles.at(-1) - result.quantiles[0];
+  const tolerance = Math.max(1e-10, span * definition.relativeTolerance);
+  assert.strictEqual(result.bucketCount, definition.bucketCount);
+  const indices = expected.indices ?? expected.probabilities.map((_, i) => i);
+  if (expected.probabilities !== undefined) {
+    assert.deepStrictEqual(result.probabilities,
+                           new Float64Array(expected.probabilities));
+  }
+  for (let i = 0; i < indices.length; i++) {
+    const index = indices[i];
+    const difference = Math.abs(result.quantiles[index] -
+                                expected.quantiles[i]);
+    assert.ok(difference <= tolerance,
+              `${definition.name} p${result.probabilities[index]}: ` +
+              `${result.quantiles[index]} != ${expected.quantiles[i]} ` +
+              `(difference ${difference}, tolerance ${tolerance})`);
+  }
+}
+
+const exactTolerance = 2e-12;
+const asymptoticTolerance = 2e-8;
+const cases = [
+  {
+    name: 'small-none',
+    bins: 10,
+    dequantize: 'none',
+    entries: [[1, 1], [2, 2], [4, 5], [16, 3], [100, 1]],
+    bucketCount: 5,
+    relativeTolerance: exactTolerance,
+  },
+  {
+    name: 'small-all',
+    bins: 10,
+    dequantize: 'all',
+    entries: [[1, 1], [2, 2], [4, 5], [16, 3], [100, 1]],
+    bucketCount: 5,
+    relativeTolerance: exactTolerance,
+  },
+  {
+    name: 'exact-support',
+    bins: 100,
+    dequantize: 'none',
+    entries: Array.from({ length: 1024 }, (_, index) => [index + 1, 1]),
+    bucketCount: 1024,
+    relativeTolerance: exactTolerance,
+  },
+  {
+    name: 'tail-focused',
+    probabilities: [0, 0.5, 0.9, 0.99, 0.999, 0.9999, 1],
+    dequantize: 'none',
+    entries: Array.from({ length: 1024 }, (_, index) => [index + 1, 1]),
+    bucketCount: 1024,
+    relativeTolerance: exactTolerance,
+  },
+  {
+    name: 'approximation-threshold',
+    bins: 1000,
+    dequantize: 'none',
+    entries: [[1, 26239], [131071, 973761]],
+    options: { highest: 131071, figures: 5 },
+    bucketCount: 2,
+    relativeTolerance: asymptoticTolerance,
+  },
+  {
+    name: 'multimodal-none',
+    bins: 100,
+    dequantize: 'none',
+    entries: [[1, 900000], [10, 90000], [100, 9000], [1000, 1000]],
+    bucketCount: 4,
+    relativeTolerance: asymptoticTolerance,
+  },
+  {
+    name: 'multimodal-all',
+    bins: 100,
+    dequantize: 'all',
+    entries: [[1, 900000], [10, 90000], [100, 9000], [1000, 1000]],
+    bucketCount: 4,
+    relativeTolerance: asymptoticTolerance,
+  },
+  {
+    name: 'wide-none',
+    bins: 1000,
+    dequantize: 'none',
+    entries: [
+      [2 ** 20, 700000],
+      [2 ** 40, 200000],
+      [2 ** 52, 99999],
+      [Number.MAX_SAFE_INTEGER, 1],
+    ],
+    bucketCount: 4,
+    relativeTolerance: asymptoticTolerance,
+  },
+  {
+    name: 'wide-hdr',
+    bins: 1000,
+    dequantize: 'hdr',
+    entries: [
+      [2 ** 20, 700000],
+      [2 ** 40, 200000],
+      [2 ** 52, 99999],
+      [Number.MAX_SAFE_INTEGER, 1],
+    ],
+    bucketCount: 4,
+    relativeTolerance: asymptoticTolerance,
+  },
+  {
+    name: 'huge-count',
+    bins: 3,
+    dequantize: 'none',
+    entries: [[1, 2 ** 50], [1000, 2 ** 51]],
+    bucketCount: 2,
+    relativeTolerance: asymptoticTolerance,
+  },
+];
+
+(async () => {
+  assert.strictEqual(oracle.implementation, 'stats::pbeta/stats::dbeta');
+  for (const definition of cases) {
+    const histogram = buildHistogram(definition.entries, definition.options);
+    const options = { dequantize: definition.dequantize };
+    if (definition.probabilities === undefined) options.bins = definition.bins;
+    else options.probabilities = definition.probabilities;
+    const result = await histogram.qrde(options);
+    assertMatchesOracle(definition, result);
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-perf-hooks-histogram-qrde-worker.js b/test/parallel/test-perf-hooks-histogram-qrde-worker.js
new file mode 100644
index 000000000000..ba8366516652
--- /dev/null
+++ b/test/parallel/test-perf-hooks-histogram-qrde-worker.js
@@ -0,0 +1,21 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { once } = require('events');
+const { Worker } = require('worker_threads');
+
+const worker = new Worker(`
+  const { parentPort } = require('worker_threads');
+  const { createHistogram } = require('perf_hooks');
+
+  const histogram = createHistogram({ highest: 200000, figures: 5 });
+  for (let i = 1; i <= 100000; i++) histogram.record(i);
+  histogram.qrde({ bins: 1000, dequantize: 'all' });
+  parentPort.postMessage('scheduled');
+`, { eval: true });
+
+(async () => {
+  assert.deepStrictEqual(await once(worker, 'message'), ['scheduled']);
+  assert.strictEqual(await worker.terminate(), 1);
+})().then(common.mustCall());
diff --git a/test/parallel/test-perf-hooks-histogram-qrde.js b/test/parallel/test-perf-hooks-histogram-qrde.js
new file mode 100644
index 000000000000..40eb1e71f1eb
--- /dev/null
+++ b/test/parallel/test-perf-hooks-histogram-qrde.js
@@ -0,0 +1,249 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createHistogram } = require('perf_hooks');
+
+function assertClose(actual, expected, tolerance = 1e-12) {
+  assert.ok(Math.abs(actual - expected) <= tolerance,
+            `${actual} != ${expected}`);
+}
+
+function recordRepeated(histogram, options, value, count) {
+  const block = createHistogram(options);
+  block.record(value);
+  while (count > 0) {
+    if (count % 2 === 1) histogram.add(block);
+    count = Math.floor(count / 2);
+    if (count > 0) block.add(block);
+  }
+}
+
+(async () => {
+  const empty = createHistogram();
+  const emptyResult = await empty.qrde();
+  assert.strictEqual(Object.getPrototypeOf(emptyResult), null);
+  const defaultProbabilities = new Float64Array(101);
+  for (let i = 0; i <= 100; i++) defaultProbabilities[i] = i / 100;
+  assert.deepStrictEqual(emptyResult.probabilities, defaultProbabilities);
+  assert.deepStrictEqual(emptyResult.quantiles, new Float64Array());
+  assert.deepStrictEqual(emptyResult.densities, new Float64Array());
+  assert.strictEqual(emptyResult.count, 0n);
+  assert.strictEqual(emptyResult.bucketCount, 0);
+  assert.strictEqual(emptyResult.corrections, 0);
+  assert.strictEqual(emptyResult.dequantize, 'hdr');
+
+  assert.throws(() => empty.qrde.call({}), {
+    code: 'ERR_INVALID_THIS',
+  });
+  assert.throws(() => empty.qrde(null), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+  assert.throws(() => empty.qrde({ bins: 0 }), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+  assert.throws(() => empty.qrde({ bins: 1001 }), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+  assert.throws(() => empty.qrde({
+    bins: 10,
+    probabilities: [0, 1],
+  }), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+  assert.throws(() => empty.qrde({ probabilities: [0] }), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+  assert.throws(() => empty.qrde({ probabilities: [0.1, 1] }), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+  assert.throws(() => empty.qrde({ probabilities: [0, 0.9] }), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+  assert.throws(() => empty.qrde({ probabilities: [0, 0.5, 0.5, 1] }), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+  assert.throws(() => empty.qrde({ probabilities: [0, 1.1, 1] }), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+  assert.throws(() => empty.qrde({ probabilities: new Array(1002) }), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+  assert.throws(() => empty.qrde({ dequantize: true }), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+  assert.throws(() => empty.qrde({ cache: 1 }), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+
+  const sample = createHistogram();
+  sample.record(3);
+  sample.record(4);
+  sample.record(7);
+  const pending = sample.qrde({ bins: 10, dequantize: 'none' });
+  assert.ok(pending instanceof Promise);
+  const result = await pending;
+  assert.ok(result.quantiles instanceof Float64Array);
+  assert.ok(result.densities instanceof Float64Array);
+  const tenBinProbabilities = new Float64Array(11);
+  for (let i = 0; i <= 10; i++) tenBinProbabilities[i] = i / 10;
+  assert.deepStrictEqual(result.probabilities, tenBinProbabilities);
+  assert.strictEqual(result.quantiles.length, 11);
+  assert.strictEqual(result.densities.length, 10);
+  assert.strictEqual(result.count, 3n);
+  assert.strictEqual(result.bucketCount, 3);
+  assert.strictEqual(result.corrections, 0);
+  assert.strictEqual(result.dequantize, 'none');
+  assertClose(result.quantiles[5], 122 / 27);
+  for (let i = 0; i < result.densities.length; i++) {
+    const width = result.quantiles[i + 1] - result.quantiles[i];
+    assertClose(result.densities[i] * width, 0.1);
+  }
+
+  const customInput = [0, 0.2, 0.5, 0.9, 1];
+  const customPending = sample.qrde({
+    probabilities: customInput,
+    dequantize: 'none',
+  });
+  customInput[1] = 0.4;
+  const custom = await customPending;
+  assert.deepStrictEqual(custom.probabilities,
+                         new Float64Array([0, 0.2, 0.5, 0.9, 1]));
+  assert.strictEqual(custom.quantiles.length, 5);
+  assert.strictEqual(custom.densities.length, 4);
+  assertClose(custom.quantiles[1], result.quantiles[2]);
+  assertClose(custom.quantiles[2], result.quantiles[5]);
+  assertClose(custom.quantiles[3], result.quantiles[9]);
+  for (let i = 0; i < custom.densities.length; i++) {
+    const width = custom.quantiles[i + 1] - custom.quantiles[i];
+    const mass = custom.probabilities[i + 1] - custom.probabilities[i];
+    assertClose(custom.densities[i] * width, mass);
+  }
+
+  const pointMass = createHistogram();
+  for (let i = 0; i < 100; i++) pointMass.record(100);
+
+  const pointMassNone =
+    await pointMass.qrde({ bins: 10, dequantize: 'none' });
+  const pointMassHdr = await pointMass.qrde({ bins: 10 });
+  assert.deepStrictEqual(pointMassNone.quantiles,
+                         new Float64Array(11).fill(100));
+  assert.deepStrictEqual(pointMassHdr.quantiles, pointMassNone.quantiles);
+  assert.ok(pointMassNone.densities.every((value) => value === Infinity));
+  assert.ok(pointMassHdr.densities.every((value) => value === Infinity));
+
+  const pointMassAll =
+    await pointMass.qrde({ bins: 10, dequantize: 'all' });
+  for (let i = 0; i <= 10; i++) {
+    assertClose(pointMassAll.quantiles[i], 99.5 + i / 10);
+  }
+  for (const density of pointMassAll.densities) assertClose(density, 1);
+  assert.strictEqual(pointMassAll.corrections, 0);
+
+  const wideBucket = createHistogram();
+  for (let i = 0; i < 100; i++) wideBucket.record(100_000);
+  const [wideNone, wideHdr, wideAll] = await Promise.all([
+    wideBucket.qrde({ bins: 10, dequantize: 'none' }),
+    wideBucket.qrde({ bins: 10, dequantize: 'hdr' }),
+    wideBucket.qrde({ bins: 10, dequantize: 'all' }),
+  ]);
+  assert.ok(wideNone.densities.every((value) => value === Infinity));
+  assert.ok(wideHdr.densities.every(Number.isFinite));
+  assert.deepStrictEqual(wideHdr.quantiles, wideAll.quantiles);
+
+  const snapshot = createHistogram();
+  snapshot.record(3);
+  snapshot.record(4);
+  snapshot.record(7);
+  const snapshotPending =
+    snapshot.qrde({ bins: 1000, dequantize: 'none' });
+  snapshot.record(1000);
+  const snapshotResult = await snapshotPending;
+  assert.strictEqual(snapshotResult.count, 3n);
+  assert.strictEqual(snapshotResult.quantiles.at(-1), 7);
+
+  const cachedSnapshot = createHistogram();
+  cachedSnapshot.record(3);
+  cachedSnapshot.record(4);
+  cachedSnapshot.record(7);
+  const cachedPending = cachedSnapshot.qrde({ bins: 1000, cache: true });
+  cachedSnapshot.record(1000);
+  const cachedResult = await cachedPending;
+  assert.strictEqual(cachedResult.count, 3n);
+  assert.strictEqual(cachedResult.quantiles.at(-1), 7);
+  const refreshedCache = await cachedSnapshot.qrde({
+    probabilities: [0, 0.5, 1],
+    cache: true,
+  });
+  assert.strictEqual(refreshedCache.count, 4n);
+  assert.strictEqual(refreshedCache.quantiles.at(-1), 1000);
+  const reusedCache = await cachedSnapshot.qrde({ bins: 4, cache: true });
+  assert.strictEqual(reusedCache.count, 4n);
+  assert.strictEqual(reusedCache.quantiles.at(-1), 1000);
+  cachedSnapshot.reset();
+  const invalidatedCache = await cachedSnapshot.qrde({ cache: true });
+  assert.strictEqual(invalidatedCache.count, 0n);
+
+  const arithmeticCache = createHistogram();
+  arithmeticCache.record(1);
+  await arithmeticCache.qrde({ cache: true });
+  const operand = createHistogram();
+  operand.record(2);
+  arithmeticCache.add(operand);
+  assert.strictEqual(
+    (await arithmeticCache.qrde({ cache: true })).count, 2n);
+  arithmeticCache.subtract(operand);
+  assert.strictEqual(
+    (await arithmeticCache.qrde({ cache: true })).count, 1n);
+  arithmeticCache.recordCorrected(10, 5);
+  assert.strictEqual(
+    (await arithmeticCache.qrde({ cache: true })).count, 3n);
+
+  const exactTails = createHistogram();
+  for (let i = 1; i <= 1024; i++) exactTails.record(i);
+  const [exactNone, exactAll] = await Promise.all([
+    exactTails.qrde({ bins: 100, dequantize: 'none' }),
+    exactTails.qrde({ bins: 100, dequantize: 'all' }),
+  ]);
+  assert.strictEqual(exactNone.bucketCount, 1024);
+  assertClose(exactNone.quantiles[1], 10.740000001653616, 1e-9);
+  assertClose(exactNone.quantiles[99], 1014.2599999983464, 1e-9);
+  assertClose(exactAll.quantiles[1], exactNone.quantiles[1]);
+  assertClose(exactAll.quantiles[99], exactNone.quantiles[99]);
+
+  const tinyUpperTail = createHistogram({ highest: 32768, figures: 4 });
+  for (let i = 1; i <= 31; i++) tinyUpperTail.record(i);
+  tinyUpperTail.record(16384);
+  const tinyUpperTailResult =
+    await tinyUpperTail.qrde({ bins: 2, dequantize: 'none' });
+  assertClose(tinyUpperTailResult.quantiles[1],
+              16.500000000000938, 2e-13);
+
+  const largeCount = createHistogram();
+  largeCount.record(1);
+  largeCount.record(3);
+  for (let i = 0; i < 52; i++) {
+    const copy = createHistogram();
+    copy.add(largeCount);
+    largeCount.add(copy);
+  }
+  largeCount.record(1);
+  const largeCountResult =
+    await largeCount.qrde({ bins: 2, dequantize: 'none' });
+  assert.strictEqual(largeCountResult.count, (1n << 53n) + 1n);
+  assertClose(largeCountResult.quantiles[1], 2);
+
+  // Exercise correction across the exact-to-asymptotic beta CDF threshold.
+  const correctionOptions = { highest: 131071, figures: 5 };
+  const correction = createHistogram(correctionOptions);
+  recordRepeated(correction, correctionOptions, 1, 26239);
+  recordRepeated(correction, correctionOptions, 131071, 973761);
+  const count = 1_000_000;
+  const threshold = (1 - Math.sqrt(1 - 100_000 / (count + 1))) / 2;
+  const corrected = await correction.qrde({
+    probabilities: [0, threshold - 1e-10, threshold + 1e-10, 1],
+    dequantize: 'none',
+  });
+  assert.strictEqual(corrected.corrections, 1);
+  assert.strictEqual(corrected.quantiles[1], corrected.quantiles[2]);
+})().then(common.mustCall());
diff --git a/test/parallel/test-perf-hooks-histogram-stats.js b/test/parallel/test-perf-hooks-histogram-stats.js
index 9b05a1061682..151b43e08c2b 100644
--- a/test/parallel/test-perf-hooks-histogram-stats.js
+++ b/test/parallel/test-perf-hooks-histogram-stats.js
@@ -3,7 +3,86 @@
 
 require('../common');
 const assert = require('assert');
-const { createHistogram } = require('perf_hooks');
+const { createHistogram, importHistogram } = require('perf_hooks');
+
+// ---------------------------------------------------------------------------
+// meanCI([options]) — confidence interval for the mean
+// ---------------------------------------------------------------------------
+{
+  const empty = createHistogram();
+  const emptyCI = empty.meanCI();
+  assert.strictEqual(Object.getPrototypeOf(emptyCI), null);
+  assert.ok(Number.isNaN(emptyCI.mean));
+  assert.ok(Number.isNaN(emptyCI.lower));
+  assert.ok(Number.isNaN(emptyCI.upper));
+
+  // A confidence interval is undefined with fewer than two samples.
+  const one = createHistogram();
+  one.record(42);
+  const oneCI = one.meanCI();
+  assert.strictEqual(oneCI.mean, 42);
+  assert.ok(Number.isNaN(oneCI.lower));
+  assert.ok(Number.isNaN(oneCI.upper));
+
+  // This known sample has a 95% Student's t confidence interval of
+  // approximately [3.334149, 7.665851].
+  const h = createHistogram();
+  for (let i = 1; i <= 10; i++) h.record(i);
+  const ci95 = h.meanCI();
+  assert.strictEqual(ci95.mean, h.mean);
+  assert.ok(Math.abs(ci95.lower - 3.3341494103866087) < 1e-6);
+  assert.ok(Math.abs(ci95.upper - 7.665850589613392) < 1e-6);
+
+  // Higher confidence produces a wider interval.
+  const ci90 = h.meanCI({ confidence: 0.90 });
+  const ci99 = h.meanCI({ confidence: 0.99 });
+  assert.ok((ci99.upper - ci99.lower) > (ci90.upper - ci90.lower));
+
+  // Very low confidence levels retain precision near the center of the
+  // distribution. With two samples, the t-distribution has one degree of
+  // freedom and the expected interval width is tan(pi * confidence / 2).
+  const two = createHistogram();
+  two.record(1);
+  two.record(2);
+  const lowConfidence = 1e-9;
+  const narrowCI = two.meanCI({ confidence: lowConfidence });
+  const expectedWidth = Math.tan(Math.PI * lowConfidence / 2);
+  const actualWidth = narrowCI.upper - narrowCI.lower;
+  assert.ok(Math.abs(actualWidth - expectedWidth) / expectedWidth < 1e-4);
+
+  // Very high confidence levels are not truncated by the quantile search.
+  const extremeCI = two.meanCI({ confidence: 0.9999999 });
+  assert.ok(extremeCI.lower < -3_000_000);
+  assert.ok(extremeCI.upper > 3_000_000);
+
+  const highestCI = two.meanCI({
+    confidence: 1 - Number.EPSILON / 2,
+  });
+  assert.ok(Number.isFinite(highestCI.lower));
+  assert.ok(Number.isFinite(highestCI.upper));
+
+  // Constant values have no sampling uncertainty.
+  const constant = createHistogram();
+  for (let i = 0; i < 100; i++) constant.record(7);
+  assert.deepStrictEqual(constant.meanCI(), {
+    __proto__: null,
+    mean: 7,
+    lower: 7,
+    upper: 7,
+  });
+
+  // Validation.
+  assert.throws(() => h.meanCI({ confidence: 0 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: 1 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: NaN }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: 'high' }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.meanCI(null),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
 
 // ---------------------------------------------------------------------------
 // welchTest(other) — Welch's t-test
@@ -440,6 +519,196 @@ const { createHistogram } = require('perf_hooks');
                 { code: 'ERR_INVALID_ARG_TYPE' });
 }
 
+// ---------------------------------------------------------------------------
+// export() / importHistogram() — CBOR round-trip
+// ---------------------------------------------------------------------------
+{
+  // Basic round-trip
+  const h = createHistogram();
+  for (let i = 1; i <= 1000; i++) h.record(i);
+
+  const buf = h.export();
+  assert.ok(buf instanceof Uint8Array, 'export should return Uint8Array');
+  assert.ok(buf.length > 0, 'export should not be empty');
+
+  const h2 = importHistogram(buf);
+  assert.strictEqual(h2.count, h.count);
+  assert.strictEqual(h2.min, h.min);
+  assert.strictEqual(h2.max, h.max);
+  assert.strictEqual(h2.mean, h.mean);
+  assert.strictEqual(h2.stddev, h.stddev);
+  assert.strictEqual(h2.percentile(50), h.percentile(50));
+  assert.strictEqual(h2.percentile(99), h.percentile(99));
+  assert.strictEqual(h2.percentile(99.9), h.percentile(99.9));
+
+  // Imported histogram is recordable
+  h2.record(9999);
+  assert.strictEqual(h2.count, h.count + 1);
+
+  // Round-trip with EWMA and threshold
+  const h3 = createHistogram({ halfLife: 10, threshold: 500 });
+  for (let i = 1; i <= 200; i++) h3.record(i);
+  const buf3 = h3.export();
+  const h4 = importHistogram(buf3);
+  assert.strictEqual(h4.count, h3.count);
+  assert.strictEqual(h4.ewmaMean, h3.ewmaMean);
+  assert.strictEqual(h4.ewmaStddev, h3.ewmaStddev);
+  assert.strictEqual(h4.ewmaErrorRate, h3.ewmaErrorRate);
+
+  // Empty histogram round-trip
+  const empty = createHistogram();
+  const emptyBuf = empty.export();
+  const empty2 = importHistogram(emptyBuf);
+  assert.strictEqual(empty2.count, 0);
+  assert.strictEqual(empty2.min, 9223372036854776000);  // INT64_MAX as double
+
+  // Sparse: only a few distinct values
+  const sparse = createHistogram();
+  sparse.record(1);
+  sparse.record(1000000);
+  const sparseBuf = sparse.export();
+  const sparse2 = importHistogram(sparseBuf);
+  assert.strictEqual(sparse2.count, 2);
+  assert.strictEqual(sparse2.percentile(1), sparse.percentile(1));
+  assert.strictEqual(sparse2.percentile(100), sparse.percentile(100));
+
+  // Size scales with distinct values, not total bucket count
+  assert.ok(sparseBuf.length < 200,
+            `Sparse export should be small, got ${sparseBuf.length}`);
+
+  // Validation — type and format
+  assert.throws(() => importHistogram('not a uint8array'),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => importHistogram(new Uint8Array(0)),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => importHistogram(new Uint8Array([0xff, 0xff])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // --- hdr_init failures (invalid histogram options) ---
+
+  // lowest=0 violates lowest>=1.
+  assert.throws(() => importHistogram(new Uint8Array([0xa1, 0x01, 0x00])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  // figures=0 violates figures>=1.
+  assert.throws(() => importHistogram(new Uint8Array([0xa1, 0x03, 0x00])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  // figures=6 violates figures<=5.
+  assert.throws(() => importHistogram(new Uint8Array([0xa1, 0x03, 0x06])),
+                { code: 'ERR_INVALID_ARG_VALUE' });
+  // lowest=100, highest=100: lowest*2 > highest.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa2,                                         // map(2)
+    0x01, 0x18, 100,                              // 1 (lowest) = 100
+    0x02, 0x18, 100,                              // 2 (highest) = 100
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Large values that trigger hdr_init internal overflow
+  // (unit_magnitude + sub_bucket_half_count_magnitude > 61).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa3,                                         // map(3)
+    0x01, 0x1b, 0, 0, 0x20, 0, 0, 0, 0, 0,       // 1 (lowest) = 2**45
+    0x02, 0x1b, 0, 0, 0x40, 0, 0, 0, 0, 0,       // 2 (highest) = 2**46
+    0x03, 0x05,                                   // 3 (figures) = 5
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // --- Structural CBOR validation ---
+
+  // Wrong version number (version=99).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x00, 0x18, 99,                               // 0 (version) = 99
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Unknown top-level key (key=255).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x18, 0xff, 0x00,                             // 255 (unknown) = 0
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Counts array with odd length (must be even: delta/count pairs).
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x0a, 0x81, 0x01,                             // 10 (counts) = [1]
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // --- Post-construction validation ---
+
+  // counts_len mismatch: valid options but declared counts_len
+  // doesn't match what hdr_init actually produces.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa2,                                         // map(2)
+    0x09, 0x01,                                   // 9 (countsLen) = 1
+    0x0a, 0x80,                                   // 10 (counts) = []
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Oversized counts array: declared length exceeds remaining buffer.
+  // Without bounds checking, reserve() would OOM-crash.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa1,                                         // map(1)
+    0x0a, 0x9b,                                   // 10 (counts) = array(
+    0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, //   2**52 elements)
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Sparse count index out of bounds: lowest=1, highest=100, figures=1
+  // produces counts_len=64. Index 100 exceeds it.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa4,                                         // map(4)
+    0x02, 0x18, 0x64,                             // 2 (highest) = 100
+    0x03, 0x01,                                   // 3 (figures) = 1
+    0x09, 0x18, 0x40,                             // 9 (countsLen) = 64
+    0x0a, 0x82, 0x18, 0x64, 0x01,                 // 10 (counts) = [100, 1]
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // --- Normalization offset validation ---
+
+  // lowest=1, highest=100, figures=1 produces counts_len=64. An offset
+  // at or beyond counts_len leaves normalize_index() out of bounds after
+  // its single wrap adjustment and would corrupt memory on a later
+  // record(), so it must be rejected.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa4,                                         // map(4)
+    0x02, 0x18, 0x64,                             // 2 (highest) = 100
+    0x03, 0x01,                                   // 3 (figures) = 1
+    0x09, 0x18, 0x40,                             // 9 (countsLen) = 64
+    0x07, 0x18, 0x40,                             // 7 (normOffset) = 64
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Offset just beyond the accepted range.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa4,                                         // map(4)
+    0x02, 0x18, 0x64,                             // 2 (highest) = 100
+    0x03, 0x01,                                   // 3 (figures) = 1
+    0x09, 0x18, 0x40,                             // 9 (countsLen) = 64
+    0x07, 0x18, 0x65,                             // 7 (normOffset) = 101
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+  // Offset that cannot be represented as int32_t (2**32). Without the
+  // representability check the static_cast would wrap to 0 and accept it.
+  assert.throws(() => importHistogram(new Uint8Array([
+    0xa4,                                         // map(4)
+    0x02, 0x18, 0x64,                             // 2 (highest) = 100
+    0x03, 0x01,                                   // 3 (figures) = 1
+    0x09, 0x18, 0x40,                             // 9 (countsLen) = 64
+    0x07, 0x1b, 0x00, 0x00, 0x00, 0x01,           // 7 (normOffset) = 2**32
+    0x00, 0x00, 0x00, 0x00,
+  ])), { code: 'ERR_INVALID_ARG_VALUE' });
+
+  // Valid offsets within [0, counts_len) are still accepted: 0 and the
+  // highest valid offset (counts_len - 1).
+  const offsetZero = importHistogram(new Uint8Array([
+    0xa4,                                         // map(4)
+    0x02, 0x18, 0x64,                             // 2 (highest) = 100
+    0x03, 0x01,                                   // 3 (figures) = 1
+    0x09, 0x18, 0x40,                             // 9 (countsLen) = 64
+    0x07, 0x00,                                   // 7 (normOffset) = 0
+  ]));
+  assert.strictEqual(offsetZero.count, 0);
+  const offsetMax = importHistogram(new Uint8Array([
+    0xa4,                                         // map(4)
+    0x02, 0x18, 0x64,                             // 2 (highest) = 100
+    0x03, 0x01,                                   // 3 (figures) = 1
+    0x09, 0x18, 0x40,                             // 9 (countsLen) = 64
+    0x07, 0x18, 0x3f,                             // 7 (normOffset) = 63
+  ]));
+  assert.strictEqual(offsetMax.count, 0);
+  // The imported histogram with the max valid offset is recordable.
+  offsetMax.record(1);
+  assert.strictEqual(offsetMax.count, 1);
+}
+
 // ---------------------------------------------------------------------------
 // ERR_INVALID_THIS for all new methods on wrong receiver
 // ---------------------------------------------------------------------------
@@ -450,6 +719,7 @@ const { createHistogram } = require('perf_hooks');
   const wrongThis = {};
 
   const methods = [
+    ['meanCI', []],
     ['welchTest', [h]],
     ['mannWhitneyTest', [h]],
     ['cohensD', [h]],
@@ -497,6 +767,7 @@ const { createHistogram } = require('perf_hooks');
   stub[kHandle] = null;
 
   assert.strictEqual(stub.welchTest(h), undefined);
+  assert.strictEqual(stub.meanCI(), undefined);
   assert.strictEqual(stub.mannWhitneyTest(h), undefined);
   assert.strictEqual(stub.percentileCI(50), undefined);
   assert.strictEqual(stub.burnRate(0.999), undefined);
diff --git a/test/parallel/test-perf-hooks-resourcetiming-attributes.js b/test/parallel/test-perf-hooks-resourcetiming-attributes.js
new file mode 100644
index 000000000000..66fee5265cd4
--- /dev/null
+++ b/test/parallel/test-perf-hooks-resourcetiming-attributes.js
@@ -0,0 +1,116 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const {
+  PerformanceResourceTiming,
+  performance,
+} = require('perf_hooks');
+
+// Covers the IDL attributes finalResponseHeadersStart,
+// firstInterimResponseStart, renderBlockingStatus, contentType and contentEncoding,
+// and the spec requirement that responseStart prefers a non-zero
+// firstInterimResponseStart over finalResponseHeadersStart.
+
+function createTimingInfo(overrides = {}) {
+  return {
+    startTime: 0,
+    redirectStartTime: 0,
+    redirectEndTime: 0,
+    postRedirectStartTime: 0,
+    finalServiceWorkerStartTime: 0,
+    finalNetworkRequestStartTime: 0,
+    finalNetworkResponseStartTime: 0,
+    endTime: 0,
+    encodedBodySize: 0,
+    decodedBodySize: 0,
+    finalConnectionTimingInfo: null,
+    ...overrides,
+  };
+}
+
+function markResourceTiming(timingInfo, bodyInfo) {
+  return performance.markResourceTiming(
+    timingInfo,
+    'http://localhost:8080',
+    'fetch',
+    {},
+    '',
+    bodyInfo,
+    200,
+    '',
+  );
+}
+
+// Default values when no optional timing or body metadata is present.
+{
+  const resource = markResourceTiming(createTimingInfo(), {});
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 0);
+  assert.strictEqual(resource.firstInterimResponseStart, 0);
+  assert.strictEqual(resource.responseStart, 0);
+  assert.strictEqual(resource.renderBlockingStatus, 'non-blocking');
+  assert.strictEqual(resource.contentType, '');
+  assert.strictEqual(resource.contentEncoding, '');
+}
+
+// responseStart falls back to the final response when no interim response timing was recorded.
+{
+  const resource = markResourceTiming(createTimingInfo({
+    finalNetworkResponseStartTime: 123,
+    firstInterimNetworkResponseStartTime: 0,
+  }), {});
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 123);
+  assert.strictEqual(resource.firstInterimResponseStart, 0);
+  assert.strictEqual(resource.responseStart, 123);
+}
+
+// Values reflected from timing info and body info.
+{
+  const timingInfo = createTimingInfo({
+    finalNetworkResponseStartTime: 123,
+    firstInterimNetworkResponseStartTime: 45,
+    renderBlocking: true,
+  });
+  const bodyInfo = {
+    contentType: 'text/html',
+    contentEncoding: 'gzip',
+  };
+  const resource = markResourceTiming(timingInfo, bodyInfo);
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 123);
+  assert.strictEqual(resource.firstInterimResponseStart, 45);
+  assert.strictEqual(resource.responseStart, 45);
+  assert.strictEqual(resource.renderBlockingStatus, 'blocking');
+  assert.strictEqual(resource.contentType, 'text/html');
+  assert.strictEqual(resource.contentEncoding, 'gzip');
+
+  const json = resource.toJSON();
+  assert.strictEqual(json.finalResponseHeadersStart, 123);
+  assert.strictEqual(json.firstInterimResponseStart, 45);
+  assert.strictEqual(json.responseStart, 45);
+  assert.strictEqual(json.renderBlockingStatus, 'blocking');
+  assert.strictEqual(json.contentType, 'text/html');
+  assert.strictEqual(json.contentEncoding, 'gzip');
+}
+
+// The attributes are enumerable getters on the prototype and perform a
+// brand check like the other PerformanceResourceTiming attributes.
+for (const name of [
+  'finalResponseHeadersStart',
+  'firstInterimResponseStart',
+  'renderBlockingStatus',
+  'contentType',
+  'contentEncoding',
+]) {
+  const desc = Object.getOwnPropertyDescriptor(
+    PerformanceResourceTiming.prototype, name);
+  assert.strictEqual(desc.enumerable, true, name);
+  assert.strictEqual(typeof desc.get, 'function', name);
+  assert.throws(() => desc.get.call({}), {
+    code: 'ERR_INVALID_THIS',
+  }, name);
+}
+
+performance.clearResourceTimings();
diff --git a/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs b/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs
new file mode 100644
index 000000000000..40bcd1184a7d
--- /dev/null
+++ b/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs
@@ -0,0 +1,67 @@
+// The ESM common wrapper does not export localhostIPv4.
+// eslint-disable-next-line node-core/require-common-first
+import common from '../common/index.js';
+
+import assert from 'node:assert';
+import { once } from 'node:events';
+import { createServer } from 'node:http';
+import {
+  PerformanceResourceTiming,
+  performance,
+} from 'node:perf_hooks';
+
+// This test ensures that built-in fetch creates a PerformanceResourceTiming
+// entry with the resource timing attributes exposed by Node.js.
+
+const responseBody = 'Hello world';
+const server = createServer(common.mustCall((req, res) => {
+  res.end(responseBody);
+}));
+
+server.listen(0, common.localhostIPv4);
+await once(server, 'listening');
+
+async function closeServer() {
+  if (server.listening) {
+    await new Promise((resolve) => server.close(resolve));
+  }
+}
+
+try {
+  performance.clearResourceTimings();
+
+  const url = `http://${common.localhostIPv4}:${server.address().port}/`;
+  const response = await fetch(url);
+  assert.strictEqual(await response.text(), responseBody);
+  await closeServer();
+
+  const entries = performance.getEntriesByName(url, 'resource');
+  assert.strictEqual(entries.length, 1);
+
+  const [entry] = entries;
+  assert(entry instanceof PerformanceResourceTiming);
+  assert.strictEqual(entry.initiatorType, 'fetch');
+  assert.strictEqual(entry.responseStatus, 200);
+  assert(entry.finalResponseHeadersStart > 0);
+  assert.strictEqual(entry.firstInterimResponseStart, 0);
+  assert.strictEqual(entry.responseStart, entry.finalResponseHeadersStart);
+  assert(entry.responseEnd >= entry.responseStart);
+  assert.strictEqual(entry.renderBlockingStatus, 'non-blocking');
+  assert.strictEqual(entry.contentType, '');
+  assert.strictEqual(entry.contentEncoding, '');
+
+  const json = entry.toJSON();
+  for (const name of [
+    'finalResponseHeadersStart',
+    'firstInterimResponseStart',
+    'responseStart',
+    'renderBlockingStatus',
+    'contentType',
+    'contentEncoding',
+  ]) {
+    assert.strictEqual(json[name], entry[name], name);
+  }
+} finally {
+  performance.clearResourceTimings();
+  await closeServer();
+}
diff --git a/test/parallel/test-perf-hooks-resourcetiming.js b/test/parallel/test-perf-hooks-resourcetiming.js
index f76cd669004e..9a94ba795e95 100644
--- a/test/parallel/test-perf-hooks-resourcetiming.js
+++ b/test/parallel/test-perf-hooks-resourcetiming.js
@@ -174,6 +174,8 @@ function createTimingInfo({
     connectEnd: 0,
     secureConnectionStart: 0,
     requestStart: 0,
+    finalResponseHeadersStart: 0,
+    firstInterimResponseStart: 0,
     responseStart: 0,
     responseEnd: 0,
     transferSize: 0,
@@ -181,6 +183,9 @@ function createTimingInfo({
     decodedBodySize: 0,
     responseStatus: 200,
     deliveryType: '',
+    renderBlockingStatus: 'non-blocking',
+    contentType: '',
+    contentEncoding: '',
   });
   assert.strictEqual(util.inspect(performance.getEntries()), `[
   PerformanceResourceTiming {
@@ -200,13 +205,18 @@ function createTimingInfo({
     connectEnd: 0,
     secureConnectionStart: 0,
     requestStart: 0,
+    finalResponseHeadersStart: 0,
+    firstInterimResponseStart: 0,
     responseStart: 0,
     responseEnd: 0,
     transferSize: 0,
     encodedBodySize: 0,
     decodedBodySize: 0,
     deliveryType: '',
-    responseStatus: 200
+    responseStatus: 200,
+    renderBlockingStatus: 'non-blocking',
+    contentType: '',
+    contentEncoding: ''
   }
 ]`);
   assert.strictEqual(util.inspect(resource), `PerformanceResourceTiming {
@@ -226,13 +236,18 @@ function createTimingInfo({
   connectEnd: 0,
   secureConnectionStart: 0,
   requestStart: 0,
+  finalResponseHeadersStart: 0,
+  firstInterimResponseStart: 0,
   responseStart: 0,
   responseEnd: 0,
   transferSize: 0,
   encodedBodySize: 0,
   decodedBodySize: 0,
   deliveryType: '',
-  responseStatus: 200
+  responseStatus: 200,
+  renderBlockingStatus: 'non-blocking',
+  contentType: '',
+  contentEncoding: ''
 }`);
 
   assert(resource instanceof PerformanceEntry);
diff --git a/test/parallel/test-perf-hooks-sliding-window-histogram-fast-calls.js b/test/parallel/test-perf-hooks-sliding-window-histogram-fast-calls.js
new file mode 100644
index 000000000000..1097920f5f73
--- /dev/null
+++ b/test/parallel/test-perf-hooks-sliding-window-histogram-fast-calls.js
@@ -0,0 +1,31 @@
+// Flags: --expose-internals --no-warnings --allow-natives-syntax
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { internalBinding } = require('internal/test/binding');
+const {
+  createSlidingWindowHistogram,
+} = require('perf_hooks');
+
+const histogram = createSlidingWindowHistogram({
+  chunks: 2,
+  recordsPerChunk: 1,
+});
+
+function record() {
+  histogram.record(1);
+}
+
+eval('%PrepareFunctionForOptimization(histogram.record)');
+record();
+eval('%OptimizeFunctionOnNextCall(histogram.record)');
+record();
+
+assert.strictEqual(histogram.snapshot().count, 2);
+
+if (common.isDebug) {
+  const { getV8FastApiCallCount } = internalBinding('debug');
+  assert.strictEqual(
+    getV8FastApiCallCount('histogram.slidingWindow.record'), 1);
+}
diff --git a/test/parallel/test-perf-hooks-sliding-window-histogram.js b/test/parallel/test-perf-hooks-sliding-window-histogram.js
new file mode 100644
index 000000000000..3ee1ca4ea437
--- /dev/null
+++ b/test/parallel/test-perf-hooks-sliding-window-histogram.js
@@ -0,0 +1,195 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { setTimeout: delay } = require('timers/promises');
+const { MessageChannel } = require('worker_threads');
+const {
+  createSlidingWindowHistogram,
+} = require('perf_hooks');
+
+{
+  const histogram = createSlidingWindowHistogram({
+    chunks: 3,
+    recordsPerChunk: 2,
+    highest: 100,
+  });
+
+  assert.strictEqual(histogram.constructor.name, 'SlidingWindowHistogram');
+  assert.strictEqual(histogram.recordDelta, undefined);
+  assert.strictEqual(histogram.snapshot().count, 0);
+
+  for (let value = 1; value <= 6; value++) histogram.record(value);
+
+  const full = histogram.snapshot();
+  assert.strictEqual(full.count, 6);
+  assert.strictEqual(full.min, 1);
+  assert.strictEqual(full.max, 6);
+  assert.strictEqual(full.record, undefined);
+
+  histogram.record(7);
+  let current = histogram.snapshot();
+  assert.strictEqual(current.count, 5);
+  assert.strictEqual(current.min, 3);
+  assert.strictEqual(current.max, 7);
+
+  histogram.record(8);
+  histogram.record(9);
+  current = histogram.snapshot();
+  assert.strictEqual(current.count, 5);
+  assert.strictEqual(current.min, 5);
+  assert.strictEqual(current.max, 9);
+
+  // Materialized snapshots do not change with the sliding window.
+  assert.strictEqual(full.count, 6);
+  assert.strictEqual(full.min, 1);
+  assert.strictEqual(full.max, 6);
+
+  histogram.reset();
+  assert.strictEqual(histogram.snapshot().count, 0);
+  histogram.record(10n);
+  assert.strictEqual(histogram.snapshot().maxBigInt, 10n);
+  for (const value of [0n, 2n ** 63n]) {
+    assert.throws(() => histogram.record(value), {
+      code: 'ERR_OUT_OF_RANGE',
+    });
+  }
+
+  assert.throws(() => new histogram.constructor(), {
+    code: 'ERR_ILLEGAL_CONSTRUCTOR',
+  });
+  assert.throws(() => histogram.record.call({}, 1), {
+    code: 'ERR_INVALID_THIS',
+  });
+  assert.throws(() => histogram.snapshot.call({}), {
+    code: 'ERR_INVALID_THIS',
+  });
+  assert.throws(() => histogram.reset.call({}), {
+    code: 'ERR_INVALID_THIS',
+  });
+  assert.throws(() => structuredClone(histogram), {
+    name: 'DataCloneError',
+  });
+
+  const { port1, port2 } = new MessageChannel();
+  assert.throws(() => port1.postMessage(histogram), {
+    name: 'DataCloneError',
+  });
+  assert.throws(() => port1.postMessage(histogram, [histogram]), {
+    name: 'DataCloneError',
+  });
+  port1.close();
+  port2.close();
+}
+
+{
+  const histogram = createSlidingWindowHistogram({
+    chunks: 2,
+    recordsPerChunk: 1,
+    highest: 10,
+  });
+
+  // Out-of-range recording attempts count toward count-based rotation.
+  histogram.record(11);
+  histogram.record(1);
+  let current = histogram.snapshot();
+  assert.strictEqual(current.count, 1);
+  assert.strictEqual(current.exceeds, 1);
+
+  histogram.record(2);
+  current = histogram.snapshot();
+  assert.strictEqual(current.count, 2);
+  assert.strictEqual(current.exceeds, 0);
+}
+
+{
+  for (const options of [
+    undefined,
+    null,
+    {},
+    { chunks: 2 },
+    { chunks: 2, chunkDuration: 1, recordsPerChunk: 1 },
+  ]) {
+    assert.throws(() => createSlidingWindowHistogram(options), {
+      code: options?.chunks === undefined ?
+        'ERR_INVALID_ARG_TYPE' : 'ERR_INVALID_ARG_VALUE',
+    });
+  }
+
+  for (const chunks of [0, 1025, 1.5, '2']) {
+    assert.throws(() => createSlidingWindowHistogram({
+      chunks,
+      recordsPerChunk: 1,
+    }), {
+      code: typeof chunks === 'number' ?
+        'ERR_OUT_OF_RANGE' : 'ERR_INVALID_ARG_TYPE',
+    });
+  }
+
+  for (const chunkDuration of [0, 1.5, 18_446_744_073_710]) {
+    assert.throws(() => createSlidingWindowHistogram({
+      chunks: 2,
+      chunkDuration,
+    }), { code: 'ERR_OUT_OF_RANGE' });
+  }
+
+  for (const recordsPerChunk of [0, 1.5, Number.MAX_SAFE_INTEGER + 1]) {
+    assert.throws(() => createSlidingWindowHistogram({
+      chunks: 2,
+      recordsPerChunk,
+    }), { code: 'ERR_OUT_OF_RANGE' });
+  }
+
+  assert.throws(() => createSlidingWindowHistogram({
+    chunks: 2,
+    recordsPerChunk: 1,
+    lowest: 10,
+    highest: 10,
+  }), { code: 'ERR_OUT_OF_RANGE' });
+
+  for (const [name, value] of [
+    ['lowest', 0n],
+    ['lowest', 2n ** 63n],
+    ['highest', 0n],
+    ['highest', 2n ** 63n],
+  ]) {
+    assert.throws(() => createSlidingWindowHistogram({
+      chunks: 2,
+      recordsPerChunk: 1,
+      [name]: value,
+    }), { code: 'ERR_OUT_OF_RANGE' });
+  }
+
+  for (const bounds of [
+    { lowest: 1n },
+    { lowest: 1n, highest: 100 },
+    { lowest: 1, highest: 100n },
+  ]) {
+    const histogram = createSlidingWindowHistogram({
+      chunks: 1,
+      recordsPerChunk: 1,
+      ...bounds,
+    });
+    histogram.record(1);
+    assert.strictEqual(histogram.snapshot().count, 1);
+  }
+}
+
+(async () => {
+  const histogram = createSlidingWindowHistogram({
+    chunks: 1,
+    chunkDuration: 100,
+    highest: 100,
+  });
+
+  histogram.record(1);
+  assert.strictEqual(histogram.snapshot().count, 1);
+
+  await delay(common.platformTimeout(200));
+  assert.strictEqual(histogram.snapshot().count, 0);
+
+  histogram.record(2);
+  const current = histogram.snapshot();
+  assert.strictEqual(current.count, 1);
+  assert.strictEqual(current.min, 2);
+})().then(common.mustCall());
diff --git a/test/parallel/test-permission-fs-filehandle-sync.js b/test/parallel/test-permission-fs-filehandle-sync.js
new file mode 100644
index 000000000000..28e9da734c85
--- /dev/null
+++ b/test/parallel/test-permission-fs-filehandle-sync.js
@@ -0,0 +1,33 @@
+// Flags: --permission --allow-fs-read=*
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+const assert = require('assert');
+const { open } = require('fs/promises');
+const fixtures = require('../common/fixtures');
+
+const regularFile = fixtures.path('permission', 'deny', 'regular-file.md');
+
+// FileHandle sync operations must be blocked when the permission model is
+// enabled, consistent with fs.fsync() / fs.fsyncSync() and fdatasync variants.
+(async () => {
+  const fh = await open(regularFile, 'r');
+  try {
+    await assert.rejects(
+      fh.sync(),
+      common.expectsError({ code: 'ERR_ACCESS_DENIED' }),
+    );
+    await assert.rejects(
+      fh.datasync(),
+      common.expectsError({ code: 'ERR_ACCESS_DENIED' }),
+    );
+  } finally {
+    await fh.close();
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-permission-openssl-store.js b/test/parallel/test-permission-openssl-store.js
index ca2f240a9520..f97657051ca9 100644
--- a/test/parallel/test-permission-openssl-store.js
+++ b/test/parallel/test-permission-openssl-store.js
@@ -4,8 +4,8 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
-if (!hasOpenSSL3)
+const { hasOpenSSL } = require('../common/crypto');
+if (!hasOpenSSL(3))
   common.skip('requires OpenSSL 3.x');
 
 // Verifies the openssl.store permission: allowed when --allow-openssl-store is
diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
index 67483f6242cf..10c3ca2a8930 100644
--- a/test/parallel/test-process-env-allowed-flags-are-documented.js
+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
@@ -5,7 +5,7 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 const rootDir = path.resolve(__dirname, '..', '..');
 const cliMd = path.join(rootDir, 'doc', 'api', 'cli.md');
@@ -44,7 +44,7 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
   }
 }
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   documented.delete('--openssl-legacy-provider');
   documented.delete('--openssl-shared-config');
 }
@@ -58,8 +58,8 @@ const conditionalOpts = [
     filter: (opt) => {
       return [
         '--openssl-config',
-        hasOpenSSL3 ? '--openssl-legacy-provider' : '',
-        hasOpenSSL3 ? '--openssl-shared-config' : '',
+        hasOpenSSL(3) ? '--openssl-legacy-provider' : '',
+        hasOpenSSL(3) ? '--openssl-shared-config' : '',
         '--tls-cipher-list',
         '--use-bundled-ca',
         '--use-openssl-ca',
@@ -67,6 +67,7 @@ const conditionalOpts = [
         '--secure-heap',
         '--secure-heap-min',
         '--enable-fips',
+        '--enable-fips-indicator-events',
         '--force-fips',
       ].includes(opt);
     }
diff --git a/test/parallel/test-process-versions.js b/test/parallel/test-process-versions.js
index b670ff37ac6f..7f54beeea674 100644
--- a/test/parallel/test-process-versions.js
+++ b/test/parallel/test-process-versions.js
@@ -87,12 +87,12 @@ assert.match(
 assert.match(process.versions.modules, /^\d+$/);
 
 if (common.hasCrypto) {
-  const { hasOpenSSL3 } = require('../common/crypto');
+  const { hasOpenSSL } = require('../common/crypto');
   assert.match(process.versions.ncrypto, commonTemplate);
   if (process.config.variables.node_shared_openssl) {
     assert.ok(process.versions.openssl);
   } else {
-    const versionRegex = hasOpenSSL3 ?
+    const versionRegex = hasOpenSSL(3) ?
       // The following also matches a development version of OpenSSL 3.x which
       // can be in the format '3.0.0-alpha4-dev'. This can be handy when
       // building and linking against the main development branch of OpenSSL.
diff --git a/test/parallel/test-quic-h3-uni-stream-limit-start-failure.mjs b/test/parallel/test-quic-h3-uni-stream-limit-start-failure.mjs
new file mode 100644
index 000000000000..78f78ac1d582
--- /dev/null
+++ b/test/parallel/test-quic-h3-uni-stream-limit-start-failure.mjs
@@ -0,0 +1,38 @@
+// Flags: --experimental-quic --no-warnings
+
+// An HTTP/3 session must cleanly fail if the peer advertises fewer than
+// the 3 unidirectional streams that HTTP/3 needs for control and QPACK.
+
+import { hasQuic, skip, mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const serverEndpoint = await listen(async (serverSession) => {
+  await serverSession.closed;
+}, {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  // No uni streams allowed:
+  transportParams: { initialMaxStreamsUni: 0 },
+  onheaders: mustNotCall(),
+});
+
+// Expect the client to cleanly fail - not crash the process
+await assert.rejects(async () => {
+  const clientSession = await connect(serverEndpoint.address, {
+    servername: 'localhost',
+    verifyPeer: 'manual',
+  });
+  await clientSession.opened;
+}, { code: 'ERR_QUIC_TRANSPORT_ERROR' });
+
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-h3-uni-stream-teardown.mjs b/test/parallel/test-quic-h3-uni-stream-teardown.mjs
new file mode 100644
index 000000000000..6f93ef73eb2d
--- /dev/null
+++ b/test/parallel/test-quic-h3-uni-stream-teardown.mjs
@@ -0,0 +1,34 @@
+// Flags: --experimental-quic --no-warnings
+
+// Regression test for https://github.com/nodejs/node/issues/65408.
+// A client-created unidirectional stream is not a valid HTTP/3 request stream,
+// but nghttp3 handles it internally. Destroying the endpoint after receiving
+// data on that stream must not crash during process teardown.
+
+import { hasQuic, skip, mustNotCall } from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { createPrivateKey } = await import('node:crypto');
+const { listen, connect } = await import('node:quic');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const endpoint = await listen(mustNotCall(), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+});
+
+const session = await connect(endpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+});
+
+const stream = await session.createUnidirectionalStream();
+stream.writer.writeSync('x');
+
+endpoint.destroy();
+await endpoint.closed;
diff --git a/test/parallel/test-quic-internal-endpoint-options.mjs b/test/parallel/test-quic-internal-endpoint-options.mjs
index 29529c05e613..a81832c71094 100644
--- a/test/parallel/test-quic-internal-endpoint-options.mjs
+++ b/test/parallel/test-quic-internal-endpoint-options.mjs
@@ -56,7 +56,7 @@ const cases = [
     valid: [
       1, 10, 100, 1000, 10000, 10000n,
     ],
-    invalid: [-1, -1n, 'a', null, false, true, {}, [], () => {}]
+    invalid: [-1, -1n, 0, 0n, 'a', null, false, true, {}, [], () => {}]
   },
   {
     key: 'retryRate',
diff --git a/test/parallel/test-readable-from-iterator-closing.js b/test/parallel/test-readable-from-iterator-closing.js
index ef7e54821ace..0ddd222756a1 100644
--- a/test/parallel/test-readable-from-iterator-closing.js
+++ b/test/parallel/test-readable-from-iterator-closing.js
@@ -101,6 +101,40 @@ async function syncRejectedSupport() {
   }
 }
 
+async function syncRejectedAfterResolvedSupport() {
+  const expectedError = new Error('later rejection');
+  const finallyMustCall = mustCall();
+  const bodyMustCall = mustCall((chunk) => {
+    assert.strictEqual(chunk, 'a');
+  });
+  const catchMustCall = mustCall((error) => {
+    assert.strictEqual(error, expectedError);
+  });
+  const thirdNextMustNotCall = mustNotCall();
+
+  function* generate() {
+    try {
+      yield Promise.resolve('a');
+      yield Promise.reject(expectedError);
+      thirdNextMustNotCall();
+    } finally {
+      finallyMustCall();
+    }
+  }
+
+  const stream = Readable.from(generate());
+
+  try {
+    for await (const chunk of stream) {
+      bodyMustCall(chunk);
+    }
+  } catch (error) {
+    catchMustCall(error);
+  }
+
+  assert.strictEqual(stream.destroyed, true);
+}
+
 async function noReturnAfterThrow() {
   const returnMustNotCall = mustNotCall();
   const bodyMustNotCall = mustNotCall();
@@ -187,6 +221,7 @@ Promise.all([
   syncSupport(),
   syncPromiseSupport(),
   syncRejectedSupport(),
+  syncRejectedAfterResolvedSupport(),
   noReturnAfterThrow(),
   closeStreamWhileNextIsPending(),
   closeAfterNullYielded(),
diff --git a/test/parallel/test-runner-coverage.js b/test/parallel/test-runner-coverage.js
index 542078c93d5e..8e87b0a60921 100644
--- a/test/parallel/test-runner-coverage.js
+++ b/test/parallel/test-runner-coverage.js
@@ -116,6 +116,8 @@ test('test coverage report', async (t) => {
 
 test('test tap coverage reporter', skipIfNoInspector, async (t) => {
   await t.test('coverage is reported and dumped to NODE_V8_COVERAGE if present', (t) => {
+    // A dump left here would match the negative checks below on pid reuse.
+    t.after(() => tmpdir.refresh());
     const fixture = fixtures.path('test-runner', 'coverage.js');
     const args = [
       '--experimental-test-coverage',
@@ -154,6 +156,8 @@ test('test tap coverage reporter', skipIfNoInspector, async (t) => {
 
 test('test spec coverage reporter', skipIfNoInspector, async (t) => {
   await t.test('coverage is reported and dumped to NODE_V8_COVERAGE if present', (t) => {
+    // A dump left here would match the negative checks below on pid reuse.
+    t.after(() => tmpdir.refresh());
     const fixture = fixtures.path('test-runner', 'coverage.js');
     const args = [
       '--experimental-test-coverage',
diff --git a/test/parallel/test-runner-execution-ordered-bypass.mjs b/test/parallel/test-runner-execution-ordered-bypass.mjs
index ac1c97ee007d..75e9eb51d7d9 100644
--- a/test/parallel/test-runner-execution-ordered-bypass.mjs
+++ b/test/parallel/test-runner-execution-ordered-bypass.mjs
@@ -1,8 +1,10 @@
 // Flags: --no-warnings
 
-import '../common/index.mjs';
+import { mustCall, platformTimeout } from '../common/index.mjs';
 import * as fixtures from '../common/fixtures.mjs';
 import assert from 'node:assert';
+import { once } from 'node:events';
+import { createServer } from 'node:net';
 import { test, run } from 'node:test';
 
 const files = [
@@ -10,15 +12,29 @@ const files = [
   fixtures.path('test-runner', 'execution-ordered-bypass', 'fast-fail.mjs'),
 ];
 
-test('execution-ordered events bypass FileTest declaration-order buffer', async () => {
+test('execution-ordered events bypass FileTest declaration-order buffer', {
+  timeout: platformTimeout(30_000),
+}, async (t) => {
+  const { promise: fastCompleted, resolve: releaseSlow } = Promise.withResolvers();
+  const server = createServer(mustCall((socket) => {
+    t.after(() => socket.destroy());
+    fastCompleted.then(mustCall(() => {
+      socket.end();
+    }));
+  }));
+  t.after(() => server.close());
+  await once(server.listen(0, '127.0.0.1'), 'listening');
+
   // Concurrency must be a number so the runner does not collapse it to 1 on
   // single-core CI runners (where `concurrency: true` resolves to
   // `availableParallelism() - 1`). Without two slots the runner spawns the
-  // files sequentially and fast-fail never starts while slow is sleeping.
+  // files sequentially and fast-fail never starts while slow is waiting.
   const stream = run({
     files,
     isolation: 'process',
     concurrency: 2,
+    argv: [String(server.address().port)],
+    signal: t.signal,
   });
 
   const events = [];
@@ -27,6 +43,9 @@ test('execution-ordered events bypass FileTest declaration-order buffer', async
     if (data.name === 'slow' || data.name === 'fast-fail') {
       events.push(`complete:${data.name}`);
     }
+    if (data.name === 'fast-fail') {
+      releaseSlow();
+    }
   });
 
   stream.on('test:fail', (data) => {
diff --git a/test/parallel/test-runner-v8-deserializer.mjs b/test/parallel/test-runner-v8-deserializer.mjs
index 7f2c0155c973..3a4db367ca6d 100644
--- a/test/parallel/test-runner-v8-deserializer.mjs
+++ b/test/parallel/test-runner-v8-deserializer.mjs
@@ -85,6 +85,15 @@ describe('v8 deserializer', common.mustCall(() => {
     assert.deepStrictEqual(reported, [reportedDiagnosticEvent]);
   });
 
+  it('should serialize a repeated object as independent messages', async () => {
+    const repeatedChunks = await toArray(serializer([diagnosticEvent, diagnosticEvent]));
+    const reported = await collectReported(repeatedChunks);
+    assert.deepStrictEqual(reported, [
+      reportedDiagnosticEvent,
+      reportedDiagnosticEvent,
+    ]);
+  });
+
   it('should deserialize a serialized chunk after non-serialized chunk', async () => {
     const reported = await collectReported([Buffer.concat([Buffer.from('unknown'), ...chunks])]);
     assert.deepStrictEqual(reported, [
diff --git a/test/parallel/test-sqlite-authz.js b/test/parallel/test-sqlite-authz.js
index 69c075a57e2e..f6020ce9047e 100644
--- a/test/parallel/test-sqlite-authz.js
+++ b/test/parallel/test-sqlite-authz.js
@@ -1,7 +1,7 @@
 'use strict';
 
-const { skipIfSQLiteMissing } = require('../common');
-skipIfSQLiteMissing();
+const common = require('../common');
+common.skipIfSQLiteMissing();
 
 const assert = require('node:assert');
 const { DatabaseSync, constants } = require('node:sqlite');
@@ -288,3 +288,329 @@ suite('DatabaseSync.prototype.setAuthorizer()', () => {
     });
   });
 });
+
+// SQLite forbids an authorizer callback from modifying the connection that
+// invoked it, which includes preparing and stepping statements.
+// See https://www.sqlite.org/c3ref/set_authorizer.html.
+suite('authorizer callback reentrancy', () => {
+  const expectedError = 'ERR_INVALID_STATE: database cannot be accessed ' +
+    'from an authorizer callback';
+  const steppingError =
+    'ERR_INVALID_STATE: statement is already being executed';
+
+  // Calls each of `cases` from inside an authorizer callback, and returns a
+  // `name -> outcome` map of what each one threw.
+  const runInAuthorizer = (db, cases) => {
+    const outcomes = {};
+    for (const [name, fn] of Object.entries(cases)) {
+      let ran = false;
+      db.setAuthorizer(() => {
+        if (!ran) {
+          ran = true;
+          try {
+            fn();
+            outcomes[name] = 'did not throw';
+          } catch (err) {
+            outcomes[name] = `${err.code}: ${err.message}`;
+          }
+        }
+        return constants.SQLITE_OK;
+      });
+      db.exec('SELECT 1');
+      db.setAuthorizer(null);
+      if (!ran) {
+        outcomes[name] = 'authorizer callback did not run';
+      }
+    }
+    return outcomes;
+  };
+
+  // Builds the expected `name -> outcome` map for the given case names.
+  const allRejected = (cases) => Object.fromEntries(
+    Object.keys(cases).map((name) => [name, expectedError]),
+  );
+
+  it('rejects database methods', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const cases = {
+      prepare: () => db.prepare('SELECT 1'),
+      exec: () => db.exec('SELECT 1'),
+      setAuthorizer: () => db.setAuthorizer(null),
+      createSession: () => db.createSession(),
+      applyChangeset: () => db.applyChangeset(new Uint8Array([1])),
+      createTagStore: () => db.createTagStore(),
+      serialize: () => db.serialize(),
+      function: () => db.function('noop', () => 1),
+      aggregate: () => db.aggregate('agg', { start: 0, step: (acc) => acc }),
+      enableLoadExtension: () => db.enableLoadExtension(false),
+      enableDefensive: () => db.enableDefensive(true),
+      limits: () => { db.limits.length = 100; },
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+  });
+
+  // loadExtension() checks that extension loading is enabled before reaching
+  // the authorizer guard, so it needs a database opened with allowExtension.
+  it('rejects loadExtension', () => {
+    const db = new DatabaseSync(':memory:', { allowExtension: true });
+    db.enableLoadExtension(true);
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const cases = {
+      loadExtension: () => db.loadExtension('/nonexistent/extension'),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+  });
+
+  // close() and deserialize() tear down the connection, so the pre-existing
+  // callback depth guard already rejects them with its own message.
+  it('rejects methods the callback depth guard already covers', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const snapshot = db.serialize();
+    const cases = {
+      close: () => db.close(),
+      deserialize: () => db.deserialize(snapshot),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), {
+      close: 'ERR_INVALID_STATE: database cannot be closed while in a callback',
+      deserialize: 'ERR_INVALID_STATE: database cannot be deserialized ' +
+        'while in a callback',
+    });
+  });
+
+  it('rejects statement methods', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const stmt = db.prepare('SELECT x FROM t');
+    const cases = {
+      run: () => stmt.run(),
+      get: () => stmt.get(),
+      all: () => stmt.all(),
+      iterate: () => stmt.iterate(),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+  });
+
+  // Only the statement being stepped is unsafe to finalize. Other statements
+  // on the connection have their own virtual machines, so finalizing them from
+  // a callback is allowed.
+  it('allows finalizing a statement that is not being executed', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const closeStmt = db.prepare('SELECT x FROM t');
+    const disposeStmt = db.prepare('SELECT x FROM t');
+    const cases = {
+      close: () => closeStmt.close(),
+      dispose: () => disposeStmt[Symbol.dispose](),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), {
+      close: 'did not throw',
+      dispose: 'did not throw',
+    });
+  });
+
+  // Disposal is idempotent, so a statement that is already finalized must stay
+  // a no-op even inside a callback. Throwing here would turn a `using` scope's
+  // real exception into a SuppressedError.
+  it('allows disposing an already-finalized statement', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const stmt = db.prepare('SELECT x FROM t');
+    stmt.close();
+    const cases = { dispose: () => stmt[Symbol.dispose]() };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), {
+      dispose: 'did not throw',
+    });
+  });
+
+  it('rejects session changeset methods', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER PRIMARY KEY, y TEXT)');
+    const session = db.createSession({ table: 't' });
+    db.exec("INSERT INTO t VALUES (1, 'a')");
+    const cases = {
+      changeset: () => session.changeset(),
+      patchset: () => session.patchset(),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+  });
+
+  // A statement being re-prepared inside sqlite3_step() is the case that
+  // actually crashes, because that statement's VM is mid-execution.
+  it('rejects finalizing the statement being stepped', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const stmt = db.prepare('SELECT x FROM t');
+    stmt.get();
+    db.exec('ALTER TABLE t ADD COLUMN y INTEGER');
+
+    let outcome = 'authorizer callback did not run';
+    let ran = false;
+    db.setAuthorizer(() => {
+      if (!ran) {
+        ran = true;
+        try {
+          stmt.close();
+          outcome = 'did not throw';
+        } catch (err) {
+          outcome = `${err.code}: ${err.message}`;
+        }
+      }
+      return constants.SQLITE_OK;
+    });
+
+    stmt.get();
+
+    assert.strictEqual(outcome, steppingError);
+  });
+
+  // Unlike an already-finalized statement, disposing the one being stepped
+  // would free the running virtual machine, so it throws.
+  it('rejects disposing the statement being stepped', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const stmt = db.prepare('SELECT x FROM t');
+    stmt.get();
+    db.exec('ALTER TABLE t ADD COLUMN y INTEGER');
+
+    let outcome = 'authorizer callback did not run';
+    let ran = false;
+    db.setAuthorizer(() => {
+      if (!ran) {
+        ran = true;
+        try {
+          stmt[Symbol.dispose]();
+          outcome = 'did not throw';
+        } catch (err) {
+          outcome = `${err.code}: ${err.message}`;
+        }
+      }
+      return constants.SQLITE_OK;
+    });
+
+    stmt.get();
+
+    assert.strictEqual(outcome, steppingError);
+  });
+
+  it('rejects iterator methods', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1), (2)');
+    const iter = db.prepare('SELECT x FROM t').iterate();
+    const cases = {
+      next: () => iter.next(),
+      return: () => iter.return(),
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+    iter.return();
+  });
+
+  // A drained iterator holds no SQLite state, so next() and return() stay
+  // available and remain idempotent inside a callback.
+  it('allows iterator methods on a drained iterator', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const iter = db.prepare('SELECT x FROM t').iterate();
+    for (const row of iter) {
+      assert.ok(row);
+    }
+    const done = {};
+    const cases = {
+      next: () => { done.next = iter.next().done; },
+      return: () => { done.return = iter.return().done; },
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), {
+      next: 'did not throw',
+      return: 'did not throw',
+    });
+    assert.deepStrictEqual(done, { next: true, return: true });
+  });
+
+  it('rejects tag store methods', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const sql = db.createTagStore(10);
+    const cases = {
+      run: () => sql.run`SELECT 1`,
+      get: () => sql.get`SELECT 1`,
+      all: () => sql.all`SELECT 1`,
+      iterate: () => sql.iterate`SELECT 1`,
+    };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+  });
+
+  // clear() only drops cached statements, so invalidating the cache after a
+  // schema change is allowed from the callback.
+  it('allows clearing a tag store', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const sql = db.createTagStore(10);
+    assert.strictEqual(sql.all`SELECT x FROM t`.length, 1);
+    assert.strictEqual(sql.size, 1);
+    const cases = { clear: () => sql.clear() };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), {
+      clear: 'did not throw',
+    });
+    assert.strictEqual(sql.size, 0);
+  });
+
+  // A statement may be re-prepared during sqlite3_step() after a schema
+  // change, which invokes the authorizer without an explicit prepare() call.
+  it('rejects reentry when the authorizer runs during a re-prepare', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    const stmt = db.prepare('SELECT x FROM t');
+    stmt.get();
+    db.exec('ALTER TABLE t ADD COLUMN y INTEGER');
+
+    let outcome = 'authorizer callback did not run';
+    let ran = false;
+    db.setAuthorizer(() => {
+      if (!ran) {
+        ran = true;
+        try {
+          db.prepare('SELECT 1');
+          outcome = 'did not throw';
+        } catch (err) {
+          outcome = `${err.code}: ${err.message}`;
+        }
+      }
+      return constants.SQLITE_OK;
+    });
+
+    stmt.get();
+
+    assert.strictEqual(outcome, expectedError);
+  });
+
+  it('allows access again after the authorizer returns', () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t (x INTEGER)');
+    const cases = { prepare: () => db.prepare('SELECT 1') };
+
+    assert.deepStrictEqual(runInAuthorizer(db, cases), allRejected(cases));
+
+    db.setAuthorizer(() => constants.SQLITE_OK);
+    assert.deepStrictEqual(db.prepare('SELECT 1 AS v').get(), { __proto__: null, v: 1 });
+  });
+});
diff --git a/test/parallel/test-sqlite-backup.mjs b/test/parallel/test-sqlite-backup.mjs
index d1e09569e1ca..ee5f54fd909b 100644
--- a/test/parallel/test-sqlite-backup.mjs
+++ b/test/parallel/test-sqlite-backup.mjs
@@ -1,5 +1,10 @@
 // Flags: --expose-gc
-import { isWindows, skipIfSQLiteMissing } from '../common/index.mjs';
+import {
+  isWindows,
+  skipIfSQLiteMissing,
+  spawnPromisified,
+} from '../common/index.mjs';
+import fixtures from '../common/fixtures.js';
 import tmpdir from '../common/tmpdir.js';
 import { join } from 'node:path';
 import { describe, test } from 'node:test';
@@ -264,6 +269,16 @@ test('throws if URL is not file: scheme', (t) => {
   });
 });
 
+test('throws if the URL-like path has an unparsable href', (t) => {
+  const database = new DatabaseSync(':memory:');
+
+  t.after(() => { database.close(); });
+
+  t.assert.throws(() => {
+    backup(database, { href: 'not a url' });
+  }, { code: 'ERR_INVALID_URL' });
+});
+
 test('database backup fails when dest file is not writable', { skip: isRoot }, async (t) => {
   const readonlyDestDb = nextDb();
   writeFileSync(readonlyDestDb, '', { mode: 0o444 });
@@ -364,3 +379,13 @@ test('source database is kept alive while a backup is in flight', async (t) => {
   const rows = backupDb.prepare('SELECT COUNT(*) AS n FROM data').get();
   t.assert.strictEqual(rows.n, 500);
 });
+
+test('backup promise settles when the backup is the last active request', async (t) => {
+  const { code, signal, stderr } = await spawnPromisified(process.execPath, [
+    fixtures.path('sqlite', 'backup-last-request.mjs'),
+    nextDb(),
+  ]);
+
+  t.assert.strictEqual(signal, null);
+  t.assert.strictEqual(code, 0, stderr);
+});
diff --git a/test/parallel/test-sqlite-data-types.js b/test/parallel/test-sqlite-data-types.js
index bc4cd1ab5183..bac5a6283135 100644
--- a/test/parallel/test-sqlite-data-types.js
+++ b/test/parallel/test-sqlite-data-types.js
@@ -1,22 +1,13 @@
 'use strict';
 const { skipIfSQLiteMissing } = require('../common');
 skipIfSQLiteMissing();
-const tmpdir = require('../common/tmpdir');
-const { join } = require('node:path');
 const { DatabaseSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
-let cnt = 0;
-
-tmpdir.refresh();
-
-function nextDb() {
-  return join(tmpdir.path, `database-${cnt++}.db`);
-}
 
 suite('data binding and mapping', () => {
   test('supported data types', (t) => {
     const u8a = new TextEncoder().encode('a☃b☃c');
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE types(
@@ -92,7 +83,7 @@ suite('data binding and mapping', () => {
   });
 
   test('large strings are bound correctly', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, text TEXT) STRICT;'
@@ -127,7 +118,7 @@ suite('data binding and mapping', () => {
   });
 
   test('unsupported data types', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -162,7 +153,7 @@ suite('data binding and mapping', () => {
 
   test('throws when binding a BigInt that is too large', (t) => {
     const max = 9223372036854775807n; // Largest 64-bit signed integer value.
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -182,7 +173,7 @@ suite('data binding and mapping', () => {
   });
 
   test('statements are unbound on each call', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
diff --git a/test/parallel/test-sqlite-database-sync.js b/test/parallel/test-sqlite-database-sync.js
index 08a636c9cbdc..e570ffde779d 100644
--- a/test/parallel/test-sqlite-database-sync.js
+++ b/test/parallel/test-sqlite-database-sync.js
@@ -51,6 +51,12 @@ suite('DatabaseSync() constructor', () => {
     });
   });
 
+  test('throws if the URL-like path has an unparsable href', (t) => {
+    t.assert.throws(() => {
+      new DatabaseSync({ href: 'not a url' });
+    }, { code: 'ERR_INVALID_URL' });
+  });
+
   test('throws if options is provided but is not an object', (t) => {
     t.assert.throws(() => {
       new DatabaseSync('foo', null);
diff --git a/test/parallel/test-sqlite-diagnostic-channel.js b/test/parallel/test-sqlite-diagnostic-channel.js
new file mode 100644
index 000000000000..8b0776c969d7
--- /dev/null
+++ b/test/parallel/test-sqlite-diagnostic-channel.js
@@ -0,0 +1,237 @@
+// Flags: --expose-gc
+'use strict';
+
+const { mustCall, skipIfSQLiteMissing } = require('../common');
+skipIfSQLiteMissing();
+
+const assert = require('node:assert');
+const dc = require('node:diagnostics_channel');
+const { DatabaseSync } = require('node:sqlite');
+const { suite, it } = require('node:test');
+const { gcUntil } = require('../common/gc');
+
+suite('sqlite.db.query diagnostics channel', () => {
+  it('subscriber receives SQL string for exec() statements', (t) => {
+    const calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+
+    assert.strictEqual(calls.length, 2);
+    assert.strictEqual(calls[0].sql, 'CREATE TABLE t (x INTEGER)');
+    assert.strictEqual(calls[1].sql, 'INSERT INTO t VALUES (1)');
+  });
+
+  it('subscriber receives SQL string for prepared INSERT statements', (t) => {
+    let calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    calls = []; // reset after setup
+
+    using stmt = db.prepare('INSERT INTO t VALUES (?)');
+    stmt.run(42);
+
+    assert.strictEqual(calls.length, 1);
+    assert.strictEqual(calls[0].sql, 'INSERT INTO t VALUES (42.0)');
+  });
+
+  it('subscriber receives SQL string for prepared SELECT statements', (t) => {
+    let calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    calls = []; // reset after setup
+
+    using stmt = db.prepare('SELECT x FROM t WHERE x = ?');
+    stmt.get(1);
+
+    assert.strictEqual(calls.length, 1);
+    assert.strictEqual(calls[0].sql, 'SELECT x FROM t WHERE x = 1.0');
+  });
+
+  it('subscriber receives SQL string for prepared UPDATE statements', (t) => {
+    let calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    calls = []; // reset after setup
+
+    using stmt = db.prepare('UPDATE t SET x = ? WHERE x = ?');
+    stmt.run(2, 1);
+
+    assert.strictEqual(calls.length, 1);
+    assert.strictEqual(calls[0].sql, 'UPDATE t SET x = 2.0 WHERE x = 1.0');
+  });
+
+  it('subscriber receives SQL string for prepared DELETE statements', (t) => {
+    let calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    db.exec('INSERT INTO t VALUES (1)');
+    calls = []; // reset after setup
+
+    using stmt = db.prepare('DELETE FROM t WHERE x = ?');
+    stmt.run(1);
+
+    assert.strictEqual(calls.length, 1);
+    assert.strictEqual(calls[0].sql, 'DELETE FROM t WHERE x = 1.0');
+  });
+
+  it('no calls received after unsubscribe', (t) => {
+    const calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    assert.strictEqual(calls.length, 1);
+
+    dc.unsubscribe('sqlite.db.query', handler);
+    db.exec('INSERT INTO t VALUES (1)');
+    assert.strictEqual(calls.length, 1); // No new calls after unsubscribe
+  });
+
+  it('falls back to source SQL when expansion fails', (t) => {
+    let calls = [];
+    using db = new DatabaseSync(':memory:', { limits: { length: 1000 } });
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x TEXT)');
+    calls = []; // reset after setup
+
+    using stmt = db.prepare('INSERT INTO t VALUES (?)');
+
+    const longValue = 'a'.repeat(977);
+    stmt.run(longValue);
+
+    assert.strictEqual(calls.length, 1);
+    // Falls back to source SQL with unexpanded '?' placeholder
+    assert.strictEqual(calls[0].sql, 'INSERT INTO t VALUES (?)');
+  });
+
+  it('database property identifies the correct database', (t) => {
+    const calls = [];
+    using db1 = new DatabaseSync(':memory:');
+    using db2 = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db1.exec('CREATE TABLE t (x INTEGER)');
+    db2.exec('CREATE TABLE t (x INTEGER)');
+
+    assert.strictEqual(calls.length, 2);
+    assert.strictEqual(calls[0].database, db1);
+    assert.strictEqual(calls[1].database, db2);
+    assert.notStrictEqual(calls[0].database, calls[1].database);
+  });
+
+  it('duration is a number', (t) => {
+    const calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+
+    assert.strictEqual(calls.length, 1);
+    assert.strictEqual(typeof calls[0].duration, 'number');
+  });
+
+  it('duration is non-negative', (t) => {
+    const calls = [];
+    using db = new DatabaseSync(':memory:');
+
+    const handler = (msg) => calls.push(msg);
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+
+    assert.strictEqual(calls.length, 1);
+    assert.ok(calls[0].duration >= 0);
+  });
+
+  it('does not publish when an unfinished statement is collected', async (t) => {
+    let calls = 0;
+    const handler = () => calls++;
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    let collected = false;
+    const registry = new FinalizationRegistry(() => { collected = true; });
+
+    (() => {
+      const db = new DatabaseSync(':memory:');
+      db.exec('CREATE TABLE t (x INTEGER)');
+      for (let i = 0; i < 10; i++) {
+        db.exec(`INSERT INTO t VALUES (${i})`);
+      }
+
+      const stmt = db.prepare('SELECT x FROM t');
+      registry.register(stmt);
+      stmt.iterate().next(); // Leave the statement unfinished.
+    })();
+
+    calls = 0; // reset after setup
+    await gcUntil('unfinished statement is collected', () => collected);
+
+    assert.strictEqual(calls, 0);
+  });
+
+  it('subscriber cannot close the database or statement', (t) => {
+    using db = new DatabaseSync(':memory:');
+
+    db.exec('CREATE TABLE t (x INTEGER)');
+    using stmt = db.prepare('INSERT INTO t VALUES (?)');
+
+    const handler = mustCall(() => {
+      assert.throws(() => db.close(), { code: 'ERR_INVALID_STATE' });
+      assert.throws(() => stmt.close(), { code: 'ERR_INVALID_STATE' });
+      assert.throws(() => stmt[Symbol.dispose](), {
+        code: 'ERR_INVALID_STATE',
+      });
+    });
+    dc.subscribe('sqlite.db.query', handler);
+    t.after(() => dc.unsubscribe('sqlite.db.query', handler));
+
+    stmt.run(1);
+
+    dc.unsubscribe('sqlite.db.query', handler);
+    assert.deepStrictEqual(db.prepare('SELECT x FROM t').all(), [
+      { __proto__: null, x: 1 },
+    ]);
+  });
+});
diff --git a/test/parallel/test-sqlite-named-parameters.js b/test/parallel/test-sqlite-named-parameters.js
index db8f46e6b6ce..fd0a209b6b0b 100644
--- a/test/parallel/test-sqlite-named-parameters.js
+++ b/test/parallel/test-sqlite-named-parameters.js
@@ -1,21 +1,12 @@
 'use strict';
 const { skipIfSQLiteMissing } = require('../common');
 skipIfSQLiteMissing();
-const tmpdir = require('../common/tmpdir');
-const { join } = require('node:path');
 const { DatabaseSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
-let cnt = 0;
-
-tmpdir.refresh();
-
-function nextDb() {
-  return join(tmpdir.path, `database-${cnt++}.db`);
-}
 
 suite('named parameters', () => {
   test('throws on unknown named parameters', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -32,7 +23,7 @@ suite('named parameters', () => {
   });
 
   test('bare named parameters are supported', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -47,7 +38,7 @@ suite('named parameters', () => {
   });
 
   test('duplicate bare named parameters are supported', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -62,7 +53,7 @@ suite('named parameters', () => {
   });
 
   test('bare named parameters throw on ambiguous names', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -118,6 +109,22 @@ suite('StatementSync.prototype.setAllowUnknownNamedParameters()', () => {
       message: /The "enabled" argument must be a boolean/,
     });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const setup = db.exec(
+      'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
+    );
+    t.assert.strictEqual(setup, undefined);
+    const stmt = db.prepare('INSERT INTO data (key, val) VALUES ($k, $v)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.setAllowUnknownNamedParameters(true);
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('options.allowUnknownNamedParameters', () => {
diff --git a/test/parallel/test-sqlite-serialize.js b/test/parallel/test-sqlite-serialize.js
index 77b9d9c5f483..e54cfa3c6a75 100644
--- a/test/parallel/test-sqlite-serialize.js
+++ b/test/parallel/test-sqlite-serialize.js
@@ -190,6 +190,23 @@ suite('DatabaseSync.prototype.deserialize()', () => {
     });
   });
 
+  test('throws if called while in a callback', (t) => {
+    const source = new DatabaseSync(':memory:');
+    const serialized = source.serialize();
+    source.close();
+
+    const db = new DatabaseSync(':memory:');
+    t.after(() => db.close());
+    db.function('deserialize_database', () => db.deserialize(serialized));
+    const stmt = db.prepare('SELECT deserialize_database()');
+
+    t.assert.throws(() => stmt.get(), {
+      code: 'ERR_INVALID_STATE',
+      message: 'database cannot be deserialized while in a callback',
+    });
+    t.assert.strictEqual(db.isOpen, true);
+  });
+
   test('throws if buffer argument is not a Uint8Array', (t) => {
     const db = new DatabaseSync(':memory:');
     t.assert.throws(() => {
diff --git a/test/parallel/test-sqlite-session.js b/test/parallel/test-sqlite-session.js
index 5faea802ccd5..a8bbaa77d064 100644
--- a/test/parallel/test-sqlite-session.js
+++ b/test/parallel/test-sqlite-session.js
@@ -404,6 +404,13 @@ test('filter handler throws', (t) => {
     name: 'Error',
     message: 'Error filtering table data1'
   });
+
+  t.assert.throws(() => {
+    database2.exec('CREATE TABLEEEE');
+  }, {
+    code: 'ERR_SQLITE_ERROR',
+    message: /syntax error/,
+  });
 });
 
 test('database.createSession() - filter changes', (t) => {
diff --git a/test/parallel/test-sqlite-statement-sync.js b/test/parallel/test-sqlite-statement-sync.js
index b3a1dc434537..cf0e4daa45ca 100644
--- a/test/parallel/test-sqlite-statement-sync.js
+++ b/test/parallel/test-sqlite-statement-sync.js
@@ -2,17 +2,8 @@
 'use strict';
 const { skipIfSQLiteMissing } = require('../common');
 skipIfSQLiteMissing();
-const tmpdir = require('../common/tmpdir');
-const { join } = require('node:path');
 const { DatabaseSync, StatementSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
-let cnt = 0;
-
-tmpdir.refresh();
-
-function nextDb() {
-  return join(tmpdir.path, `database-${cnt++}.db`);
-}
 
 suite('StatementSync() constructor', () => {
   test('StatementSync cannot be constructed directly', (t) => {
@@ -27,7 +18,7 @@ suite('StatementSync() constructor', () => {
 
 suite('StatementSync.prototype.get()', () => {
   test('executes a query and returns undefined on no results', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.strictEqual(stmt.get(), undefined);
@@ -36,7 +27,7 @@ suite('StatementSync.prototype.get()', () => {
   });
 
   test('executes a query and returns the first result', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.strictEqual(stmt.get(), undefined);
@@ -48,7 +39,7 @@ suite('StatementSync.prototype.get()', () => {
   });
 
   test('executes a query that returns special columns', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const stmt = db.prepare('SELECT 1 as __proto__, 2 as constructor, 3 as toString');
     t.assert.deepStrictEqual(stmt.get(), { __proto__: null, ['__proto__']: 1, constructor: 2, toString: 3 });
@@ -76,18 +67,30 @@ suite('StatementSync.prototype.get()', () => {
       __proto__: null, key: 'key1', val: 'val1',
     });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.get();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.all()', () => {
   test('executes a query and returns an empty array on no results', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.deepStrictEqual(stmt.all(), []);
   });
 
   test('executes a query and returns all results', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.deepStrictEqual(stmt.run(), { changes: 0, lastInsertRowid: 0 });
@@ -129,11 +132,23 @@ suite('StatementSync.prototype.all()', () => {
       { __proto__: null, key: 'key1', val: 'val1' },
     ]);
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.all();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.iterate()', () => {
   test('executes a query and returns an empty iterator on no results', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     const iter = stmt.iterate();
@@ -143,7 +158,7 @@ suite('StatementSync.prototype.iterate()', () => {
   });
 
   test('executes a query and returns all results', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     let stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
     t.assert.deepStrictEqual(stmt.run(), { changes: 0, lastInsertRowid: 0 });
@@ -295,11 +310,23 @@ suite('StatementSync.prototype.iterate()', () => {
     stmt2.get();
     it.next();
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.iterate();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.run()', () => {
   test('executes a query and returns change metadata', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE storage(key TEXT, val TEXT);
@@ -311,7 +338,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('SQLite throws when trying to bind too many parameters', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -329,7 +356,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('SQLite defaults to NULL for unbound parameters', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER NOT NULL) STRICT;'
@@ -366,7 +393,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('SQLite defaults unbound ?NNN parameters', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER NOT NULL) STRICT;'
@@ -385,7 +412,7 @@ suite('StatementSync.prototype.run()', () => {
   });
 
   test('binds ?NNN params by position', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER NOT NULL) STRICT;'
@@ -394,11 +421,23 @@ suite('StatementSync.prototype.run()', () => {
     const stmt = db.prepare('INSERT INTO data (key, val) VALUES (?1, ?2)');
     t.assert.deepStrictEqual(stmt.run(1, 2), { changes: 1, lastInsertRowid: 1 });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.run();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.sourceSQL', () => {
   test('equals input SQL', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -408,11 +447,21 @@ suite('StatementSync.prototype.sourceSQL', () => {
     const stmt = db.prepare(sql);
     t.assert.strictEqual(stmt.sourceSQL, sql);
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => stmt.sourceSQL, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.expandedSQL', () => {
   test('equals expanded SQL', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -427,11 +476,21 @@ suite('StatementSync.prototype.expandedSQL', () => {
     );
     t.assert.strictEqual(stmt.expandedSQL, expanded);
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => stmt.expandedSQL, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.setReadBigInts()', () => {
   test('BigInts support can be toggled', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
@@ -464,7 +523,7 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -480,7 +539,7 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
   });
 
   test('BigInt is required for reading large integers', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const bad = db.prepare(`SELECT ${Number.MAX_SAFE_INTEGER} + 1`);
     t.assert.throws(() => {
@@ -496,11 +555,23 @@ suite('StatementSync.prototype.setReadBigInts()', () => {
       [`${Number.MAX_SAFE_INTEGER} + 1`]: 2n ** 53n,
     });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.setReadBigInts(true);
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.setReturnArrays()', () => {
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -514,11 +585,23 @@ suite('StatementSync.prototype.setReturnArrays()', () => {
       message: /The "returnArrays" argument must be a boolean/,
     });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.setReturnArrays(true);
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('StatementSync.prototype.get() with array output', () => {
   test('returns array row when setReturnArrays is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -538,7 +621,7 @@ suite('StatementSync.prototype.get() with array output', () => {
 
   test('returns array rows with BigInts when both flags are set', (t) => {
     const expected = [1n, 9007199254740992n];
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE big_data(id INTEGER, big_num INTEGER);
@@ -557,7 +640,7 @@ suite('StatementSync.prototype.get() with array output', () => {
 
 suite('StatementSync.prototype.all() with array output', () => {
   test('returns array rows when setReturnArrays is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -598,7 +681,7 @@ suite('StatementSync.prototype.all() with array output', () => {
       9,
       'text3',
     ];
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE wide_table(
@@ -623,7 +706,7 @@ suite('StatementSync.prototype.all() with array output', () => {
 
 suite('StatementSync.prototype.iterate() with array output', () => {
   test('iterates array rows when setReturnArrays is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -692,7 +775,7 @@ suite('StatementSync.prototype.iterate() with array output', () => {
 
 suite('StatementSync.prototype.setAllowBareNamedParameters()', () => {
   test('bare named parameter support can be toggled', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -718,7 +801,7 @@ suite('StatementSync.prototype.setAllowBareNamedParameters()', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -732,11 +815,23 @@ suite('StatementSync.prototype.setAllowBareNamedParameters()', () => {
       message: /The "allowBareNamedParameters" argument must be a boolean/,
     });
   });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.setAllowBareNamedParameters(true);
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
 });
 
 suite('options.readBigInts', () => {
   test('BigInts are returned when input is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
@@ -749,7 +844,7 @@ suite('options.readBigInts', () => {
   });
 
   test('numbers are returned when input is false', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
@@ -762,7 +857,7 @@ suite('options.readBigInts', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -777,7 +872,7 @@ suite('options.readBigInts', () => {
   });
 
   test('setReadBigInts can override prepare option', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;
@@ -794,7 +889,7 @@ suite('options.readBigInts', () => {
 
 suite('options.returnArrays', () => {
   test('arrays are returned when input is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -810,7 +905,7 @@ suite('options.returnArrays', () => {
   });
 
   test('objects are returned when input is false', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -826,7 +921,7 @@ suite('options.returnArrays', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;'
@@ -841,7 +936,7 @@ suite('options.returnArrays', () => {
   });
 
   test('setReturnArrays can override prepare option', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -859,7 +954,7 @@ suite('options.returnArrays', () => {
   });
 
   test('all() returns arrays when input is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -879,7 +974,7 @@ suite('options.returnArrays', () => {
   });
 
   test('iterate() returns arrays when input is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(key INTEGER PRIMARY KEY, val TEXT) STRICT;
@@ -901,7 +996,7 @@ suite('options.returnArrays', () => {
 
 suite('options.allowBareNamedParameters', () => {
   test('bare named parameters are allowed when input is true', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -918,7 +1013,7 @@ suite('options.allowBareNamedParameters', () => {
   });
 
   test('bare named parameters throw when input is false', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -937,7 +1032,7 @@ suite('options.allowBareNamedParameters', () => {
   });
 
   test('throws when input is not a boolean', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -955,7 +1050,7 @@ suite('options.allowBareNamedParameters', () => {
   });
 
   test('setAllowBareNamedParameters can override prepare option', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(
       'CREATE TABLE data(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
@@ -978,3 +1073,71 @@ suite('options.allowBareNamedParameters', () => {
     );
   });
 });
+
+
+suite('StatementSync.prototype.close()', () => {
+  test('finalizes an open statement', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE storage(key TEXT, val TEXT)');
+    const stmt = db.prepare('SELECT * FROM storage');
+    t.assert.strictEqual(stmt.close(), undefined);
+    t.assert.throws(() => stmt.get(), {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
+
+  test('throws if the statement is already finalized', (t) => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt.close();
+    t.assert.throws(() => {
+      stmt.close();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
+});
+
+suite('StatementSync.prototype[Symbol.dispose]()', () => {
+  test('finalizes an open statement', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE storage(key TEXT, val TEXT)');
+    const stmt = db.prepare('SELECT * FROM storage');
+    stmt[Symbol.dispose]();
+    t.assert.throws(() => stmt.get(), {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
+
+  test('does not throw on an already-finalized statement', () => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt[Symbol.dispose]();
+    stmt[Symbol.dispose]();
+  });
+
+  test('works with a using declaration', (t) => {
+    using db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE storage(key TEXT, val TEXT)');
+    let captured;
+    {
+      using stmt = db.prepare('SELECT * FROM storage');
+      captured = stmt;
+      t.assert.deepStrictEqual(stmt.all(), []);
+    }
+    t.assert.throws(() => captured.get(), {
+      code: 'ERR_INVALID_STATE',
+      message: /statement has been finalized/,
+    });
+  });
+
+  test('closing the database after dispose does not double-finalize', () => {
+    using db = new DatabaseSync(':memory:');
+    const stmt = db.prepare('CREATE TABLE storage(key TEXT, val TEXT)');
+    stmt[Symbol.dispose]();
+    db.close();
+  });
+});
diff --git a/test/parallel/test-sqlite-transactions.js b/test/parallel/test-sqlite-transactions.js
index 50b47829aca0..963e7126a101 100644
--- a/test/parallel/test-sqlite-transactions.js
+++ b/test/parallel/test-sqlite-transactions.js
@@ -1,21 +1,12 @@
 'use strict';
 const { skipIfSQLiteMissing } = require('../common');
 skipIfSQLiteMissing();
-const tmpdir = require('../common/tmpdir');
-const { join } = require('node:path');
 const { DatabaseSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
-let cnt = 0;
-
-tmpdir.refresh();
-
-function nextDb() {
-  return join(tmpdir.path, `database-${cnt++}.db`);
-}
 
 suite('manual transactions', () => {
   test('a transaction is committed', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(
@@ -42,7 +33,7 @@ suite('manual transactions', () => {
   });
 
   test('a transaction is rolled back', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     const setup = db.exec(`
       CREATE TABLE data(
diff --git a/test/parallel/test-sqlite-typed-array-and-data-view.js b/test/parallel/test-sqlite-typed-array-and-data-view.js
index 3e2b62d2d573..5236c182e061 100644
--- a/test/parallel/test-sqlite-typed-array-and-data-view.js
+++ b/test/parallel/test-sqlite-typed-array-and-data-view.js
@@ -1,17 +1,8 @@
 'use strict';
 const { skipIfSQLiteMissing } = require('../common');
 skipIfSQLiteMissing();
-const tmpdir = require('../common/tmpdir');
-const { join } = require('node:path');
 const { DatabaseSync } = require('node:sqlite');
 const { suite, test } = require('node:test');
-let cnt = 0;
-
-tmpdir.refresh();
-
-function nextDb() {
-  return join(tmpdir.path, `database-${cnt++}.db`);
-}
 
 const arrayBuffer = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]).buffer;
 const sharedArrayBuffer = new SharedArrayBuffer(8);
@@ -36,7 +27,7 @@ const TypedArrays = [
 suite('StatementSync with TypedArray/DataView', () => {
   for (const [displayName, TypedArray] of TypedArrays) {
     test(displayName, (t) => {
-      const db = new DatabaseSync(nextDb());
+      const db = new DatabaseSync(':memory:');
       t.after(() => { db.close(); });
       db.exec('CREATE TABLE test (data BLOB)');
       // insert
diff --git a/test/parallel/test-sqlite-udf-close.js b/test/parallel/test-sqlite-udf-close.js
new file mode 100644
index 000000000000..cb11e50a7f7a
--- /dev/null
+++ b/test/parallel/test-sqlite-udf-close.js
@@ -0,0 +1,242 @@
+'use strict';
+
+const { skipIfSQLiteMissing } = require('../common');
+skipIfSQLiteMissing();
+const assert = require('node:assert');
+const { test } = require('node:test');
+const { DatabaseSync } = require('node:sqlite');
+
+for (const method of ['all', 'get', 'run', 'iterate']) {
+  test(`database.close() from a UDF during statement.${method}()`, () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE data (value INTEGER);
+      INSERT INTO data VALUES (1), (2), (3);
+    `);
+
+    db.function('close_db', (value) => {
+      db.close();
+      return value;
+    });
+
+    const statement = db.prepare('SELECT close_db(value) FROM data');
+    assert.throws(() => {
+      if (method === 'iterate') {
+        for (const row of statement.iterate()) {
+          assert.ok(row);
+        }
+      } else {
+        statement[method]();
+      }
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: 'database cannot be closed while in a callback',
+    });
+
+    assert.strictEqual(db.isOpen, true);
+    db.close();
+  });
+
+  // Finalizing the statement being stepped frees the virtual machine that
+  // sqlite3_step() is still running, so this must throw rather than crash.
+  test(`statement.close() from a UDF during statement.${method}()`, () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE data (value INTEGER);
+      INSERT INTO data VALUES (1), (2), (3);
+    `);
+
+    let statement;
+    db.function('close_stmt', (value) => {
+      statement.close();
+      return value;
+    });
+
+    statement = db.prepare('SELECT close_stmt(value) FROM data');
+    assert.throws(() => {
+      if (method === 'iterate') {
+        for (const row of statement.iterate()) {
+          assert.ok(row);
+        }
+      } else {
+        statement[method]();
+      }
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: 'statement is already being executed',
+    });
+
+    db.close();
+  });
+
+  // Re-running the statement being stepped resets its virtual machine
+  // mid-execution, which is the same use-after-free as finalizing it.
+  for (const reentrant of ['run', 'get', 'all', 'iterate']) {
+    test(`statement.${reentrant}() from a UDF during ` +
+         `statement.${method}()`, () => {
+      const db = new DatabaseSync(':memory:');
+      db.exec(`
+        CREATE TABLE data (value INTEGER, padding TEXT);
+        INSERT INTO data VALUES (1, '${'x'.repeat(400)}'),
+                                (2, '${'y'.repeat(400)}'),
+                                (3, '${'z'.repeat(400)}');
+      `);
+
+      let statement;
+      let thrown;
+      db.function('reenter', (value) => {
+        if (thrown === undefined) {
+          try {
+            statement[reentrant]();
+            thrown = null;
+          } catch (err) {
+            thrown = err;
+          }
+        }
+        return value;
+      });
+
+      statement = db.prepare('SELECT reenter(value), padding FROM data');
+      if (method === 'iterate') {
+        for (const row of statement.iterate()) {
+          assert.ok(row);
+        }
+      } else {
+        statement[method]();
+      }
+
+      assert.ok(thrown, `${reentrant}() was not rejected`);
+      assert.strictEqual(thrown.code, 'ERR_INVALID_STATE');
+      assert.strictEqual(thrown.message, 'statement is already being executed');
+
+      db.close();
+    });
+  }
+
+  // Tag store methods resolve to a cached statement, which may be the one
+  // currently being stepped. Each reentrant method has its own guard, so all
+  // four are exercised.
+  for (const reentrant of ['run', 'get', 'all', 'iterate']) {
+    test(`tag store ${reentrant} reentry during statement.${method}()`, () => {
+      const db = new DatabaseSync(':memory:');
+      const sql = db.createTagStore(10);
+      db.exec(`
+        CREATE TABLE data (value INTEGER, padding TEXT);
+        INSERT INTO data VALUES (1, '${'x'.repeat(400)}'),
+                                (2, '${'y'.repeat(400)}');
+      `);
+
+      let thrown;
+      db.function('reenter_tag', (value) => {
+        if (thrown === undefined) {
+          try {
+            // The identical tagged literal resolves to the same cached
+            // statement that is mid-execution.
+            // All four reject at call time, iterate() included, so the
+            // result is never consumed.
+            // eslint-disable-next-line no-unused-expressions
+            sql[reentrant]`SELECT reenter_tag(value), padding FROM data`;
+            thrown = null;
+          } catch (err) {
+            thrown = err;
+          }
+        }
+        return value;
+      });
+
+      if (method === 'iterate') {
+        for (const row of sql.iterate`SELECT reenter_tag(value), padding FROM data`) {
+          assert.ok(row);
+        }
+      } else {
+        // eslint-disable-next-line no-unused-expressions
+        sql[method]`SELECT reenter_tag(value), padding FROM data`;
+      }
+
+      assert.ok(thrown, `tag store ${reentrant} reentry was not rejected`);
+      assert.strictEqual(thrown.code, 'ERR_INVALID_STATE');
+      assert.strictEqual(thrown.message,
+                         'statement is already being executed');
+
+      db.close();
+    });
+  }
+
+  // A UDF may prepare and finalize its own helper statements. Only the
+  // statement being stepped is off limits.
+  test(`UDF finalizes its own statement during statement.${method}()`, () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE data (value INTEGER);
+      INSERT INTO data VALUES (1), (2), (3);
+      CREATE TABLE lookup (key INTEGER, label TEXT);
+      INSERT INTO lookup VALUES (1, 'one'), (2, 'two'), (3, 'three');
+    `);
+
+    db.function('lookup_label', (value) => {
+      const helper = db.prepare('SELECT label FROM lookup WHERE key = ?');
+      const label = helper.get(value).label;
+      helper.close();
+      return label;
+    });
+
+    const statement = db.prepare('SELECT lookup_label(value) AS l FROM data');
+    if (method === 'iterate') {
+      const labels = [];
+      for (const row of statement.iterate()) {
+        labels.push(row.l);
+      }
+      assert.deepStrictEqual(labels, ['one', 'two', 'three']);
+    } else if (method === 'all') {
+      assert.deepStrictEqual(statement.all().map((r) => r.l),
+                             ['one', 'two', 'three']);
+    } else if (method === 'get') {
+      assert.strictEqual(statement.get().l, 'one');
+    } else {
+      statement.run();
+    }
+
+    db.close();
+  });
+}
+
+// iterator.return() resets the statement it is iterating, and next() steps it
+// again, so both reach the virtual machine that is mid-execution.
+for (const op of ['next', 'return']) {
+  test(`iterator.${op}() from a UDF during iteration`, () => {
+    const db = new DatabaseSync(':memory:');
+    db.exec(`
+      CREATE TABLE data (value INTEGER, padding TEXT);
+      INSERT INTO data VALUES (1, '${'x'.repeat(400)}'),
+                              (2, '${'y'.repeat(400)}'),
+                              (3, '${'z'.repeat(400)}');
+    `);
+
+    let iterator;
+    let thrown;
+    db.function('reenter_iter', (value) => {
+      if (thrown === undefined && iterator !== undefined) {
+        try {
+          iterator[op]();
+          thrown = null;
+        } catch (err) {
+          thrown = err;
+        }
+      }
+      return value;
+    });
+
+    const statement = db.prepare(
+      'SELECT reenter_iter(value) AS v, padding FROM data');
+    iterator = statement.iterate();
+    for (const row of iterator) {
+      assert.ok(row);
+    }
+
+    assert.ok(thrown, `iterator.${op}() was not rejected`);
+    assert.strictEqual(thrown.code, 'ERR_INVALID_STATE');
+    assert.strictEqual(thrown.message, 'statement is already being executed');
+
+    db.close();
+  });
+}
diff --git a/test/parallel/test-sqlite.js b/test/parallel/test-sqlite.js
index ebbcd27d1345..b7b65f1258f0 100644
--- a/test/parallel/test-sqlite.js
+++ b/test/parallel/test-sqlite.js
@@ -36,7 +36,7 @@ suite('accessing the node:sqlite module', () => {
 });
 
 test('ERR_SQLITE_ERROR is thrown for errors originating from SQLite', (t) => {
-  const db = new DatabaseSync(nextDb());
+  const db = new DatabaseSync(':memory:');
   t.after(() => { db.close(); });
   const setup = db.exec(`
     CREATE TABLE test(
@@ -86,6 +86,7 @@ test('sqlite constants are defined', (t) => {
 });
 
 test('PRAGMAs are supported', (t) => {
+  // WAL journal mode requires an on-disk database.
   const db = new DatabaseSync(nextDb());
   t.after(() => { db.close(); });
   t.assert.deepStrictEqual(
@@ -218,7 +219,7 @@ suite('SQL APIs enabled at build time', () => {
   });
 
   test('dbstat is enabled', (t) => {
-    const db = new DatabaseSync(nextDb());
+    const db = new DatabaseSync(':memory:');
     t.after(() => { db.close(); });
     db.exec(`
       CREATE TABLE t1 (key INTEGER PRIMARY KEY);
diff --git a/test/parallel/test-stream-duplex-from.js b/test/parallel/test-stream-duplex-from.js
index e12599fed17c..a553a90f96e3 100644
--- a/test/parallel/test-stream-duplex-from.js
+++ b/test/parallel/test-stream-duplex-from.js
@@ -418,3 +418,19 @@ function makeATestWritableStream(writeFunc) {
   }));
   r.destroy(expectedErr);
 }
+
+// Regression for https://github.com/nodejs/node/issues/55077:
+// An AsyncFunction passed to Duplex.from() that returns without consuming its
+// input must still allow pipeline() to complete and destroy the upstream.
+{
+  const r = Readable.from(['foo', 'bar', 'baz']);
+  pipeline(
+    r,
+    Duplex.from(async function() {
+      // Intentionally do not consume the async iterable input.
+    }),
+    common.mustCall(() => {
+      assert.strictEqual(r.destroyed, true);
+    }),
+  );
+}
diff --git a/test/parallel/test-stream-iter-broadcast-basic.js b/test/parallel/test-stream-iter-broadcast-basic.js
index 3dbd3ce97512..4135aea6d97d 100644
--- a/test/parallel/test-stream-iter-broadcast-basic.js
+++ b/test/parallel/test-stream-iter-broadcast-basic.js
@@ -350,6 +350,18 @@ async function testLateJoinerSeesBufferedData() {
   assert.strictEqual(result, 'before-join');
 }
 
+async function testLateJoinerAfterDetachSeesBufferedData() {
+  const { writer, broadcast: bc } = broadcast({ budget: 16384 });
+  const first = bc.push()[Symbol.asyncIterator]();
+
+  writer.writeSync('before-detach');
+  await first.return();
+
+  const second = bc.push();
+  writer.endSync();
+  assert.strictEqual(await text(second), 'before-detach');
+}
+
 async function testOverlappingNextKeepsEarlierRead() {
   const { writer, broadcast: bc } = broadcast();
   const it = bc.push()[Symbol.asyncIterator]();
@@ -403,5 +415,6 @@ Promise.all([
   testFailDetachesConsumers(),
   testWriterFailIdempotent(),
   testLateJoinerSeesBufferedData(),
+  testLateJoinerAfterDetachSeesBufferedData(),
   testOverlappingNextKeepsEarlierRead(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-broadcast-from.js b/test/parallel/test-stream-iter-broadcast-from.js
index 39d92c2aef49..928d4d472f06 100644
--- a/test/parallel/test-stream-iter-broadcast-from.js
+++ b/test/parallel/test-stream-iter-broadcast-from.js
@@ -122,8 +122,8 @@ async function testBroadcastFromCancelWhileBlocked() {
   async function* slowSource() {
     const enc = new TextEncoder();
     yield [enc.encode('chunk1')];
-    // Simulate a long delay - the cancel should unblock this
-    await new Promise((resolve) => setTimeout(resolve, 10000));
+    // Simulate a long delay without keeping the cancelled source alive.
+    await new Promise((resolve) => setTimeout(resolve, 10000).unref());
     yield [enc.encode('chunk2')];
     sourceFinished = true;
   }
diff --git a/test/parallel/test-stream-iter-consumers-merge.js b/test/parallel/test-stream-iter-consumers-merge.js
index 84aeb24b6159..becf68ee63a1 100644
--- a/test/parallel/test-stream-iter-consumers-merge.js
+++ b/test/parallel/test-stream-iter-consumers-merge.js
@@ -108,6 +108,109 @@ async function testMergeSourceError() {
   );
 }
 
+async function testMergeFalsySourceErrors() {
+  const reasons = [undefined, null, false, 0, '', NaN];
+
+  for (const reason of reasons) {
+    const noError = { __proto__: null };
+    let actual = noError;
+    try {
+      await text(merge(rejectedSource(reason), from('other')));
+    } catch (error) {
+      actual = error;
+    }
+    assert.strictEqual(Object.is(actual, reason), true);
+  }
+}
+
+function rejectedSource(reason) {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+    next() {
+      return Promise.reject(reason);
+    },
+  };
+}
+
+function pendingSource() {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+    next() {
+      return new Promise(() => {});
+    },
+    return() {
+      return new Promise(() => {});
+    },
+  };
+}
+
+async function testMergeSourceErrorDoesNotAwaitCleanup() {
+  const reason = new Error('source failed');
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    text(merge(rejectedSource(reason), pendingSource())).then(
+      () => ({ __proto__: null, status: 'fulfilled' }),
+      (error) => ({ __proto__: null, status: 'rejected', error }),
+    ),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.notStrictEqual(outcome, timedOut);
+  assert.strictEqual(outcome.status, 'rejected');
+  assert.strictEqual(outcome.error, reason);
+}
+
+async function testMergeBreakDoesNotAwaitCleanup() {
+  async function* readySource() {
+    yield [Uint8Array.of(1)];
+  }
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    (async () => {
+      for await (const batch of merge(readySource(), pendingSource())) {
+        assert.deepStrictEqual(batch, [Uint8Array.of(1)]);
+        break;
+      }
+      return true;
+    })(),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.strictEqual(outcome, true);
+}
+
+async function testMergeNaNAbortDoesNotAwaitCleanup() {
+  const ac = new AbortController();
+  const iterator = merge(pendingSource(), pendingSource(), {
+    __proto__: null,
+    signal: ac.signal,
+  })[Symbol.asyncIterator]();
+  const next = iterator.next();
+  await new Promise(setImmediate);
+  ac.abort(NaN);
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    next.then(
+      () => ({ __proto__: null, status: 'fulfilled' }),
+      (error) => ({ __proto__: null, status: 'rejected', error }),
+    ),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.notStrictEqual(outcome, timedOut);
+  assert.strictEqual(outcome.status, 'rejected');
+  assert.strictEqual(Object.is(outcome.error, NaN), true);
+}
+
 async function testMergeConsumerBreak() {
   let source1Return = false;
   let source2Return = false;
@@ -296,9 +399,8 @@ async function testMergeCleanupErrorOnly() {
   );
 }
 
-// Primary error + cleanup error: a source throws during iteration AND
-// iterator.return() also throws. Should get a SuppressedError.
-async function testMergePrimaryAndCleanupError() {
+// A primary source error must not wait for asynchronous cleanup failures.
+async function testMergePrimaryErrorPrecedesCleanupError() {
   async function* badSource() {
     yield [new TextEncoder().encode('x')];
     throw new Error('primary boom');
@@ -319,15 +421,7 @@ async function testMergePrimaryAndCleanupError() {
         // Consume until error
       }
     },
-    (err) => {
-      assert.ok(
-        err instanceof SuppressedError,
-        `Expected SuppressedError, got ${err.constructor.name}`,
-      );
-      assert.strictEqual(err.error.message, 'primary boom');
-      assert.strictEqual(err.suppressed.message, 'cleanup boom');
-      return true;
-    },
+    { message: 'primary boom' },
   );
 }
 
@@ -353,6 +447,27 @@ async function testMergeBreakWithCleanupError() {
   );
 }
 
+async function testMergeMultiSourceBreakWithCleanupError() {
+  async function* failingReturnSource() {
+    try {
+      yield [new TextEncoder().encode('data')];
+    } finally {
+      await Promise.resolve();
+      throwInFinally('async cleanup on break');
+    }
+  }
+
+  await assert.rejects(
+    async () => {
+      // eslint-disable-next-line no-unused-vars
+      for await (const _ of merge(failingReturnSource(), from('other'))) {
+        break;
+      }
+    },
+    { message: 'async cleanup on break' },
+  );
+}
+
 Promise.all([
   testMergeTwoSources(),
   testMergeSingleSource(),
@@ -360,6 +475,10 @@ Promise.all([
   testMergeWithAbortSignal(),
   testMergeSyncSources(),
   testMergeSourceError(),
+  testMergeFalsySourceErrors(),
+  testMergeSourceErrorDoesNotAwaitCleanup(),
+  testMergeBreakDoesNotAwaitCleanup(),
+  testMergeNaNAbortDoesNotAwaitCleanup(),
   testMergeConsumerBreak(),
   testMergeSignalMidIteration(),
   testMergeSignalDuringPendingMultiSourceRead(),
@@ -368,6 +487,7 @@ Promise.all([
   testMergeStringSources(),
   testMergeObjectLikeSources(),
   testMergeCleanupErrorOnly(),
-  testMergePrimaryAndCleanupError(),
+  testMergePrimaryErrorPrecedesCleanupError(),
   testMergeBreakWithCleanupError(),
+  testMergeMultiSourceBreakWithCleanupError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-duplex.js b/test/parallel/test-stream-iter-duplex.js
index 0969b91e7d21..354fa28b67a6 100644
--- a/test/parallel/test-stream-iter-duplex.js
+++ b/test/parallel/test-stream-iter-duplex.js
@@ -14,32 +14,26 @@ async function testBasicDuplex() {
 
   // A writes, B reads
   await channelA.writer.write('hello from A');
-  await channelA.close();
-
+  const closing = channelA.close();
   const dataAtB = await text(channelB.readable);
+  await closing;
   assert.strictEqual(dataAtB, 'hello from A');
 }
 
 async function testBidirectional() {
   const [channelA, channelB] = duplex();
 
-  // A writes to B, B writes to A concurrently
-  const writeA = (async () => {
-    await channelA.writer.write('A to B');
-    await channelA.close();
-  })();
-
-  const writeB = (async () => {
-    await channelB.writer.write('B to A');
-    await channelB.close();
-  })();
-
-  const readAtB = text(channelB.readable);
-  const readAtA = text(channelA.readable);
-
-  await Promise.all([writeA, writeB]);
+  await channelA.writer.write('A to B');
+  await channelB.writer.write('B to A');
 
-  const [dataAtA, dataAtB] = await Promise.all([readAtA, readAtB]);
+  const endA = channelA.writer.end();
+  const endB = channelB.writer.end();
+  const [dataAtA, dataAtB] = await Promise.all([
+    text(channelA.readable),
+    text(channelB.readable),
+  ]);
+  await Promise.all([endA, endB]);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtB, 'A to B');
   assert.strictEqual(dataAtA, 'B to A');
@@ -51,19 +45,29 @@ async function testMultipleWrites() {
   await channelA.writer.write('one');
   await channelA.writer.write('two');
   await channelA.writer.write('three');
-  await channelA.close();
-
+  const closing = channelA.close();
   const data = await text(channelB.readable);
+  await closing;
   assert.strictEqual(data, 'onetwothree');
 }
 
 async function testChannelClose() {
   const [channelA, channelB] = duplex();
-
-  await channelA.close();
-
-  // Should be able to close twice without error
-  await channelA.close();
+  const iteratorA = channelA.readable[Symbol.asyncIterator]();
+  const otherIteratorA = channelA.readable[Symbol.asyncIterator]();
+  const pendingRead = iteratorA.next();
+
+  const closing = channelA.close();
+  assert.strictEqual(channelA.close(), closing);
+  await closing;
+
+  assert.strictEqual((await pendingRead).done, true);
+  assert.strictEqual((await otherIteratorA.next()).done, true);
+  assert.strictEqual(
+    (await channelA.readable[Symbol.asyncIterator]().next()).done, true);
+  await assert.rejects(channelB.writer.write('late'), {
+    code: 'ERR_INVALID_STATE',
+  });
 
   // B's readable should end (A -> B direction is closed)
   const batches = [];
@@ -73,6 +77,20 @@ async function testChannelClose() {
   assert.strictEqual(batches.length, 0);
 }
 
+async function testConcurrentChannelClose() {
+  const [channelA, channelB] = duplex();
+
+  const results = await Promise.allSettled([
+    channelA.close(),
+    channelB.close(),
+  ]);
+
+  assert.deepStrictEqual(results, [
+    { status: 'fulfilled', value: undefined },
+    { status: 'fulfilled', value: undefined },
+  ]);
+}
+
 async function testWithOptions() {
   const [channelA, channelB] = duplex({
     budget: 16384,
@@ -80,9 +98,9 @@ async function testWithOptions() {
   });
 
   await channelA.writer.write('msg');
-  await channelA.close();
-
+  const closing = channelA.close();
   const data = await text(channelB.readable);
+  await closing;
   assert.strictEqual(data, 'msg');
 }
 
@@ -95,15 +113,17 @@ async function testPerChannelOptions() {
   // Channel A -> B direction uses A's options
   // Channel B -> A direction uses B's options
   await channelA.writer.write('from-a');
-  await channelA.close();
-
   await channelB.writer.write('from-b');
-  await channelB.close();
+
+  const endA = channelA.writer.end();
+  const endB = channelB.writer.end();
 
   const [dataAtA, dataAtB] = await Promise.all([
     text(channelA.readable),
     text(channelB.readable),
   ]);
+  await Promise.all([endA, endB]);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtB, 'from-a');
   assert.strictEqual(dataAtA, 'from-b');
@@ -146,17 +166,39 @@ async function testWriterEndWithPreAbortedSignal() {
 async function testEmptyDuplex() {
   const [channelA, channelB] = duplex();
 
-  // Close without writing
-  await channelA.close();
-  await channelB.close();
+  await channelA.writer.end();
+  await channelB.writer.end();
 
   const dataAtA = await bytes(channelA.readable);
   const dataAtB = await bytes(channelB.readable);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtA.byteLength, 0);
   assert.strictEqual(dataAtB.byteLength, 0);
 }
 
+async function testCloseWaitsForDrain() {
+  const [channelA, channelB] = duplex();
+  await channelA.writer.write('buffered');
+
+  let closed = false;
+  const closing = channelA.close().then(common.mustCall(() => {
+    closed = true;
+  }));
+  await new Promise(setImmediate);
+  assert.strictEqual(closed, false);
+
+  assert.strictEqual(await text(channelB.readable), 'buffered');
+  await closing;
+}
+
+async function testClosePropagatesWriterFailure() {
+  const [channelA] = duplex();
+  const reason = new Error('writer failed');
+  channelA.writer.fail(reason);
+  await assert.rejects(channelA.close(), (error) => error === reason);
+}
+
 // Channel fail propagation
 async function testChannelFail() {
   const [a, b] = duplex();
@@ -195,11 +237,14 @@ Promise.all([
   testBidirectional(),
   testMultipleWrites(),
   testChannelClose(),
+  testConcurrentChannelClose(),
   testWithOptions(),
   testPerChannelOptions(),
   testAbortSignal(),
   testWriterEndWithPreAbortedSignal(),
   testEmptyDuplex(),
+  testCloseWaitsForDrain(),
+  testClosePropagatesWriterFailure(),
   testChannelFail(),
   testAbortSignalBothChannels(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-from-async.js b/test/parallel/test-stream-iter-from-async.js
index 5ef78088bfbd..a4726d633ef0 100644
--- a/test/parallel/test-stream-iter-from-async.js
+++ b/test/parallel/test-stream-iter-from-async.js
@@ -31,6 +31,30 @@ async function testFromAsyncGenerator() {
   assert.deepStrictEqual(batches[1][0], new Uint8Array([30, 40]));
 }
 
+async function testFromBoundsNestedAsyncIterable() {
+  let nestedClosed = false;
+  async function* nested() {
+    try {
+      let value = 0;
+      while (true) yield new Uint8Array([value++]);
+    } finally {
+      nestedClosed = true;
+    }
+  }
+
+  async function* source() {
+    yield nested();
+  }
+
+  const iterator = from(source())[Symbol.asyncIterator]();
+  const first = await iterator.next();
+  assert.strictEqual(first.done, false);
+  assert.strictEqual(first.value.length, 128);
+
+  await iterator.return();
+  assert.strictEqual(nestedClosed, true);
+}
+
 async function testFromSyncIterableAsAsync() {
   // Sync iterable passed to from() should work
   function* gen() {
@@ -235,6 +259,20 @@ async function testFromTopLevelProtocolOverIterator() {
   assert.strictEqual(result, 'from-protocol');
 }
 
+async function testFromHandlesProtocolRejectionUntilIteration() {
+  const reason = new Error('protocol failed');
+  const iterable = from({
+    [Symbol.for('Stream.toAsyncStreamable')]: common.mustCall(
+      () => Promise.reject(reason)),
+  });
+
+  await new Promise(setImmediate);
+  await assert.rejects(
+    iterable[Symbol.asyncIterator]().next(),
+    (error) => error === reason,
+  );
+}
+
 // DataView input should be converted to Uint8Array (zero-copy)
 async function testFromDataView() {
   const buf = new ArrayBuffer(5);
@@ -260,6 +298,7 @@ function testFromUndefinedThrows() {
 Promise.all([
   testFromString(),
   testFromAsyncGenerator(),
+  testFromBoundsNestedAsyncIterable(),
   testFromSyncIterableAsAsync(),
   testFromSyncIterableAwaitsPromiseValues(),
   testFromSyncIterableRejectsNestedAsyncIterable(),
@@ -279,5 +318,6 @@ Promise.all([
   testFromTopLevelToStreamable(),
   testFromTopLevelAsyncPrecedence(),
   testFromTopLevelProtocolOverIterator(),
+  testFromHandlesProtocolRejectionUntilIteration(),
   testFromDataView(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-pipeto-signal.js b/test/parallel/test-stream-iter-pipeto-signal.js
index ec1324a4e04b..be04c8c635df 100644
--- a/test/parallel/test-stream-iter-pipeto-signal.js
+++ b/test/parallel/test-stream-iter-pipeto-signal.js
@@ -9,6 +9,51 @@ const assert = require('assert');
 const { setTimeout } = require('timers/promises');
 const { pipeTo, from } = require('stream/iter');
 
+async function testPipeToPreAbortedSignalFailsWriter() {
+  const reason = new Error('already aborted');
+  let sourceTouched = false;
+  const source = {
+    [Symbol.asyncIterator]() {
+      sourceTouched = true;
+      return {};
+    },
+  };
+  const writer = {
+    write: common.mustNotCall(),
+    fail: common.mustCall((error) => assert.strictEqual(error, reason)),
+  };
+
+  await assert.rejects(
+    pipeTo(source, writer, { signal: AbortSignal.abort(reason) }),
+    (error) => error === reason,
+  );
+  assert.strictEqual(sourceTouched, false);
+}
+
+async function testPipeToPreAbortedSignalPreventFail() {
+  const reason = new Error('already aborted');
+  let sourceTouched = false;
+  const source = {
+    [Symbol.asyncIterator]() {
+      sourceTouched = true;
+      return {};
+    },
+  };
+  const writer = {
+    write: common.mustNotCall(),
+    fail: common.mustNotCall(),
+  };
+
+  await assert.rejects(
+    pipeTo(source, writer, {
+      signal: AbortSignal.abort(reason),
+      preventFail: true,
+    }),
+    (error) => error === reason,
+  );
+  assert.strictEqual(sourceTouched, false);
+}
+
 // pipeTo with live signal, no transforms — abort mid-stream
 async function testPipeToLiveSignalNoTransforms() {
   const ac = new AbortController();
@@ -116,6 +161,8 @@ async function testPipeToLiveSignalWithTransformsCompletes() {
 }
 
 Promise.all([
+  testPipeToPreAbortedSignalFailsWriter(),
+  testPipeToPreAbortedSignalPreventFail(),
   testPipeToLiveSignalNoTransforms(),
   testPipeToLiveSignalNoTransformsPendingNext(),
   testPipeToLiveSignalWithTransforms(),
diff --git a/test/parallel/test-stream-iter-pipeto.js b/test/parallel/test-stream-iter-pipeto.js
index 5d8b5088f540..0ccaf196a9cf 100644
--- a/test/parallel/test-stream-iter-pipeto.js
+++ b/test/parallel/test-stream-iter-pipeto.js
@@ -244,7 +244,7 @@ async function testPipeToSyncMinimalWriter() {
   assert.strictEqual(chunks.length > 0, true);
 }
 
-async function testPipeToSyncIterableFastPathWritesIncrementally() {
+async function testPipeToSyncIterableUsesFromBatching() {
   let pulled = 0;
   let firstWritePulled = 0;
   const chunks = [];
@@ -267,7 +267,7 @@ async function testPipeToSyncIterableFastPathWritesIncrementally() {
 
   const totalBytes = await pipeTo(source(), writer);
   assert.strictEqual(totalBytes, 3);
-  assert.strictEqual(firstWritePulled, 1);
+  assert.strictEqual(firstWritePulled, 3);
   assert.deepStrictEqual(chunks, [
     new Uint8Array([0x61]),
     new Uint8Array([0x62]),
@@ -275,7 +275,31 @@ async function testPipeToSyncIterableFastPathWritesIncrementally() {
   ]);
 }
 
-async function testPipeToSyncIterableFastPathWriteFallback() {
+async function testPipeToSourceNormalizationIndependentOfWriter() {
+  function source() {
+    return {
+      *[Symbol.iterator]() {
+        yield {
+          async *[Symbol.asyncIterator]() {
+            yield 'nested';
+          },
+        };
+      },
+    };
+  }
+
+  for (const hasWriteSync of [false, true]) {
+    const writer = { write: common.mustNotCall() };
+    if (hasWriteSync) writer.writeSync = common.mustNotCall();
+
+    await assert.rejects(
+      pipeTo(source(), writer, { preventClose: true, preventFail: true }),
+      { code: 'ERR_INVALID_ARG_TYPE' },
+    );
+  }
+}
+
+async function testPipeToSyncIterableWriteFallback() {
   const asyncWrites = [];
   const writer = {
     writeSync(chunk) {
@@ -296,7 +320,7 @@ async function testPipeToSyncIterableFastPathWriteFallback() {
   assert.deepStrictEqual(asyncWrites, [new Uint8Array([0x62])]);
 }
 
-async function testPipeToSyncIterableFastPathAsyncValue() {
+async function testPipeToSyncIterableAsyncValue() {
   const chunks = [];
   const writer = {
     write: common.mustNotCall(),
@@ -334,7 +358,8 @@ Promise.all([
   testPipeToSyncPreventClose(),
   testPipeToMinimalWriter(),
   testPipeToSyncMinimalWriter(),
-  testPipeToSyncIterableFastPathWritesIncrementally(),
-  testPipeToSyncIterableFastPathWriteFallback(),
-  testPipeToSyncIterableFastPathAsyncValue(),
+  testPipeToSyncIterableUsesFromBatching(),
+  testPipeToSyncIterableWriteFallback(),
+  testPipeToSyncIterableAsyncValue(),
+  testPipeToSourceNormalizationIndependentOfWriter(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-pull-async.js b/test/parallel/test-stream-iter-pull-async.js
index 3159b718f27e..c341cf296ddd 100644
--- a/test/parallel/test-stream-iter-pull-async.js
+++ b/test/parallel/test-stream-iter-pull-async.js
@@ -3,7 +3,16 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { pull, from, text, tap } = require('stream/iter');
+const {
+  broadcast,
+  from,
+  pull,
+  push,
+  share,
+  tap,
+  text,
+  toAsyncStreamable,
+} = require('stream/iter');
 
 async function testPullIdentity() {
   const data = await text(pull(from('hello-async')));
@@ -40,23 +49,72 @@ async function testPullStatefulTransform() {
   assert.strictEqual(data, 'data-ASYNC-END');
 }
 
+async function testPullStatefulTransformReceiver() {
+  const descriptor = {};
+  descriptor.transform = common.mustCall(
+    async function*(source) {
+      assert.strictEqual(this, descriptor);
+      for await (const chunks of source) {
+        yield chunks;
+      }
+    });
+
+  assert.strictEqual(await text(pull(from('receiver'), descriptor)), 'receiver');
+}
+
 async function testPullWithAbortSignal() {
   async function* gen() {
     yield [new Uint8Array([1])];
   }
 
-  const result = pull(gen(), { signal: AbortSignal.abort() });
-  await assert.rejects(
-    async () => {
-      // eslint-disable-next-line no-unused-vars
-      for await (const _ of result) {
-        assert.fail('Should not reach here');
-      }
-    },
+  assert.throws(
+    () => pull(gen(), { signal: AbortSignal.abort() }),
     { name: 'AbortError' },
   );
 }
 
+async function testPullNormalizesSourceAtCallTime() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return {
+        async *[Symbol.asyncIterator]() {
+          iteratorCalls++;
+          yield 'data';
+        },
+      };
+    },
+  };
+
+  const result = pull(source);
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+  assert.strictEqual(await text(result), 'data');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 1);
+}
+
+function testPullPreAbortOrdering() {
+  const reason = new Error('already aborted');
+  let protocolCalls = 0;
+  const source = {
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return from('data');
+    },
+  };
+  const signal = AbortSignal.abort(reason);
+
+  assert.throws(() => pull(source, { signal }), (error) => error === reason);
+  assert.strictEqual(protocolCalls, 1);
+  assert.throws(
+    () => pull(null, { signal }),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+}
+
 async function testPullChainedTransforms() {
   const enc = new TextEncoder();
   const transforms = [
@@ -170,6 +228,61 @@ async function testPullSignalAbortWhileSourceNextPending() {
   await assert.rejects(next, { name: 'AbortError' });
 }
 
+async function testPullReturnWhileSourceNextPending() {
+  let startNext;
+  const nextStarted = new Promise((resolve) => { startNext = resolve; });
+  const source = {
+    [Symbol.asyncIterator]() {
+      return {
+        next() {
+          startNext();
+          return new Promise(() => {});
+        },
+      };
+    },
+  };
+
+  const iter = pull(source)[Symbol.asyncIterator]();
+  const next = assert.rejects(iter.next(), { name: 'AbortError' });
+  await nextStarted;
+
+  const timeout = {};
+  const result = await Promise.race([
+    iter.return(),
+    new Promise((resolve) => setImmediate(resolve, timeout)),
+  ]);
+
+  assert.notStrictEqual(result, timeout);
+  assert.deepStrictEqual(result, { value: undefined, done: true });
+  await next;
+}
+
+async function testTransformedConsumerReturnBeforeNext() {
+  const identity = (chunks) => chunks;
+  const pushed = push(identity);
+  const { broadcast: bc } = broadcast();
+  const broadcastConsumer = bc.push(identity);
+  const shared = share(from('shared'));
+  const sharedConsumer = shared.pull(identity);
+
+  assert.strictEqual(bc.consumerCount, 1);
+  assert.strictEqual(shared.consumerCount, 1);
+
+  const cases = [
+    [pushed.readable, common.mustCall(
+      () => assert.strictEqual(pushed.writer.canWrite, null))],
+    [broadcastConsumer, common.mustCall(
+      () => assert.strictEqual(bc.consumerCount, 0))],
+    [sharedConsumer, common.mustCall(
+      () => assert.strictEqual(shared.consumerCount, 0))],
+  ];
+
+  for (const [readable, verify] of cases) {
+    await readable[Symbol.asyncIterator]().return();
+    verify();
+  }
+}
+
 async function testPullSignalAbortWithTransformWhileSourceNextPending() {
   const source = {
     [Symbol.asyncIterator]() {
@@ -411,12 +524,17 @@ async function testTransformOptionsNotShared() {
     testPullIdentity(),
     testPullStatelessTransform(),
     testPullStatefulTransform(),
+    testPullStatefulTransformReceiver(),
     testPullWithAbortSignal(),
+    testPullNormalizesSourceAtCallTime(),
+    testPullPreAbortOrdering(),
     testPullChainedTransforms(),
     testPullSourceError(),
     testTapCallbackError(),
     testPullSignalAbortMidIteration(),
     testPullSignalAbortWhileSourceNextPending(),
+    testPullReturnWhileSourceNextPending(),
+    testTransformedConsumerReturnBeforeNext(),
     testPullSignalAbortWithTransformWhileSourceNextPending(),
     testPullConsumerBreakCleanup(),
     testPullTransformReturnsPromise(),
diff --git a/test/parallel/test-stream-iter-pull-sync.js b/test/parallel/test-stream-iter-pull-sync.js
index c47a6b3f9233..af481dbfa137 100644
--- a/test/parallel/test-stream-iter-pull-sync.js
+++ b/test/parallel/test-stream-iter-pull-sync.js
@@ -3,7 +3,13 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { pullSync, fromSync, bytesSync, tapSync } = require('stream/iter');
+const {
+  pullSync,
+  fromSync,
+  bytesSync,
+  tapSync,
+  toStreamable,
+} = require('stream/iter');
 
 function testPullSyncIdentity() {
   // No transforms - just pass through
@@ -11,6 +17,30 @@ function testPullSyncIdentity() {
   assert.deepStrictEqual(data, new TextEncoder().encode('hello'));
 }
 
+function testPullSyncNormalizesSourceAtCallTime() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    [toStreamable]() {
+      protocolCalls++;
+      return {
+        *[Symbol.iterator]() {
+          iteratorCalls++;
+          yield 'data';
+        },
+      };
+    },
+  };
+
+  const result = pullSync(source);
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+  assert.strictEqual(new TextDecoder().decode(bytesSync(result)), 'data');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 1);
+  assert.throws(() => pullSync(null), { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
 function testPullSyncStatelessTransform() {
   const upper = (chunks) => {
     if (chunks === null) return null;
@@ -44,6 +74,20 @@ function testPullSyncStatefulTransform() {
   assert.strictEqual(data, 'data-END');
 }
 
+function testPullSyncStatefulTransformReceiver() {
+  const descriptor = {};
+  descriptor.transform = common.mustCall(
+    function*(source) {
+      assert.strictEqual(this, descriptor);
+      yield* source;
+    });
+
+  assert.strictEqual(
+    new TextDecoder().decode(bytesSync(pullSync(fromSync('receiver'), descriptor))),
+    'receiver',
+  );
+}
+
 function testPullSyncChainedTransforms() {
   const addExcl = (chunks) => {
     if (chunks === null) return null;
@@ -177,8 +221,10 @@ function testPullSyncInvalidTransform() {
 
 Promise.all([
   testPullSyncIdentity(),
+  testPullSyncNormalizesSourceAtCallTime(),
   testPullSyncStatelessTransform(),
   testPullSyncStatefulTransform(),
+  testPullSyncStatefulTransformReceiver(),
   testPullSyncChainedTransforms(),
   testPullSyncSourceError(),
   testPullSyncEmptySource(),
diff --git a/test/parallel/test-stream-iter-push-writer.js b/test/parallel/test-stream-iter-push-writer.js
index 8ce555ca9251..7f9c651614b9 100644
--- a/test/parallel/test-stream-iter-push-writer.js
+++ b/test/parallel/test-stream-iter-push-writer.js
@@ -294,6 +294,21 @@ async function testEndSignalAbortWhileDraining() {
   assert.strictEqual(await completedEnd, 5);
 }
 
+async function testFactorySignalAbortWhileDraining() {
+  const controller = new AbortController();
+  const reason = new Error('stream aborted while draining');
+  const { writer, readable } = push({ signal: controller.signal });
+
+  writer.writeSync('hello');
+  const end = writer.end();
+  const endRejected = assert.rejects(end, (error) => error === reason);
+  controller.abort(reason);
+
+  await endRejected;
+  await assert.rejects(text(readable), (error) => error === reason);
+  await assert.rejects(writer.end(), (error) => error === reason);
+}
+
 async function testEndAfterEndSyncWaitsForDrain() {
   const { writer, readable } = push();
   writer.writeSync('hello');
@@ -424,6 +439,20 @@ async function testConsumerReturnResolvesPendingRead() {
   assert.strictEqual(readResult.done, true);
 }
 
+async function testEndRejectsAfterConsumerReturn() {
+  const { writer, readable } = push();
+  writer.writeSync('data');
+  const iter = readable[Symbol.asyncIterator]();
+
+  await iter.return();
+
+  await assert.rejects(
+    writer.end({ signal: AbortSignal.timeout(common.platformTimeout(100)) }),
+    { code: 'ERR_INVALID_STATE' },
+  );
+  assert.strictEqual((await iter.next()).done, true);
+}
+
 // iterator.throw() rejects a pending read with the thrown error
 async function testConsumerThrowRejectsPendingRead() {
   const { readable } = push();
@@ -502,6 +531,23 @@ async function testAsyncDispose() {
   }
 }
 
+async function testAsyncDisposeWaitsAfterEndSync() {
+  const { writer, readable } = push({ budget: 16384 });
+  writer.writeSync('hello');
+  assert.strictEqual(writer.endSync(), -1);
+
+  let disposed = false;
+  const disposal = writer[Symbol.asyncDispose]().then(() => {
+    disposed = true;
+  });
+  await Promise.resolve();
+  assert.strictEqual(disposed, false);
+
+  assert.strictEqual(await text(readable), 'hello');
+  await disposal;
+  assert.strictEqual(disposed, true);
+}
+
 async function testSyncDispose() {
   const { writer, readable } = push({ budget: 16384 });
   writer.writeSync('hello');
@@ -589,6 +635,7 @@ Promise.all([
   testEndAsyncReturnValue(),
   testEndWithPreAbortedSignal(),
   testEndSignalAbortWhileDraining(),
+  testFactorySignalAbortWhileDraining(),
   testEndAfterEndSyncWaitsForDrain(),
   testWriteUint8Array(),
   testOndrainWaitsForDrain(),
@@ -599,10 +646,12 @@ Promise.all([
   testFailRejectsFutureReadWithFalsyReason(),
   testFailRejectsPendingReadWithFalsyReason(),
   testConsumerReturnResolvesPendingRead(),
+  testEndRejectsAfterConsumerReturn(),
   testConsumerThrowRejectsPendingRead(),
   testEndRejectsPendingWrites(),
   testEndIdempotentWhenClosed(),
   testEndRejectsWhenErrored(),
   testAsyncDispose(),
+  testAsyncDisposeWaitsAfterEndSync(),
   testSyncDispose(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-share-async.js b/test/parallel/test-stream-iter-share-async.js
index c96a0cb0f3c3..dafb157a7512 100644
--- a/test/parallel/test-stream-iter-share-async.js
+++ b/test/parallel/test-stream-iter-share-async.js
@@ -143,6 +143,70 @@ async function testShareCancelWithFalsyReason() {
   }
 }
 
+async function testShareCancelWhileSourcePullPending() {
+  const noReason = { __proto__: null };
+
+  for (const reason of [noReason, 0]) {
+    const sourceStarted = Promise.withResolvers();
+    const sourceNext = Promise.withResolvers();
+    let nextCalls = 0;
+    let returnCalls = 0;
+    const source = {
+      __proto__: null,
+      [Symbol.asyncIterator]() {
+        return {
+          __proto__: null,
+          next() {
+            nextCalls++;
+            sourceStarted.resolve();
+            return sourceNext.promise;
+          },
+          async return() {
+            returnCalls++;
+            return { __proto__: null, done: true, value: undefined };
+          },
+        };
+      },
+    };
+    const shared = share(source);
+    const iterator = shared.pull()[Symbol.asyncIterator]();
+    const read = iterator.next().then(
+      (value) => ({ __proto__: null, rejected: false, value }),
+      (error) => ({ __proto__: null, rejected: true, error }),
+    );
+
+    await sourceStarted.promise;
+    if (reason === noReason) {
+      shared.cancel();
+    } else {
+      shared.cancel(reason);
+    }
+
+    const timedOut = { __proto__: null };
+    const outcome = await Promise.race([
+      read,
+      new Promise((resolve) => setImmediate(resolve, timedOut)),
+    ]);
+    assert.notStrictEqual(outcome, timedOut);
+    if (reason === noReason) {
+      assert.strictEqual(outcome.rejected, false);
+      assert.strictEqual(outcome.value.done, true);
+    } else {
+      assert.strictEqual(outcome.rejected, true);
+      assert.strictEqual(outcome.error, reason);
+    }
+    assert.strictEqual(nextCalls, 1);
+
+    sourceNext.resolve({
+      __proto__: null,
+      done: false,
+      value: [Uint8Array.of(1)],
+    });
+    await new Promise(setImmediate);
+    assert.strictEqual(returnCalls, 1);
+  }
+}
+
 async function testShareAbortSignal() {
   const ac = new AbortController();
   const reason = new Error('share aborted');
@@ -272,6 +336,27 @@ async function testShareSourceError() {
   }, { message: 'share source boom' });
 }
 
+async function testShareSourceErrorFollowsBufferedData() {
+  const reason = new Error('share source boom');
+  async function* failingSource() {
+    yield [Uint8Array.of(1)];
+    throw reason;
+  }
+
+  const shared = share(failingSource());
+  const fast = shared.pull()[Symbol.asyncIterator]();
+  const slow = shared.pull()[Symbol.asyncIterator]();
+  const returned = shared.pull()[Symbol.asyncIterator]();
+  await returned.return();
+
+  assert.deepStrictEqual((await fast.next()).value, [Uint8Array.of(1)]);
+  await assert.rejects(fast.next(), (error) => error === reason);
+
+  assert.deepStrictEqual((await slow.next()).value, [Uint8Array.of(1)]);
+  await assert.rejects(slow.next(), (error) => error === reason);
+  assert.strictEqual((await returned.next()).done, true);
+}
+
 async function testShareLateJoiningConsumer() {
   // A consumer that joins after some data has been consumed should only
   // see data remaining in the buffer (not items already trimmed).
@@ -380,12 +465,14 @@ Promise.all([
   testShareCancelMidIteration(),
   testShareCancelWithReason(),
   testShareCancelWithFalsyReason(),
+  testShareCancelWhileSourcePullPending(),
   testShareAbortSignal(),
   testShareAbortSignalWhileSourcePullPending(),
   testSharePullAbortSignalRejectsPendingNext(),
   testSharePullPreAbortedSignalDoesNotAddConsumer(),
   testShareAlreadyAborted(),
   testShareSourceError(),
+  testShareSourceErrorFollowsBufferedData(),
   testShareLateJoiningConsumer(),
   testShareConsumerBreak(),
   testShareMultipleConsumersConcurrentPull(),
diff --git a/test/parallel/test-stream-iter-share-from.js b/test/parallel/test-stream-iter-share-from.js
index 806e30876302..69b782ce5608 100644
--- a/test/parallel/test-stream-iter-share-from.js
+++ b/test/parallel/test-stream-iter-share-from.js
@@ -221,23 +221,29 @@ async function testShareDropNewest() {
 // =============================================================================
 
 async function testShareStrictBackpressure() {
-  async function* source() {
-    for (let i = 0; i < 10; i++) {
-      yield [new Uint8Array(16384)];
+  for (const transformed of [false, true]) {
+    async function* source() {
+      for (let i = 0; i < 10; i++) {
+        yield [new Uint8Array(16384)];
+      }
     }
+    const shared = share(source(), {
+      budget: 32768,
+      backpressure: 'strict',
+    });
+    const consumer = transformed ?
+      shared.pull((chunks) => chunks) : shared.pull();
+    const fast = consumer[Symbol.asyncIterator]();
+    // This consumer prevents the buffer from being trimmed.
+    shared.pull();
+
+    await fast.next();
+    await fast.next();
+    await assert.rejects(fast.next(), { code: 'ERR_OUT_OF_RANGE' });
+    assert.strictEqual(shared.consumerCount, 1);
+    assert.strictEqual((await fast.next()).done, true);
+    shared.cancel();
   }
-  const shared = share(source(), { budget: 32768, backpressure: 'strict' });
-  const fast = shared.pull();
-  // Create a second consumer that never reads — this prevents buffer trimming
-  shared.pull();
-
-  // The fast consumer's pulls will eventually cause the buffer to exceed
-  // the budget (since the slow consumer prevents trimming),
-  // triggering an ERR_OUT_OF_RANGE error.
-  await assert.rejects(async () => {
-    // eslint-disable-next-line no-unused-vars
-    for await (const _ of fast) { /* consume */ }
-  }, { code: 'ERR_OUT_OF_RANGE' });
 }
 
 Promise.all([
diff --git a/test/parallel/test-stream-iter-transform-roundtrip.js b/test/parallel/test-stream-iter-transform-roundtrip.js
index df63483d6c85..a734b6c3132e 100644
--- a/test/parallel/test-stream-iter-transform-roundtrip.js
+++ b/test/parallel/test-stream-iter-transform-roundtrip.js
@@ -19,6 +19,7 @@ const {
   decompressBrotli,
   decompressZstd,
 } = require('zlib/iter');
+const zlib = require('zlib');
 
 // =============================================================================
 // Helper: compress then decompress, verify round-trip equality
@@ -42,6 +43,18 @@ async function testGzipRoundTrip() {
   assert.strictEqual(result, input);
 }
 
+async function testValidatedTransformReceiver() {
+  const descriptor = compressGzip();
+  const transform = descriptor.transform;
+  descriptor.transform = common.mustCall(function(source, options) {
+    assert.strictEqual(this, descriptor);
+    return Reflect.apply(transform, this, [source, options]);
+  });
+
+  const result = await bytes(pull(from('receiver'), descriptor));
+  assert.ok(result.byteLength > 0);
+}
+
 async function testGzipLargeData() {
   // 100KB of repeated text - exercises multi-chunk path
   const input = 'gzip large data test. '.repeat(5000);
@@ -131,6 +144,20 @@ async function testZstdActuallyCompresses() {
             `Compressed ${compressed.byteLength} should be < original ${inputBuf.byteLength}`);
 }
 
+async function testZstdConcatenatedFrames() {
+  const first = zlib.zstdCompressSync('a');
+  const second = zlib.zstdCompressSync('b');
+  const input = Buffer.concat([first, second]);
+  const result = await bytes(pull(from(input), decompressZstd()));
+  assert.strictEqual(Buffer.from(result).toString(), 'ab');
+
+  const withJunk = await bytes(pull(
+    from([first, Buffer.from('junk'), second]),
+    decompressZstd(),
+  ));
+  assert.strictEqual(Buffer.from(withJunk).toString(), 'a');
+}
+
 // =============================================================================
 // Binary data round-trip - verify no corruption on non-text data
 // =============================================================================
@@ -250,6 +277,7 @@ async function testGzipWithLevel() {
 (async () => {
   // Gzip
   await testGzipRoundTrip();
+  await testValidatedTransformReceiver();
   await testGzipLargeData();
   await testGzipActuallyCompresses();
 
@@ -267,6 +295,7 @@ async function testGzipWithLevel() {
   await testZstdRoundTrip();
   await testZstdLargeData();
   await testZstdActuallyCompresses();
+  await testZstdConcatenatedFrames();
 
   // Binary data
   await testBinaryRoundTripGzip();
diff --git a/test/parallel/test-stream-iter-transform-sync.js b/test/parallel/test-stream-iter-transform-sync.js
index d674c26cca10..991dba2748ed 100644
--- a/test/parallel/test-stream-iter-transform-sync.js
+++ b/test/parallel/test-stream-iter-transform-sync.js
@@ -19,6 +19,7 @@ const {
   decompressBrotliSync,
   decompressZstdSync,
 } = require('zlib/iter');
+const { zstdCompressSync } = require('zlib');
 
 // =============================================================================
 // Helper: sync compress then decompress, verify round-trip equality
@@ -118,6 +119,15 @@ function testZstdLargeData() {
   assert.strictEqual(result, input);
 }
 
+function testZstdConcatenatedFrames() {
+  const input = Buffer.concat([
+    zstdCompressSync('a'),
+    zstdCompressSync('b'),
+  ]);
+  const result = bytesSync(pullSync(fromSync(input), decompressZstdSync()));
+  assert.strictEqual(Buffer.from(result).toString(), 'ab');
+}
+
 // =============================================================================
 // Cross-algorithm: compress async-compatible, decompress sync (and vice versa)
 // The sync transforms should produce output compatible with the standard format
@@ -218,6 +228,7 @@ testBrotliRoundTrip();
 testBrotliLargeData();
 testZstdRoundTrip();
 testZstdLargeData();
+testZstdConcatenatedFrames();
 testGzipWithOptions();
 testBrotliWithOptions();
 testMixedStatelessAndStateful();
diff --git a/test/parallel/test-stream-iter-validation.js b/test/parallel/test-stream-iter-validation.js
index 8dcfb46f173f..b93e6575490f 100644
--- a/test/parallel/test-stream-iter-validation.js
+++ b/test/parallel/test-stream-iter-validation.js
@@ -99,16 +99,16 @@ assert.throws(() => duplex({ budget: 0 }), { code: 'ERR_OUT_OF_RANGE' });
   const [a, b] = duplex({ budget: Number.MAX_SAFE_INTEGER });
   assert.strictEqual(a.writer.canWrite, true);
   assert.strictEqual(b.writer.canWrite, true);
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 // Per-direction overrides
 {
   const [a, b] = duplex({ a: { budget: 16384 }, b: { budget: 32768 } });
   assert.strictEqual(a.writer.canWrite, true);
   assert.strictEqual(b.writer.canWrite, true);
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 
 assert.throws(() => duplex({ signal: {} }), { code: 'ERR_INVALID_ARG_TYPE' });
@@ -397,8 +397,8 @@ async function testAsyncValidation() {
 // Duplex with valid options
 {
   const [a, b] = duplex({ budget: 16384 });
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 
 // Broadcast with valid options
diff --git a/test/parallel/test-stream-pipeline-http2.js b/test/parallel/test-stream-pipeline-http2.js
index 8ffee7786838..0b26c95b3a4e 100644
--- a/test/parallel/test-stream-pipeline-http2.js
+++ b/test/parallel/test-stream-pipeline-http2.js
@@ -30,8 +30,7 @@ const http2 = require('http2');
     let received = 0;
     req.on('data', (data) => {
       received += data.length;
-      // Bound the data that flows before teardown - bytes per data event vary
-      // by platform, and letting this run longer hangs on macOS.
+      // Use a byte threshold because data event chunking varies by platform.
       if (received >= 32 * 1024) rs.destroy();
     });
   }));
diff --git a/test/parallel/test-stream-pipeline.js b/test/parallel/test-stream-pipeline.js
index 7b4052f2b47d..4e7ff2f8c79d 100644
--- a/test/parallel/test-stream-pipeline.js
+++ b/test/parallel/test-stream-pipeline.js
@@ -243,12 +243,12 @@ tmpdir.refresh();
     pipeline(rs, res, () => {});
   }));
 
-  let cnt = 10;
+  let received = 0;
 
   const badSink = new Writable({
     write(data, enc, cb) {
-      cnt--;
-      if (cnt === 0) cb(new Error('kaboom'));
+      received += data.length;
+      if (received >= 50) cb(new Error('kaboom'));
       else cb();
     }
   });
diff --git a/test/parallel/test-stream-readable-next-no-null.js b/test/parallel/test-stream-readable-next-no-null.js
index 7599e386ca70..b3348c2b9794 100644
--- a/test/parallel/test-stream-readable-next-no-null.js
+++ b/test/parallel/test-stream-readable-next-no-null.js
@@ -1,19 +1,87 @@
 'use strict';
-const { mustNotCall, expectsError } = require('../common');
+const common = require('../common');
+const assert = require('assert');
 const { Readable } = require('stream');
+const { finished } = require('stream/promises');
 
-async function* generate() {
-  yield null;
-}
-
-const stream = Readable.from(generate());
-
-stream.on('error', expectsError({
+const expectedError = {
   code: 'ERR_STREAM_NULL_VALUES',
   name: 'TypeError',
   message: 'May not write null values to stream'
-}));
+};
+
+async function rejectsNull(iterable, expectedChunks = []) {
+  const stream = Readable.from(iterable);
+  const chunks = [];
+  const completion = finished(stream);
+
+  stream.on('data', (chunk) => chunks.push(chunk));
+
+  await assert.rejects(completion, expectedError);
+  assert.deepStrictEqual(chunks, expectedChunks);
+  assert.strictEqual(stream.destroyed, true);
+}
+
+async function asyncIteratorYieldsNull() {
+  const cleanup = common.mustCall();
+
+  async function* generate() {
+    try {
+      yield null;
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate());
+}
 
-stream.on('data', mustNotCall());
+async function syncIteratorYieldsNull() {
+  const cleanup = common.mustCall();
+
+  function* generate() {
+    try {
+      yield null;
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate());
+}
+
+async function firstSyncValueResolvesToNull() {
+  const cleanup = common.mustCall();
+
+  function* generate() {
+    try {
+      yield Promise.resolve(null);
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate());
+}
+
+async function laterSyncValueResolvesToNull() {
+  const cleanup = common.mustCall();
+
+  function* generate() {
+    try {
+      yield Promise.resolve('first');
+      yield Promise.resolve(null);
+    } finally {
+      cleanup();
+    }
+  }
+
+  await rejectsNull(generate(), ['first']);
+}
 
-stream.on('end', mustNotCall());
+Promise.all([
+  asyncIteratorYieldsNull(),
+  syncIteratorYieldsNull(),
+  firstSyncValueResolvesToNull(),
+  laterSyncValueResolvesToNull(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-readable-to-web-termination.js b/test/parallel/test-stream-readable-to-web-termination.js
index f30cf721e14c..8a15fa3f5fdb 100644
--- a/test/parallel/test-stream-readable-to-web-termination.js
+++ b/test/parallel/test-stream-readable-to-web-termination.js
@@ -42,3 +42,25 @@ const { setTimeout: delay } = require('timers/promises');
     assert.deepStrictEqual(closeResult, { value: undefined, done: true });
   })().then(common.mustCall());
 }
+
+// Cancelling a web ReadableStream while the underlying Readable is actively
+// producing data should not throw ERR_INVALID_STATE. The 'data' handler in
+// newReadableStreamFromStreamReadable must check wasCanceled before calling
+// controller.enqueue(). See: https://github.com/nodejs/node/issues/54205
+{
+  const readable = new Readable({
+    read() {
+      this.push(Buffer.alloc(1024));
+    },
+  });
+
+  const webStream = Readable.toWeb(readable);
+  const reader = webStream.getReader();
+
+  (async () => {
+    await reader.read();
+    await reader.read();
+    reader.releaseLock();
+    await webStream.cancel();
+  })().then(common.mustCall());
+}
diff --git a/test/parallel/test-stream-readable-unobserved-eof-readable.js b/test/parallel/test-stream-readable-unobserved-eof-readable.js
new file mode 100644
index 000000000000..5eb6d1b2b631
--- /dev/null
+++ b/test/parallel/test-stream-readable-unobserved-eof-readable.js
@@ -0,0 +1,76 @@
+'use strict';
+const common = require('../common');
+const { Readable } = require('stream');
+const assert = require('assert');
+
+// When a stream reaches its end while nobody is observing it, the
+// end-of-stream 'readable' emission is not scheduled. It is emitted
+// later if a 'readable' listener is attached, and read()/resume()
+// still reach 'end' on their own.
+
+{
+  // Listener attached synchronously after push(null) gets 'readable'
+  // and then 'end'.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  let readableEmitted = false;
+  r.on('readable', common.mustCall(() => {
+    readableEmitted = true;
+    assert.strictEqual(r.read(), null);
+  }));
+  r.on('end', common.mustCall(() => {
+    assert.strictEqual(readableEmitted, true);
+  }));
+}
+
+{
+  // Listener attached one macrotask after the unobserved end still gets
+  // the owed 'readable' before 'end'.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    let readableEmitted = false;
+    r.on('readable', common.mustCall(() => {
+      readableEmitted = true;
+      assert.strictEqual(r.read(), null);
+    }));
+    r.on('end', common.mustCall(() => {
+      assert.strictEqual(readableEmitted, true);
+    }));
+  }));
+}
+
+{
+  // A stream that ends unobserved still emits 'end' when resumed later.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    r.resume();
+    r.on('end', common.mustCall());
+  }));
+}
+
+{
+  // read() after an unobserved end consumes the owed notification: a
+  // 'readable' listener attached afterwards does not receive it, but
+  // 'end' is still emitted.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    assert.strictEqual(r.read(), null);
+    r.on('end', common.mustCall());
+  }));
+}
+
+{
+  // A 'data' listener attached after an unobserved end still gets 'end'.
+  const r = new Readable({ read() {} });
+  r.push('x');
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    r.on('data', common.mustCall((chunk) => {
+      assert.strictEqual(chunk.toString(), 'x');
+    }));
+    r.on('end', common.mustCall());
+  }));
+}
diff --git a/test/parallel/test-tick-processor-arguments.js b/test/parallel/test-tick-processor-arguments.js
index 406b13b676d7..a2d99192f979 100644
--- a/test/parallel/test-tick-processor-arguments.js
+++ b/test/parallel/test-tick-processor-arguments.js
@@ -19,6 +19,17 @@ const files = fs.readdirSync(tmpdir.path);
 const logfile = files.find((name) => /\.log$/.test(name));
 assert(logfile);
 
+// Drop the shared-library entries: the tick processor resolves the C++
+// symbols of every listed library through nm (and c++filt on macOS), which is
+// slow on builds that link many shared libraries and depends on the host
+// toolchain. This test only checks that CLI arguments reach the tick
+// processor; C++ symbol resolution is covered by test/tick-processor.
+const logpath = tmpdir.resolve(logfile);
+fs.writeFileSync(logpath, fs.readFileSync(logpath, 'utf8')
+  .split('\n')
+  .filter((line) => !line.startsWith('shared-library,'))
+  .join('\n'));
+
 // Make sure that the --preprocess argument is passed through correctly,
 // as an example flag listed in deps/v8/tools/tickprocessor.js.
 // Any of the other flags there should work for this test too, if --preprocess
diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
index c319e766ce8a..1b80571e70e6 100644
--- a/test/parallel/test-tls-alert-handling.js
+++ b/test/parallel/test-tls-alert-handling.js
@@ -6,7 +6,8 @@ if (!common.hasCrypto) {
 }
 
 const {
-  hasOpenSSL3,
+  hasOpenSSL,
+  isBoringSSL,
 } = require('../common/crypto');
 
 const assert = require('assert');
@@ -38,7 +39,7 @@ const errorHandler = common.mustCall((err) => {
   assert.match(err.code,
                /ERR_SSL_(WRONG_VERSION_NUMBER|PACKET_LENGTH_TOO_LONG|BAD_RECORD_TYPE)/);
   assert.strictEqual(err.library, 'SSL routines');
-  if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
+  if (!hasOpenSSL(3) && !isBoringSSL)
     assert.strictEqual(err.function, 'ssl3_get_record');
   assert.match(err.reason,
                /wrong[\s_]version[\s_]number|packet[\s_]length[\s_]too[\s_]long|bad[\s_]record[\s_]type/i);
@@ -99,7 +100,7 @@ function sendBADTLSRecord() {
     assert.match(err.code,
                  /ERR_SSL_(TLSV1_ALERT_PROTOCOL_VERSION|TLSV1_ALERT_RECORD_OVERFLOW|(SSL\/)?TLS_ALERT_UNEXPECTED_MESSAGE)/);
     assert.strictEqual(err.library, 'SSL routines');
-    if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
+    if (!hasOpenSSL(3) && !isBoringSSL)
       assert.strictEqual(err.function, 'ssl3_read_bytes');
     assert.match(err.reason,
                  /tlsv1[\s_]alert[\s_]protocol[\s_]version|tlsv1[\s_]alert[\s_]record[\s_]overflow|(ssl\/)?tls[\s_]alert[\s_]unexpected[\s_]message/i);
diff --git a/test/parallel/test-tls-alert.js b/test/parallel/test-tls-alert.js
index 64b7080e39ba..5c229d7e05cd 100644
--- a/test/parallel/test-tls-alert.js
+++ b/test/parallel/test-tls-alert.js
@@ -27,7 +27,9 @@ if (!common.hasCrypto) {
 
 const {
   hasOpenSSL,
+  hasFIPS,
   opensslCli,
+  isBoringSSL,
 } = require('../common/crypto');
 
 if (!opensslCli) {
@@ -43,12 +45,19 @@ function loadPEM(n) {
   return fixtures.readKey(`${n}.pem`);
 }
 
-const server = tls.Server({
-  secureProtocol: 'TLSv1_2_server_method',
+const serverOptions = {
   key: loadPEM('agent2-key'),
-  cert: loadPEM('agent2-cert')
-}, null).listen(0, common.mustCall(() => {
-  if (process.features.openssl_is_boringssl) {
+  cert: loadPEM('agent2-cert'),
+};
+if (hasFIPS(3)) {
+  serverOptions.minVersion = 'TLSv1.3';
+  serverOptions.maxVersion = 'TLSv1.3';
+} else {
+  serverOptions.secureProtocol = 'TLSv1_2_server_method';
+}
+
+const server = tls.Server(serverOptions, null).listen(0, common.mustCall(() => {
+  if (isBoringSSL) {
     let gotClientError = false;
     let gotServerError = false;
     function maybeClose() {
@@ -75,8 +84,9 @@ const server = tls.Server({
     return;
   }
 
-  const args = ['s_client', '-quiet', '-tls1_1',
-                '-cipher', (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+  const args = ['s_client', '-quiet', hasFIPS(3) ? '-tls1_2' : '-tls1_1',
+                '-cipher', hasFIPS(3) ? 'DEFAULT' :
+                  (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
                 '-connect', `127.0.0.1:${server.address().port}`];
 
   execFile(opensslCli, args, common.mustCall((err, _, stderr) => {
diff --git a/test/parallel/test-tls-alpn-callback-sync-end-newsession.js b/test/parallel/test-tls-alpn-callback-sync-end-newsession.js
new file mode 100644
index 000000000000..6e20e4d112ab
--- /dev/null
+++ b/test/parallel/test-tls-alpn-callback-sync-end-newsession.js
@@ -0,0 +1,56 @@
+'use strict';
+
+// A shutdown deferred off the SSL library's stack must not run while the
+// 'newSession' callback is still outstanding. Make sure it's deferred
+// correctly so the connection still cleanly closes.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const tls = require('tls');
+const { SSL_OP_NO_TICKET } = require('crypto').constants;
+
+const server = tls.createServer({
+  key: fixtures.readKey('agent1-key.pem'),
+  cert: fixtures.readKey('agent1-cert.pem'),
+  // The only config that consistently fires newSession on both OpenSSL &
+  // BoringSSL is TLS v1.2 + session id resumption (tickets disabled):
+  minVersion: 'TLSv1.2',
+  maxVersion: 'TLSv1.2',
+  secureOptions: SSL_OP_NO_TICKET,
+  ALPNCallback: common.mustCall(function({ protocols }) {
+    this.end();
+    return protocols[0];
+  }),
+});
+
+// Answering asynchronously holds EncOut() while the shutdown is replayed.
+server.on('newSession', common.mustCall((id, data, callback) => {
+  setImmediate(callback);
+}));
+
+server.on('tlsClientError', common.mustNotCall());
+server.on('secureConnection', common.mustCall((socket) => {
+  socket.on('error', common.mustNotCall());
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = tls.connect({
+    port: server.address().port,
+    ALPNProtocols: ['a'],
+    rejectUnauthorized: false,
+  }, common.mustCall(() => {
+    assert.strictEqual(client.alpnProtocol, 'a');
+  }));
+
+  client.on('end', common.mustCall());
+  client.on('close', common.mustCall((hadError) => {
+    assert.strictEqual(hadError, false);
+    server.close();
+  }));
+  client.on('error', common.mustNotCall());
+}));
diff --git a/test/parallel/test-tls-alpn-callback-sync-end.js b/test/parallel/test-tls-alpn-callback-sync-end.js
new file mode 100644
index 000000000000..96c639983901
--- /dev/null
+++ b/test/parallel/test-tls-alpn-callback-sync-end.js
@@ -0,0 +1,53 @@
+'use strict';
+
+// Ending a server TLSSocket synchronously from inside an ALPNCallback must
+// finish the handshake and then shut the connection down cleanly, rather than
+// dropping the underlying socket part way through it.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const tls = require('tls');
+
+function test(maxVersion) {
+  const server = tls.createServer({
+    key: fixtures.readKey('agent1-key.pem'),
+    cert: fixtures.readKey('agent1-cert.pem'),
+    maxVersion,
+    ALPNCallback: common.mustCall(function({ protocols }) {
+      this.end();
+      return protocols[0];
+    }),
+  });
+
+  server.on('tlsClientError', common.mustNotCall());
+  server.on('secureConnection', common.mustCall((socket) => {
+    socket.on('error', common.mustNotCall());
+  }));
+
+  server.listen(0, common.mustCall(() => {
+    const client = tls.connect({
+      port: server.address().port,
+      ALPNProtocols: ['a'],
+      rejectUnauthorized: false,
+      maxVersion,
+    }, common.mustCall(() => {
+      assert.strictEqual(client.alpnProtocol, 'a');
+    }));
+
+    // A clean close_notify, not a truncated connection.
+    client.on('end', common.mustCall());
+    client.on('close', common.mustCall((hadError) => {
+      assert.strictEqual(hadError, false);
+      server.close();
+    }));
+    client.on('error', common.mustNotCall());
+  }));
+}
+
+test('TLSv1.2');
+test('TLSv1.3');
diff --git a/test/parallel/test-tls-alpn-callback-sync-write.js b/test/parallel/test-tls-alpn-callback-sync-write.js
new file mode 100644
index 000000000000..d7e2d9098c44
--- /dev/null
+++ b/test/parallel/test-tls-alpn-callback-sync-write.js
@@ -0,0 +1,49 @@
+'use strict';
+
+// Writing to a server TLSSocket synchronously from inside an ALPNCallback,
+// which the TLS library invokes on its own stack mid-handshake, must not break
+// the connection; the data must be delivered once the handshake ends.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const tls = require('tls');
+
+const server = tls.createServer({
+  key: fixtures.readKey('agent1-key.pem'),
+  cert: fixtures.readKey('agent1-cert.pem'),
+  ALPNCallback: common.mustCall(function({ protocols }) {
+    // The write cannot complete until the handshake does, but it must be
+    // accepted and eventually flushed rather than dropped or encrypted into
+    // the middle of the handshake.
+    this.write('from-mid-handshake', common.mustCall());
+    return protocols[0];
+  }),
+});
+
+server.on('tlsClientError', common.mustNotCall());
+server.on('secureConnection', common.mustCall((socket) => {
+  assert.strictEqual(socket.alpnProtocol, 'a');
+  socket.on('error', common.mustNotCall());
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = tls.connect({
+    port: server.address().port,
+    ALPNProtocols: ['a', 'b'],
+    rejectUnauthorized: false,
+  }, common.mustCall(() => {
+    assert.strictEqual(client.alpnProtocol, 'a');
+
+    client.on('data', common.mustCall((data) => {
+      assert.strictEqual(data.toString(), 'from-mid-handshake');
+      client.end();
+      server.close();
+    }));
+  }));
+  client.on('error', common.mustNotCall());
+}));
diff --git a/test/parallel/test-tls-cert-ext-encoding.js b/test/parallel/test-tls-cert-ext-encoding.js
index 154e0cdcf022..973e9fad32ee 100644
--- a/test/parallel/test-tls-cert-ext-encoding.js
+++ b/test/parallel/test-tls-cert-ext-encoding.js
@@ -3,9 +3,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (hasOpenSSL3)
+if (hasOpenSSL(3))
   // TODO(danbev) This test fails with the following error:
   // error:0D00008F:asn1 encoding routines::no matching choice type
   //
diff --git a/test/parallel/test-tls-certcb-sync-write.js b/test/parallel/test-tls-certcb-sync-write.js
new file mode 100644
index 000000000000..caf591d669f4
--- /dev/null
+++ b/test/parallel/test-tls-certcb-sync-write.js
@@ -0,0 +1,49 @@
+'use strict';
+
+// Writing to a server TLSSocket synchronously from inside an SNICallback,
+// while the handshake is still waiting on the certificate callback, must not
+// break the connection; the data must be delivered once the handshake ends.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const net = require('net');
+const tls = require('tls');
+
+const secureContext = tls.createSecureContext({
+  key: fixtures.readKey('rsa_private.pem'),
+  cert: fixtures.readKey('rsa_cert.crt'),
+});
+
+let serverSocket;
+const server = net.createServer(common.mustCall((raw) => {
+  serverSocket = new tls.TLSSocket(raw, {
+    isServer: true,
+    secureContext,
+    SNICallback: common.mustCall((servername, callback) => {
+      assert.strictEqual(servername, 'localhost');
+      serverSocket.write('from-mid-handshake');
+      callback(null, null);
+    }),
+  });
+  serverSocket.on('error', common.mustNotCall());
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = tls.connect({
+    port: server.address().port,
+    servername: 'localhost',
+    rejectUnauthorized: false,
+  }, common.mustCall(() => {
+    client.on('data', common.mustCall((data) => {
+      assert.strictEqual(data.toString(), 'from-mid-handshake');
+      client.end();
+      server.close();
+    }));
+  }));
+  client.on('error', common.mustNotCall());
+}));
diff --git a/test/parallel/test-tls-client-auth.js b/test/parallel/test-tls-client-auth.js
index 517054c6e290..da06156e2e07 100644
--- a/test/parallel/test-tls-client-auth.js
+++ b/test/parallel/test-tls-client-auth.js
@@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const {
   assert, connect, keys, tls
@@ -111,7 +111,7 @@ if (tls.DEFAULT_MAX_VERSION === 'TLSv1.3') connect({
   // and sends a fatal Alert to the client that the client discovers there has
   // been a fatal error.
   pair.client.conn.once('error', common.mustCall((err) => {
-    const expectedErr = process.features.openssl_is_boringssl ?
+    const expectedErr = isBoringSSL ?
       'ERR_SSL_TLSV1_ALERT_CERTIFICATE_REQUIRED' :
       'ERR_SSL_TLSV13_ALERT_CERTIFICATE_REQUIRED';
     assert.strictEqual(err.code, expectedErr);
diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js
index 82572c4e4975..f1c179db8fae 100644
--- a/test/parallel/test-tls-client-getephemeralkeyinfo.js
+++ b/test/parallel/test-tls-client-getephemeralkeyinfo.js
@@ -3,13 +3,18 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+const {
+  isBoringSSL,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testEphemeralKeyInfo();
   return;
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { X509Certificate } = require('crypto');
@@ -17,12 +22,14 @@ const tls = require('tls');
 
 const key = fixtures.readKey('agent2-key.pem');
 const cert = fixtures.readKey('agent2-cert.pem');
+const fips3 = hasFIPS(3);
+const rejectsXCurves = hasFIPS(3, 5);
 
 function loadDHParam(n) {
   return fixtures.readKey(`dh${n}.pem`);
 }
 
-function test(size, type, name, cipher) {
+function test(size, type, name, cipher, expectError = false) {
   assert(cipher);
 
   const options = {
@@ -49,39 +56,62 @@ function test(size, type, name, cipher) {
     }
   }
 
-  const server = tls.createServer(options, common.mustCall((conn) => {
-    assert.strictEqual(conn.getEphemeralKeyInfo(), null);
-    conn.end();
-  }));
+  if (rejectsXCurves && (name === 'X25519' || name === 'X448')) {
+    assert.throws(() => tls.createServer(options), {
+      code: 'ERR_CRYPTO_OPERATION_FAILED',
+    });
+    return;
+  }
+
+  const onConnection = expectError ? common.mustNotCall() :
+    common.mustCall((conn) => {
+      assert.strictEqual(conn.getEphemeralKeyInfo(), null);
+      conn.end();
+    });
+  const server = tls.createServer(options, onConnection);
 
   server.on('close', common.mustSucceed());
 
   server.listen(0, common.mustCall(() => {
+    const onSecureConnect = expectError ? common.mustNotCall() :
+      common.mustCall(function() {
+        const ekeyinfo = client.getEphemeralKeyInfo();
+        assert.strictEqual(ekeyinfo.type, type);
+        assert.strictEqual(ekeyinfo.size, size);
+        assert.strictEqual(ekeyinfo.name, name);
+        server.close();
+      });
     const client = tls.connect({
       port: server.address().port,
       rejectUnauthorized: false
-    }, common.mustCall(function() {
-      const ekeyinfo = client.getEphemeralKeyInfo();
-      assert.strictEqual(ekeyinfo.type, type);
-      assert.strictEqual(ekeyinfo.size, size);
-      assert.strictEqual(ekeyinfo.name, name);
-      server.close();
-    }));
-    client.on('secureConnect', common.mustCall());
+    }, onSecureConnect);
+    if (expectError) {
+      client.on('error', common.mustCall((err) => {
+        assert.strictEqual(err.code, 'ERR_SSL_BAD_DH_VALUE');
+        server.close();
+      }));
+    } else {
+      client.on('secureConnect', common.mustCall());
+    }
   }));
 }
 
-test(undefined, undefined, undefined, 'AES256-SHA256');
+if (!fips3)
+  test(undefined, undefined, undefined, 'AES256-SHA256');
 test('auto', 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
-if (hasOpenSSL(4, 0)) {
-  // OpenSSL 4.0 implements RFC 7919 FFDHE negotiation for TLS 1.2 and
-  // always selects FFDHE-2048 regardless of the server-supplied dhparam.
-} else if (!hasOpenSSL(3, 2)) {
-  test(1024, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
+if (fips3 && !hasOpenSSL(4)) {
+  test(2048, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384', true);
 } else {
-  test(3072, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
+  if (hasOpenSSL(4, 0)) {
+    // OpenSSL 4.0 implements RFC 7919 FFDHE negotiation for TLS 1.2 and
+    // always selects FFDHE-2048 regardless of the server-supplied dhparam.
+  } else if (!hasOpenSSL(3, 2)) {
+    test(1024, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
+  } else {
+    test(3072, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
+  }
+  test(2048, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
 }
-test(2048, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
 test(256, 'ECDH', 'prime256v1', 'ECDHE-RSA-AES256-GCM-SHA384');
 test(521, 'ECDH', 'secp521r1', 'ECDHE-RSA-AES256-GCM-SHA384');
 test(253, 'ECDH', 'X25519', 'ECDHE-RSA-AES256-GCM-SHA384');
@@ -96,6 +126,17 @@ function testTLS13Group(size, type, name) {
     maxVersion: 'TLSv1.3',
   };
 
+  const unsupportedFipsGroup =
+    (rejectsXCurves && name === 'X25519') ||
+    (hasFIPS(4) &&
+     (name === 'curveSM2' || name === 'curveSM2MLKEM768'));
+  if (unsupportedFipsGroup) {
+    assert.throws(() => tls.createServer(options), {
+      code: 'ERR_CRYPTO_OPERATION_FAILED',
+    });
+    return;
+  }
+
   const server = tls.createServer(options, common.mustCall((conn) => {
     assert.strictEqual(conn.getEphemeralKeyInfo(), null);
     conn.end();
@@ -121,6 +162,8 @@ function testTLS13Group(size, type, name) {
   }));
 }
 
+if (fips3)
+  testTLS13Group(256, 'ECDH', 'prime256v1');
 testTLS13Group(253, 'ECDH', 'X25519');
 
 if (hasOpenSSL(3, 5)) {
diff --git a/test/parallel/test-tls-client-hello-fragmented.js b/test/parallel/test-tls-client-hello-fragmented.js
new file mode 100644
index 000000000000..690482e73dc5
--- /dev/null
+++ b/test/parallel/test-tls-client-hello-fragmented.js
@@ -0,0 +1,75 @@
+'use strict';
+
+// A ClientHello split across several TLS records must still emit
+// 'resumeSession'.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const net = require('net');
+const tls = require('tls');
+
+const options = {
+  key: fixtures.readKey('rsa_private.pem'),
+  cert: fixtures.readKey('rsa_cert.crt'),
+};
+
+// Capture a real ClientHello record so the replayed bytes are well-formed.
+function captureClientHello(callback) {
+  let hello = Buffer.alloc(0);
+  const collector = net.createServer((socket) => {
+    socket.on('data', (chunk) => {
+      hello = Buffer.concat([hello, chunk]);
+      if (hello.length < 5 || hello.length < 5 + hello.readUInt16BE(3)) return;
+      socket.destroy();
+      collector.close(() => callback(hello));
+    });
+  });
+  collector.listen(0, common.mustCall(() => {
+    tls.connect({ port: collector.address().port, rejectUnauthorized: false })
+      .on('error', () => {});
+  }));
+}
+
+captureClientHello(common.mustCall((hello) => {
+  assert.strictEqual(hello[0], 22);
+
+  // Split partway through the fixed-size header, before the session ID.
+  const body = hello.subarray(5);
+  const split = 20;
+  assert.ok(body.length > split);
+
+  const record = (payload) => Buffer.concat([
+    Buffer.from([22, hello[1], hello[2],
+                 payload.length >> 8, payload.length & 0xff]),
+    payload,
+  ]);
+
+  const server = tls.createServer(options);
+  server.on('tlsClientError', () => {});  // The replay never completes.
+
+  server.listen(0, common.mustCall(() => {
+    const client = net.connect(server.address().port, common.mustCall(() => {
+      client.write(record(body.subarray(0, split)));
+      setTimeout(() => client.write(record(body.subarray(split))), 10);
+    }));
+    client.on('error', () => {});
+
+    // Fail fast: a missing event stalls the handshake rather than erroring.
+    const guard = setTimeout(() => {
+      throw new Error('resumeSession was not emitted');
+    }, common.platformTimeout(10000));
+
+    server.on('resumeSession', common.mustCall((id, callback) => {
+      clearTimeout(guard);
+      assert.ok(id.length > 0);
+      callback(null, null);
+      client.destroy();
+      server.close();
+    }));
+  }));
+}));
diff --git a/test/parallel/test-tls-client-mindhsize.js b/test/parallel/test-tls-client-mindhsize.js
index d777a9bfa97f..f08be448dd19 100644
--- a/test/parallel/test-tls-client-mindhsize.js
+++ b/test/parallel/test-tls-client-mindhsize.js
@@ -13,7 +13,9 @@ const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const fips3 = hasFIPS(3);
+const fips4 = hasFIPS(4);
 
 const key = fixtures.readKey('agent2-key.pem');
 const cert = fixtures.readKey('agent2-cert.pem');
@@ -29,7 +31,7 @@ function test(size, err, next, minDHSizeOverride) {
   const options = {
     key: key,
     cert: cert,
-    dhparam: loadDHParam(size),
+    dhparam: size === 'auto' ? 'auto' : loadDHParam(size),
     ciphers: 'DHE-RSA-AES128-GCM-SHA256'
   };
 
@@ -60,7 +62,8 @@ function test(size, err, next, minDHSizeOverride) {
     if (err) {
       client.on('error', common.mustCall((e) => {
         nerror++;
-        assert.strictEqual(e.code, 'ERR_TLS_DH_PARAM_SIZE');
+        assert.strictEqual(e.code, fips3 && !fips4 ?
+          'ERR_SSL_BAD_DH_VALUE' : 'ERR_TLS_DH_PARAM_SIZE');
         server.close();
       }));
     }
@@ -85,8 +88,12 @@ function testDHE3072() {
   test(3072, false, null);
 }
 
-if (!process.features.openssl_is_boringssl) {
-  if (hasOpenSSL(4, 0)) {
+if (!isBoringSSL) {
+  if (fips3 && !fips4) {
+    // The FIPS provider rejects explicit DH parameters without a validated
+    // subgroup, while OpenSSL's built-in FFDHE group remains available.
+    testDHE2048(true, () => test('auto', false, null, 2048));
+  } else if (hasOpenSSL(4, 0)) {
     // OpenSSL 4.0 implements RFC 7919 FFDHE negotiation for TLS 1.2 and
     // ignores the server-supplied dhparam in favor of FFDHE-2048. The 3072
     // success case is therefore replaced by a 2048 success case.
@@ -122,7 +129,7 @@ for (const minDHSize of [true, false, null, undefined, {}, [], '', '1']) {
   });
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   process.on('exit', function() {
     assert.strictEqual(nsuccess, 1);
     assert.strictEqual(nerror, 1);
diff --git a/test/parallel/test-tls-client-reject.js b/test/parallel/test-tls-client-reject.js
index cff0aabc89a7..90e3127ba471 100644
--- a/test/parallel/test-tls-client-reject.js
+++ b/test/parallel/test-tls-client-reject.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -31,7 +33,7 @@ const fixtures = require('../common/fixtures');
 const options = {
   key: fixtures.readKey('rsa_private.pem'),
   cert: fixtures.readKey('rsa_cert.crt'),
-  ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+  ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
 };
 
 const server = tls.createServer(options, function(socket) {
@@ -48,7 +50,7 @@ function unauthorized() {
     port: server.address().port,
     servername: 'localhost',
     rejectUnauthorized: false,
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustCall(function() {
     let _data;
     assert(!socket.authorized);
@@ -70,7 +72,7 @@ function rejectUnauthorized() {
   console.log('reject unauthorized');
   const socket = tls.connect(server.address().port, {
     servername: 'localhost',
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustNotCall());
   socket.on('data', common.mustNotCall());
   socket.on('error', common.mustCall(function(err) {
@@ -84,7 +86,7 @@ function rejectUnauthorizedUndefined() {
   const socket = tls.connect(server.address().port, {
     servername: 'localhost',
     rejectUnauthorized: undefined,
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustNotCall());
   socket.on('data', common.mustNotCall());
   socket.on('error', common.mustCall(function(err) {
@@ -98,7 +100,7 @@ function authorized() {
   const socket = tls.connect(server.address().port, {
     ca: [fixtures.readKey('rsa_cert.crt')],
     servername: 'localhost',
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustCall(function() {
     console.log('... authorized');
     assert(socket.authorized);
diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/parallel/test-tls-client-renegotiation-13.js
index 80c4753d065e..33e74af13eda 100644
--- a/test/parallel/test-tls-client-renegotiation-13.js
+++ b/test/parallel/test-tls-client-renegotiation-13.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const fixtures = require('../common/fixtures');
 
@@ -32,7 +32,7 @@ connect({
   assert.strictEqual(client.getProtocol(), 'TLSv1.3');
 
   const ok = client.renegotiate({}, common.mustCall((err) => {
-    if (process.features.openssl_is_boringssl) {
+    if (isBoringSSL) {
       assert.throws(() => { throw err; }, {
         message: 'TLS session renegotiation is unsupported by this TLS ' +
                  'implementation',
@@ -40,7 +40,7 @@ connect({
       });
     } else {
       assert.throws(() => { throw err; }, {
-        message: hasOpenSSL3 ?
+        message: hasOpenSSL(3) ?
           'error:0A00010A:SSL routines::wrong ssl version' :
           'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
         code: 'ERR_SSL_WRONG_SSL_VERSION',
diff --git a/test/parallel/test-tls-client-renegotiation-limit.js b/test/parallel/test-tls-client-renegotiation-limit.js
index 9b7f62865b33..b712e6f7d9eb 100644
--- a/test/parallel/test-tls-client-renegotiation-limit.js
+++ b/test/parallel/test-tls-client-renegotiation-limit.js
@@ -25,13 +25,13 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { opensslCli } = require('../common/crypto');
+const { opensslCli, isBoringSSL } = require('../common/crypto');
 
 if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testRenegotiationUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-clienthello-sync-write.js b/test/parallel/test-tls-clienthello-sync-write.js
new file mode 100644
index 000000000000..4b7fcc541f0c
--- /dev/null
+++ b/test/parallel/test-tls-clienthello-sync-write.js
@@ -0,0 +1,53 @@
+'use strict';
+
+// Writing to a server TLSSocket synchronously from inside a 'resumeSession'
+// handler, while the handshake is still waiting on the ClientHello, must not
+// break the connection; the data must be delivered once the handshake ends.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { EventEmitter } = require('events');
+const fixtures = require('../common/fixtures');
+const net = require('net');
+const tls = require('tls');
+
+const secureContext = tls.createSecureContext({
+  key: fixtures.readKey('rsa_private.pem'),
+  cert: fixtures.readKey('rsa_cert.crt'),
+});
+
+const fakeServer = new EventEmitter();
+fakeServer.getTicketKeys = () => null;
+
+let serverSocket;
+fakeServer.on('resumeSession', common.mustCall((id, callback) => {
+  serverSocket.write('from-mid-handshake');
+  callback(null, null);
+}));
+
+const server = net.createServer(common.mustCall((raw) => {
+  serverSocket = new tls.TLSSocket(raw, {
+    isServer: true,
+    secureContext,
+    server: fakeServer,
+  });
+  serverSocket.on('error', common.mustNotCall());
+}));
+
+server.listen(0, common.mustCall(() => {
+  const client = tls.connect({
+    port: server.address().port,
+    rejectUnauthorized: false,
+  }, common.mustCall(() => {
+    client.on('data', common.mustCall((data) => {
+      assert.strictEqual(data.toString(), 'from-mid-handshake');
+      client.end();
+      server.close();
+    }));
+  }));
+  client.on('error', common.mustNotCall());
+}));
diff --git a/test/parallel/test-tls-connect-single-use-context.js b/test/parallel/test-tls-connect-single-use-context.js
new file mode 100644
index 000000000000..e135bff4f259
--- /dev/null
+++ b/test/parallel/test-tls-connect-single-use-context.js
@@ -0,0 +1,132 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+// tls.connect() builds a SecureContext per connection and marks it as single
+// use, so that the underlying SSL_CTX is released as soon as the socket
+// closes instead of when the JS wrapper happens to be garbage collected.
+// Regression test for https://github.com/nodejs/node/issues/66002, where the
+// flag was lost on its way to the context and nothing was ever closed.
+
+const assert = require('assert');
+const tls = require('tls');
+const fixtures = require('../common/fixtures');
+const { createMockedLookup } = require('../common/dns');
+
+const key = fixtures.readKey('agent1-key.pem');
+const cert = fixtures.readKey('agent1-cert.pem');
+
+const server = tls.createServer({ key, cert }, (conn) => conn.end());
+
+// Bound to a single address so that the addresses the handle-swap case
+// retries through are refused rather than answered by this server.
+server.listen(0, '127.0.0.1', common.mustCall(() => {
+  connectWithOwnContext(common.mustCall(() => {
+    connectWithSharedContext(common.mustCall(() => {
+      connectAcrossHandleSwaps(common.mustCall(() => {
+        connectWithKeepAlive(common.mustCall(() => server.close()));
+      }));
+    }));
+  }));
+}));
+
+// _destroySSL() runs from the immediate queue, after the 'close' event.
+function afterDestroySSL(socket, fn) {
+  socket.on('close', common.mustCall(() => setImmediate(fn)));
+}
+
+function connectWithOwnContext(done) {
+  const socket = tls.connect({
+    host: '127.0.0.1',
+    port: server.address().port,
+    rejectUnauthorized: false,
+  }, common.mustCall(() => {
+    const secureContext = socket.ssl._secureContext;
+    assert.strictEqual(secureContext.singleUse, true);
+    assert.notStrictEqual(secureContext.context, null);
+
+    afterDestroySSL(socket, common.mustCall(() => {
+      assert.strictEqual(secureContext.context, null);
+      done();
+    }));
+  }));
+}
+
+function connectWithSharedContext(done) {
+  // A context passed in by the user may outlive the connection, so it must
+  // not be marked single use, and it must still work for the next socket.
+  const secureContext = tls.createSecureContext();
+  let remaining = 2;
+
+  (function connectOnce() {
+    const socket = tls.connect({
+      host: '127.0.0.1',
+      port: server.address().port,
+      rejectUnauthorized: false,
+      secureContext,
+    }, common.mustCall(() => {
+      assert.strictEqual(socket.ssl._secureContext, secureContext);
+      assert.strictEqual(secureContext.singleUse, undefined);
+
+      afterDestroySSL(socket, common.mustCall(() => {
+        assert.notStrictEqual(secureContext.context, null);
+        if (--remaining === 0) done();
+        else connectOnce();
+      }));
+    }));
+  })();
+}
+
+function connectAcrossHandleSwaps(done) {
+  // autoSelectFamily reinitializes the handle on every failed attempt, and the
+  // successive TLSWraps share the socket's context. Releasing it with the old
+  // handle leaves the next attempt without a context. Two failing addresses
+  // are needed: the close happens on the first swap, and the next swap is what
+  // trips over it.
+  const socket = tls.connect({
+    host: 'example.org',
+    port: server.address().port,
+    rejectUnauthorized: false,
+    autoSelectFamily: true,
+    autoSelectFamilyAttemptTimeout:
+      common.defaultAutoSelectFamilyAttemptTimeout,
+    lookup: createMockedLookup('::1', '127.0.0.2', '127.0.0.1'),
+  }, common.mustCall(() => {
+    // `ssl` is cleared while the handle is swapped, so read the context from
+    // the handle the socket ended up with.
+    const secureContext = socket._handle._secureContext;
+    assert.strictEqual(secureContext.singleUse, true);
+    assert.notStrictEqual(secureContext.context, null);
+
+    afterDestroySSL(socket, common.mustCall(() => {
+      assert.strictEqual(secureContext.context, null);
+      done();
+    }));
+  }));
+}
+
+function connectWithKeepAlive(done) {
+  // tls.connect() only asks for a single-use context when TCP keepalive is
+  // off, so a client that enables it leaves its context to the garbage
+  // collector. Pinned here as the current behaviour: whether the context
+  // should be released early in this case too is the open question in the
+  // issue, and is deliberately not decided by this change.
+  const socket = tls.connect({
+    host: '127.0.0.1',
+    port: server.address().port,
+    rejectUnauthorized: false,
+    keepAlive: true,
+  }, common.mustCall(() => {
+    const secureContext = socket.ssl._secureContext;
+    assert.strictEqual(secureContext.singleUse, undefined);
+    assert.notStrictEqual(secureContext.context, null);
+
+    afterDestroySSL(socket, common.mustCall(() => {
+      assert.notStrictEqual(secureContext.context, null);
+      done();
+    }));
+  }));
+}
diff --git a/test/parallel/test-tls-dhe.js b/test/parallel/test-tls-dhe.js
index 83af6daccbd0..6f54bbd97667 100644
--- a/test/parallel/test-tls-dhe.js
+++ b/test/parallel/test-tls-dhe.js
@@ -26,7 +26,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').assertFiniteFieldDheUnsupported();
   return;
 }
@@ -34,6 +36,7 @@ if (process.features.openssl_is_boringssl) {
 const {
   opensslCli,
   hasOpenSSL,
+  hasFIPS,
 } = require('../common/crypto');
 
 // OpenSSL has a set of security levels which affect what algorithms
@@ -62,7 +65,7 @@ const dheCipher = 'DHE-RSA-AES128-SHA256';
 const ecdheCipher = 'ECDHE-RSA-AES128-SHA256';
 const ciphers = `${dheCipher}:${ecdheCipher}`;
 
-if (secLevel < 2) {
+if (secLevel < 2 && !hasFIPS(3)) {
   // Test will emit a warning because the DH parameter size is < 2048 bits
   // when the test is run on versions lower than OpenSSL32
   common.expectWarning('SecurityWarning',
@@ -74,7 +77,7 @@ function loadDHParam(n) {
   return fixtures.readKey(keyname);
 }
 
-function test(dhparam, keylen, expectedCipher) {
+function test(dhparam, keylen, expectedCipher, expectedError) {
   const options = {
     key,
     cert,
@@ -84,12 +87,29 @@ function test(dhparam, keylen, expectedCipher) {
   };
 
   const server = tls.createServer(options, (conn) => conn.end());
+  if (typeof expectedError === 'string' || Array.isArray(expectedError)) {
+    server.once('tlsClientError', common.mustCall((err) => {
+      if (Array.isArray(expectedError)) {
+        assert.ok(expectedError.includes(err.code), err);
+      } else {
+        assert.strictEqual(err.code, expectedError);
+      }
+    }));
+  }
 
   server.listen(0, '127.0.0.1', common.mustCall(() => {
     const args = ['s_client', '-connect', `127.0.0.1:${server.address().port}`,
                   '-cipher', `${ciphers}:@SECLEVEL=1`];
 
-    execFile(opensslCli, args, common.mustSucceed((stdout) => {
+    execFile(opensslCli, args, common.mustCall((err, stdout, stderr) => {
+      if (expectedError) {
+        assert.strictEqual(err?.code, 1);
+        if (expectedError instanceof RegExp) assert.match(stderr, expectedError);
+        server.close();
+        return;
+      }
+
+      assert.ifError(err);
       assert(keylen === null ||
              // s_client < OpenSSL 3.5
              stdout.includes(`Server Temp Key: DH, ${keylen} bits`) ||
@@ -103,10 +123,10 @@ function test(dhparam, keylen, expectedCipher) {
   return once(server, 'close');
 }
 
-function testCustomParam(keylen, expectedCipher) {
+function testCustomParam(keylen, expectedCipher, expectedError) {
   const dhparam = loadDHParam(keylen);
   if (keylen === 'error') keylen = null;
-  return test(dhparam, keylen, expectedCipher);
+  return test(dhparam, keylen, expectedCipher, expectedError);
 }
 
 (async () => {
@@ -140,14 +160,29 @@ function testCustomParam(keylen, expectedCipher) {
   // OpenSSL 4.0 implements RFC 7919 FFDHE negotiation for TLS 1.2 and
   // ignores the server-supplied dhparam in favor of FFDHE-2048, so the
   // negotiated key length is always 2048.
-  if (secLevel < 2) {
-    await testCustomParam(1024, dheCipher);
-  } else if (hasOpenSSL(4, 0)) {
-    await test(loadDHParam(3072), 2048, dheCipher);
+  if (hasFIPS(3)) {
+    if (hasFIPS(4)) {
+      await test(loadDHParam(3072), 2048, dheCipher);
+      await testCustomParam(2048, dheCipher);
+    } else {
+      const errorCode = hasFIPS(3, 5) ?
+        [
+          'ERR_SSL_INVALID_KEY_LENGTH',
+          'ERR_SSL_SSL/TLS_ALERT_ILLEGAL_PARAMETER',
+        ] : 'ERR_SSL_INTERNAL_ERROR';
+      await testCustomParam(3072, null, errorCode);
+      await testCustomParam(2048, null, errorCode);
+    }
   } else {
-    await testCustomParam(3072, dheCipher);
+    if (secLevel < 2) {
+      await testCustomParam(1024, dheCipher);
+    } else if (hasOpenSSL(4, 0)) {
+      await test(loadDHParam(3072), 2048, dheCipher);
+    } else {
+      await testCustomParam(3072, dheCipher);
+    }
+    await testCustomParam(2048, dheCipher);
   }
-  await testCustomParam(2048, dheCipher);
 
   // Invalid DHE parameters are discarded. Prior to OpenSSL 4.0 this
   // disabled DHE and ECDHE was negotiated; since 4.0, FFDHE-2048 is used.
diff --git a/test/parallel/test-tls-dhparam-auto-boringssl.js b/test/parallel/test-tls-dhparam-auto-boringssl.js
index 54f2190d1a94..d2334c7feb0e 100644
--- a/test/parallel/test-tls-dhparam-auto-boringssl.js
+++ b/test/parallel/test-tls-dhparam-auto-boringssl.js
@@ -1,9 +1,11 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (!process.features.openssl_is_boringssl)
+if (!isBoringSSL)
   common.skip('only applies to BoringSSL builds');
 
 const assert = require('assert');
diff --git a/test/parallel/test-tls-disable-renegotiation.js b/test/parallel/test-tls-disable-renegotiation.js
index 84a6ead4a544..1934becc2a62 100644
--- a/test/parallel/test-tls-disable-renegotiation.js
+++ b/test/parallel/test-tls-disable-renegotiation.js
@@ -1,5 +1,7 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
 
@@ -8,7 +10,7 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testRenegotiationUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-ecdh-multiple.js b/test/parallel/test-tls-ecdh-multiple.js
index ed60044197d7..cc74130a2e39 100644
--- a/test/parallel/test-tls-ecdh-multiple.js
+++ b/test/parallel/test-tls-ecdh-multiple.js
@@ -8,7 +8,12 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { opensslCli, hasOpenSSL } = require('../common/crypto');
+const {
+  opensslCli,
+  hasOpenSSL,
+  hasFIPS,
+  isBoringSSL,
+} = require('../common/crypto');
 const crypto = require('crypto');
 
 if (!opensslCli) {
@@ -19,14 +24,16 @@ const assert = require('assert');
 const tls = require('tls');
 const { execFile } = require('child_process');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
 
 function loadPEM(n) {
   return fixtures.readKey(`${n}.pem`);
 }
 
-// OpenSSL 4.0 disables support for deprecated elliptic curves from RFC 8422
-// (including secp256k1) by default.
-const ecdhCurve = process.features.openssl_is_boringssl || hasOpenSSL(4, 0) ?
+// The FIPS provider and OpenSSL 4.0 disable support for deprecated elliptic
+// curves from RFC 8422 (including secp256k1) by default.
+const ecdhCurve = isBoringSSL ||
+  hasOpenSSL(4, 0) || hasFIPS(3) ?
   'prime256v1:secp521r1' :
   'secp256k1:prime256v1:secp521r1';
 
@@ -61,13 +68,22 @@ const server = tls.createServer(options, (conn) => {
     'prime192v3',
   ];
 
-  // Brainpool is not supported in FIPS mode.
-  if (crypto.getFips()) {
+  // Setting a Brainpool group on a TLS context is deferred by OpenSSL, so
+  // exercise the prohibited key operation directly under FIPS properties.
+  if (fips3) {
+    if (hasFIPS(3, 5)) {
+      assert.throws(
+        () => crypto.createECDH('brainpoolP256r1').generateKeys(),
+        { code: 'ERR_CRYPTO_OPERATION_FAILED' });
+    } else {
+      unsupportedCurves.push('brainpoolP256r1');
+    }
+  } else if (crypto.getFips() === 1) {
     unsupportedCurves.push('brainpoolP256r1');
   }
 
   // Deprecated RFC 8422 curves are disabled by default in OpenSSL 4.0.
-  if (process.features.openssl_is_boringssl || hasOpenSSL(4, 0)) {
+  if (isBoringSSL || hasOpenSSL(4, 0)) {
     unsupportedCurves.push('secp256k1');
   }
 
diff --git a/test/parallel/test-tls-empty-sni-context.js b/test/parallel/test-tls-empty-sni-context.js
index 6ecdfbeecbe3..7d8bf61239ac 100644
--- a/test/parallel/test-tls-empty-sni-context.js
+++ b/test/parallel/test-tls-empty-sni-context.js
@@ -3,7 +3,7 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 
@@ -26,7 +26,7 @@ const server = tls.createServer(options, (c) => {
   }, common.mustNotCall());
 
   c.on('error', common.mustCall((err) => {
-    const expectedErr = process.features.openssl_is_boringssl ?
+    const expectedErr = isBoringSSL ?
       'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR' : hasOpenSSL(4, 0) ?
         'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
           'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
diff --git a/test/parallel/test-tls-env-extra-ca-with-options.js b/test/parallel/test-tls-env-extra-ca-with-options.js
index 8f04decf670c..5775284eea44 100644
--- a/test/parallel/test-tls-env-extra-ca-with-options.js
+++ b/test/parallel/test-tls-env-extra-ca-with-options.js
@@ -8,7 +8,9 @@ if (!common.hasCrypto)
 const assert = require('node:assert');
 const tls = require('node:tls');
 const { fork } = require('node:child_process');
+const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
 
 const tests = [
   {
@@ -28,13 +30,26 @@ const tests = [
       crl: fixtures.readKey('ca2-crl.pem')
     }
   },
-  {
+];
+
+if (fips3) {
+  assert.throws(() => tls.createSecureContext({
+    pfx: fixtures.readKey('agent1.pfx'),
+    passphrase: 'sample',
+  }), {
+    code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+  });
+}
+
+if (!fips3 || hasFIPS(3, 5)) {
+  tests.push({
     clientOptions: {
-      pfx: fixtures.readKey('agent1.pfx'),
-      passphrase: 'sample'
+      pfx: fixtures.readKey(fips3 ?
+        'agent1-fips.pfx' : 'agent1.pfx'),
+      passphrase: fips3 ? 'password' : 'sample'
     }
-  },
-];
+  });
+}
 
 if (process.argv[2]) {
   const testNumber = parseInt(process.argv[2], 10);
diff --git a/test/parallel/test-tls-finished.js b/test/parallel/test-tls-finished.js
index b23b4567d27e..5a33257cebc1 100644
--- a/test/parallel/test-tls-finished.js
+++ b/test/parallel/test-tls-finished.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -21,7 +23,7 @@ const pem = (n) => fixtures.readKey(`${n}.pem`);
 const server = tls.createServer({
   key: pem('agent1-key'),
   cert: pem('agent1-cert'),
-  ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+  ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
 }, common.mustCall((alice) => {
   msg.server = {
     alice: alice.getFinished(),
@@ -34,7 +36,7 @@ server.listen(0, common.mustCall(() => {
   const bob = tls.connect({
     port: server.address().port,
     rejectUnauthorized: false,
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustCall(() => {
     msg.client = {
       alice: bob.getPeerFinished(),
diff --git a/test/parallel/test-tls-getcipher.js b/test/parallel/test-tls-getcipher.js
index 2d4de5639afb..cb8f1ba826b5 100644
--- a/test/parallel/test-tls-getcipher.js
+++ b/test/parallel/test-tls-getcipher.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL: commonIsBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
@@ -36,7 +38,7 @@ const options = {
   honorCipherOrder: true
 };
 
-const isBoringSSL = process.features.openssl_is_boringssl;
+const isBoringSSL = commonIsBoringSSL;
 let clients = 0;
 const expectedClients = isBoringSSL ? 1 : 2;
 const server = tls.createServer(options, common.mustCall(() => {
diff --git a/test/parallel/test-tls-getprotocol.js b/test/parallel/test-tls-getprotocol.js
index 2945ff99b5a2..e3e0a1fa2418 100644
--- a/test/parallel/test-tls-getprotocol.js
+++ b/test/parallel/test-tls-getprotocol.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // This test ensures that `getProtocol` returns the right protocol
 // from a TLS connection
@@ -11,6 +11,7 @@ const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
 
 let clientConfigs = [
   {
@@ -27,7 +28,7 @@ let clientConfigs = [
   },
 ];
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   // Remove the TLSv1 and TLSv1.1 cases. BoringSSL does not negotiate those
   // legacy protocols in this configuration; keep TLSv1.2 to cover getProtocol()
   // on a successful BoringSSL TLS handshake.
@@ -41,28 +42,51 @@ const serverConfig = {
   cert: fixtures.readKey('agent2-cert.pem')
 };
 
-if (!process.features.openssl_is_boringssl) {
-  serverConfig.ciphers = 'RSA@SECLEVEL=0';
+if (!isBoringSSL) {
+  serverConfig.ciphers = fips3 ?
+    'ECDHE-RSA-AES256-GCM-SHA384' : 'RSA@SECLEVEL=0';
 }
 
-const server = tls.createServer(serverConfig, common.mustCall(clientConfigs.length))
+const expectedConnections = fips3 ? 1 : clientConfigs.length;
+const server = tls.createServer(serverConfig, common.mustCall(expectedConnections));
+
+if (fips3) {
+  server.on('tlsClientError', common.mustCall((err) => {
+    assert.ok([
+      'ERR_SSL_NO_SUITABLE_DIGEST_ALGORITHM',
+      'ERR_SSL_UNEXPECTED_MESSAGE',
+    ].includes(err.code), err);
+  }, 2));
+}
+
+server
 .listen(0, common.localhostIPv4, common.mustCall(function() {
-  let connected = 0;
+  let completed = 0;
+  function done() {
+    if (++completed === clientConfigs.length)
+      server.close();
+  }
+
   for (const v of clientConfigs) {
-    tls.connect({
+    const shouldConnect = !fips3 || v.version === 'TLSv1.2';
+    const client = tls.connect({
       host: common.localhostIPv4,
       port: server.address().port,
       ciphers: v.ciphers,
       rejectUnauthorized: false,
       secureProtocol: v.secureProtocol
-    }, common.mustCall(function() {
+    }, shouldConnect ? common.mustCall(function() {
       assert.strictEqual(this.getProtocol(), v.version);
       this.on('end', common.mustCall());
       this.on('close', common.mustCall(function() {
         assert.strictEqual(this.getProtocol(), null);
+        done();
       })).end();
-      if (++connected === clientConfigs.length)
-        server.close();
-    }));
+    }) : common.mustNotCall());
+
+    if (!shouldConnect) {
+      client.on('error', common.mustCall((err) => assert(err.code)));
+      client.on('close', common.mustCall(done));
+    }
   }
 }));
diff --git a/test/parallel/test-tls-honorcipherorder.js b/test/parallel/test-tls-honorcipherorder.js
index d86a59aa4cdc..fcaed53353a8 100644
--- a/test/parallel/test-tls-honorcipherorder.js
+++ b/test/parallel/test-tls-honorcipherorder.js
@@ -8,6 +8,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const mustCall = common.mustCall;
 const tls = require('tls');
 const util = require('util');
@@ -16,7 +17,7 @@ const util = require('util');
 // default method is updated in the future
 const SSL_Method = 'TLSv1_2_method';
 const localhost = '127.0.0.1';
-const config = process.features.openssl_is_boringssl ? {
+const config = isBoringSSL || hasFIPS(3) ? {
   serverCiphers:
     'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256',
   clientPreferenceCiphers:
diff --git a/test/parallel/test-tls-invalid-pfx.js b/test/parallel/test-tls-invalid-pfx.js
index c16858f0f788..749d9e8b9f76 100644
--- a/test/parallel/test-tls-invalid-pfx.js
+++ b/test/parallel/test-tls-invalid-pfx.js
@@ -7,6 +7,7 @@ const fixtures = require('../common/fixtures');
 const {
   assert, connect, keys
 } = require(fixtures.path('tls-connect'));
+const { hasFIPS } = require('../common/crypto');
 
 const invalidPfx = fixtures.readKey('cert-without-key.pfx');
 
@@ -18,6 +19,10 @@ connect({
   },
   server: keys.agent1
 }, common.mustCall((e, pair, cleanup) => {
-  assert.strictEqual(e.message, 'Unable to load private key from PFX data');
+  if (hasFIPS(3)) {
+    assert.strictEqual(e.code, 'ERR_CRYPTO_UNSUPPORTED_OPERATION');
+  } else {
+    assert.strictEqual(e.message, 'Unable to load private key from PFX data');
+  }
   cleanup();
 }));
diff --git a/test/parallel/test-tls-key-mismatch.js b/test/parallel/test-tls-key-mismatch.js
index 797c7c171dc5..8f60ef0520c4 100644
--- a/test/parallel/test-tls-key-mismatch.js
+++ b/test/parallel/test-tls-key-mismatch.js
@@ -27,13 +27,13 @@ if (!common.hasCrypto) {
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const tls = require('tls');
-const errorMessageRegex = process.features.openssl_is_boringssl ?
+const errorMessageRegex = isBoringSSL ?
   /^Error: error:0b000074:X\.509 certificate routines:OPENSSL_internal:KEY_VALUES_MISMATCH$/ :
-  hasOpenSSL3 ?
+  hasOpenSSL(3) ?
     /^Error: error:05800074:x509 certificate routines::key values mismatch$/ :
     /^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/;
 
diff --git a/test/parallel/test-tls-keylog-sync-write.js b/test/parallel/test-tls-keylog-sync-write.js
new file mode 100644
index 000000000000..5e806ae62e7a
--- /dev/null
+++ b/test/parallel/test-tls-keylog-sync-write.js
@@ -0,0 +1,55 @@
+'use strict';
+
+// The 'keylog' event is emitted from the TLS library's own stack, part way
+// through the handshake. Writing to the socket from the handler must not
+// corrupt the connection; the data must arrive intact.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const tls = require('tls');
+
+const PAYLOAD = 'from-keylog';
+
+const server = tls.createServer({
+  key: fixtures.readKey('agent1-key.pem'),
+  cert: fixtures.readKey('agent1-cert.pem'),
+}, common.mustCall((socket) => {
+  socket.on('error', common.mustNotCall());
+
+  const onPayload = common.mustCall(() => {
+    assert.strictEqual(received, PAYLOAD);
+    socket.end();
+    server.close();
+  });
+
+  let received = '';
+  socket.on('data', (data) => {
+    received += data;
+    if (received.length >= PAYLOAD.length) onPayload();
+  });
+}));
+
+server.on('tlsClientError', common.mustNotCall());
+
+server.listen(0, common.mustCall(() => {
+  const client = tls.connect({
+    port: server.address().port,
+    rejectUnauthorized: false,
+  });
+
+  // 'keylog' fires once per secret derived, so the count is version dependent.
+  // Write from the first one only, to keep what the server expects exact.
+  let written = false;
+  client.on('keylog', common.mustCallAtLeast(() => {
+    if (written) return;
+    written = true;
+    client.write(PAYLOAD, common.mustCall());
+  }));
+
+  client.on('error', common.mustNotCall());
+}));
diff --git a/test/parallel/test-tls-legacy-pfx.js b/test/parallel/test-tls-legacy-pfx.js
index 5106217718db..77f9c0935025 100644
--- a/test/parallel/test-tls-legacy-pfx.js
+++ b/test/parallel/test-tls-legacy-pfx.js
@@ -4,9 +4,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+');
 }
 
diff --git a/test/parallel/test-tls-max-send-fragment.js b/test/parallel/test-tls-max-send-fragment.js
index 2e319fcdaeaf..d389cf50d3d7 100644
--- a/test/parallel/test-tls-max-send-fragment.js
+++ b/test/parallel/test-tls-max-send-fragment.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -64,7 +66,7 @@ const server = tls.createServer({
   // both out-of-range values and reports success, so assert that difference
   // explicitly instead of using a truthiness shortcut.
   const acceptsOutOfRangeFragmentSize =
-    process.features.openssl_is_boringssl;
+    isBoringSSL;
   assert.strictEqual(c.setMaxSendFragment(511),
                      acceptsOutOfRangeFragmentSize);
   assert.strictEqual(c.setMaxSendFragment(16385),
diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js
index 88dce9f4b8e6..932ad7f0f219 100644
--- a/test/parallel/test-tls-min-max-version.js
+++ b/test/parallel/test-tls-min-max-version.js
@@ -5,15 +5,17 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const {
+  isBoringSSL,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testLegacyProtocolUnsupported();
   return;
 }
 
-const {
-  hasOpenSSL,
-  hasOpenSSL3,
-} = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const { inspect } = require('util');
 
@@ -29,8 +31,24 @@ const DEFAULT_MAX_VERSION = tls.DEFAULT_MAX_VERSION;
 function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) {
   assert(proto || cerr || serr, 'test missing any expectations');
 
+  const legacyProtocols = new Set([
+    'TLSv1',
+    'TLSv1.1',
+    'TLSv1_method',
+    'TLSv1_1_method',
+  ]);
+  const expectedLegacyProtocol = proto === 'TLSv1' || proto === 'TLSv1.1';
+  const legacyOnlyConfiguration = [cprot, sprot, cmax, smax]
+    .some((value) => legacyProtocols.has(value));
+  const fipsLegacyFailure = hasFIPS(3) &&
+    (expectedLegacyProtocol || (!proto && legacyOnlyConfiguration));
+
+  if (hasFIPS(3) && expectedLegacyProtocol) {
+    proto = undefined;
+  }
+
   let ciphers;
-  if (hasOpenSSL3 && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
+  if (hasOpenSSL(3) && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
       proto === 'TLSv1_1_method' || proto === 'TLSv1_method' ||
       sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) {
     if (serr !== 'ERR_SSL_UNSUPPORTED_PROTOCOL')
@@ -65,6 +83,27 @@ function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) {
     console.log('test:', u(cmin), u(cmax), u(cprot), u(smin), u(smax), u(sprot),
                 u(ciphers), 'expect', u(proto), u(cerr), u(serr));
     console.log('  ', where);
+    if (fipsLegacyFailure) {
+      const errors = [pair.client.err, pair.server.err].filter(Boolean);
+      assert(errors.length > 0);
+      const expectedCodes = new Set([
+        'ERR_SSL_NO_PROTOCOLS_AVAILABLE',
+        'ERR_SSL_NO_SUITABLE_DIGEST_ALGORITHM',
+        'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE',
+        'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE',
+        'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION',
+        'ERR_SSL_UNEXPECTED_MESSAGE',
+        'ERR_SSL_UNSUPPORTED_PROTOCOL',
+        'ERR_SSL_VERSION_TOO_LOW',
+        'ERR_SSL_WRONG_VERSION_NUMBER',
+      ]);
+      if (hasFIPS(4))
+        expectedCodes.add('ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE');
+      for (const error of errors)
+        assert(expectedCodes.has(error.code), error);
+      return cleanup();
+    }
+
     if (!proto) {
       console.log('client', pair.client.err ? pair.client.err.code : undefined);
       console.log('server', pair.server.err ? pair.server.err.code : undefined);
@@ -139,9 +178,9 @@ test(U, U, 'TLS_method', U, U, 'TLSv1_method', 'TLSv1');
 
 // OpenSSL 1.1.1 and 3.0 use a different error code and alert (sent to the
 // client) when no protocols are enabled on the server.
-const NO_PROTOCOLS_AVAILABLE_SERVER = hasOpenSSL3 ?
+const NO_PROTOCOLS_AVAILABLE_SERVER = hasOpenSSL(3) ?
   'ERR_SSL_NO_PROTOCOLS_AVAILABLE' : 'ERR_SSL_INTERNAL_ERROR';
-const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = hasOpenSSL3 ?
+const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = hasOpenSSL(3) ?
   'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION' : 'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR';
 
 // SSLv23 also means "any supported protocol" greater than the default
diff --git a/test/parallel/test-tls-multi-key.js b/test/parallel/test-tls-multi-key.js
index 0a9c6f108bf6..cc52eb9e65d4 100644
--- a/test/parallel/test-tls-multi-key.js
+++ b/test/parallel/test-tls-multi-key.js
@@ -27,7 +27,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').assertMultiKeyUnsupported();
   return;
 }
@@ -143,6 +145,17 @@ test({
 });
 
 function test(options) {
+  if (hasFIPS(3) && options.pfx) {
+    const serverOptions = { ...options };
+    delete serverOptions.rsaCN;
+    delete serverOptions.eccCN;
+    delete serverOptions.client;
+    assert.throws(() => tls.createServer(serverOptions), {
+      code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    });
+    return;
+  }
+
   const rsaCN = options.rsaCN || 'agent1';
   const eccCN = options.eccCN || 'agent2';
   const clientTrustRoots = options.client.ca;
diff --git a/test/parallel/test-tls-multi-pfx.js b/test/parallel/test-tls-multi-pfx.js
index fec697cd3b70..d8a533049b2e 100644
--- a/test/parallel/test-tls-multi-pfx.js
+++ b/test/parallel/test-tls-multi-pfx.js
@@ -3,7 +3,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testMultiPfxSelectionDifference();
   return;
 }
@@ -11,8 +13,10 @@ if (process.features.openssl_is_boringssl) {
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
+const fips3 = hasFIPS(3);
+const fips4 = hasFIPS(4);
 
-const options = {
+const legacyOptions = {
   pfx: [
     {
       buf: fixtures.readKey('agent1.pfx'),
@@ -22,6 +26,40 @@ const options = {
   ]
 };
 
+if (fips3) {
+  assert.throws(() => tls.createServer(legacyOptions), {
+    code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+  });
+
+  if (!hasFIPS(3, 5)) {
+    return;
+  }
+}
+
+const fipsPfx = [
+  {
+    buf: fixtures.readKey('agent1-fips.pfx'),
+    passphrase: 'password',
+  },
+  {
+    buf: fixtures.readKey('ec-fips.pfx'),
+    passphrase: 'password',
+  },
+];
+
+if (fips4) {
+  for (const { buf } of fipsPfx) {
+    assert.throws(() => tls.createServer({
+      pfx: buf,
+      passphrase: 'sample',
+    }), {
+      message: 'password strength too weak',
+    });
+  }
+}
+
+const options = fips3 ? { pfx: fipsPfx } : legacyOptions;
+
 const ciphers = [];
 
 const server = tls.createServer(options, function(conn) {
diff --git a/test/parallel/test-tls-no-cert-required.js b/test/parallel/test-tls-no-cert-required.js
index 499ab2dfd14e..36da97526b6b 100644
--- a/test/parallel/test-tls-no-cert-required.js
+++ b/test/parallel/test-tls-no-cert-required.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -28,7 +30,7 @@ const assert = require('assert');
 const tls = require('tls');
 
 // Omitting the cert or pfx option to tls.createServer() should not throw.
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   // AECDH-NULL-SHA is a no-authentication/no-encryption cipher and hence
   // does not need a certificate. BoringSSL does not provide that anonymous
   // cipher suite, so only this cipher-specific no-cert case is skipped.
diff --git a/test/parallel/test-tls-options-boolean-check.js b/test/parallel/test-tls-options-boolean-check.js
index f7dd7bb102f3..4366502aacb3 100644
--- a/test/parallel/test-tls-options-boolean-check.js
+++ b/test/parallel/test-tls-options-boolean-check.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -41,7 +43,7 @@ const certDataView = toDataView(certBuff);
 const caArrDataView = toDataView(caCert);
 
 function filterBoringSSLKeyCertArrayCases(options, setName) {
-  if (!process.features.openssl_is_boringssl)
+  if (!isBoringSSL)
     return options;
 
   // The array-valued cases exercise multi-identity key/cert handling.
diff --git a/test/parallel/test-tls-passphrase.js b/test/parallel/test-tls-passphrase.js
index 4372da249bb5..6e1b50c0bb10 100644
--- a/test/parallel/test-tls-passphrase.js
+++ b/test/parallel/test-tls-passphrase.js
@@ -26,6 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const tls = require('tls');
+const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 const passKey = fixtures.readKey('rsa_private_encrypted.pem');
@@ -224,6 +225,10 @@ server.listen(0, common.mustCall(function() {
 })).unref();
 
 const errMessageDecrypt = /bad[ _]decrypt/i;
+// TLS supplies an empty password when the passphrase is omitted. OpenSSL 4
+// FIPS rejects it during PBKDF2 password-length checks, before decryption.
+const missingPassphraseError = hasFIPS(4) ?
+  { code: 'ERR_OSSL_PASSWORD_STRENGTH_TOO_WEAK' } : errMessageDecrypt;
 
 // Missing passphrase
 assert.throws(function() {
@@ -233,7 +238,7 @@ assert.throws(function() {
     cert: cert,
     rejectUnauthorized: false
   });
-}, errMessageDecrypt);
+}, missingPassphraseError);
 
 assert.throws(function() {
   tls.connect({
@@ -242,7 +247,7 @@ assert.throws(function() {
     cert: cert,
     rejectUnauthorized: false
   });
-}, errMessageDecrypt);
+}, missingPassphraseError);
 
 assert.throws(function() {
   tls.connect({
@@ -251,14 +256,14 @@ assert.throws(function() {
     cert: cert,
     rejectUnauthorized: false
   });
-}, errMessageDecrypt);
+}, missingPassphraseError);
 
 // Invalid passphrase
 assert.throws(function() {
   tls.connect({
     port: server.address().port,
     key: passKey,
-    passphrase: 'invalid',
+    passphrase: 'wrong-password',
     cert: cert,
     rejectUnauthorized: false
   });
@@ -268,7 +273,7 @@ assert.throws(function() {
   tls.connect({
     port: server.address().port,
     key: [passKey],
-    passphrase: 'invalid',
+    passphrase: 'wrong-password',
     cert: cert,
     rejectUnauthorized: false
   });
@@ -278,7 +283,7 @@ assert.throws(function() {
   tls.connect({
     port: server.address().port,
     key: [{ pem: passKey }],
-    passphrase: 'invalid',
+    passphrase: 'wrong-password',
     cert: cert,
     rejectUnauthorized: false
   });
@@ -287,7 +292,7 @@ assert.throws(function() {
 assert.throws(function() {
   tls.connect({
     port: server.address().port,
-    key: [{ pem: passKey, passphrase: 'invalid' }],
+    key: [{ pem: passKey, passphrase: 'wrong-password' }],
     passphrase: 'password', // Valid but unused
     cert: cert,
     rejectUnauthorized: false
diff --git a/test/parallel/test-tls-peer-certificate-repeated-reads.js b/test/parallel/test-tls-peer-certificate-repeated-reads.js
new file mode 100644
index 000000000000..a50d69687b9c
--- /dev/null
+++ b/test/parallel/test-tls-peer-certificate-repeated-reads.js
@@ -0,0 +1,87 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+// Reading the peer certificate must not consume the chain held by the SSL
+// session. getPeerX509Certificate() and getPeerCertificate() have to keep
+// returning the full chain however often, and in whichever order, they are
+// called on either end of the connection (see the #65579 regression, where an
+// internal getPeerX509Certificate() call left getPeerCertificate(true) with
+// only the leaf). On the server this also covers the peer certificate check
+// that runs before 'secureConnection' is emitted.
+
+const assert = require('assert');
+const { X509Certificate } = require('crypto');
+const tls = require('tls');
+const fixtures = require('../common/fixtures');
+
+// Each peer presents a distinct leaf -> intermediate -> root chain, so the
+// certificate read back has two issuers above the leaf.
+const serverChain = [
+  'leaf-from-intermediate-cert.pem',
+  'intermediate-ca.pem',
+  'fake-startcom-root-cert.pem',
+].map((name) => fixtures.readKey(name));
+const clientChain = [
+  'agent10-cert.pem',
+  'ca4-cert.pem',
+  'ca2-cert.pem',
+].map((name) => fixtures.readKey(name));
+
+function fingerprints(chain) {
+  return chain.map((pem) => new X509Certificate(pem).fingerprint256);
+}
+
+function checkPeerCertificate(socket, chain, side) {
+  assert.strictEqual(socket.authorized, true, side);
+  const [leaf, intermediate, root] = fingerprints(chain);
+
+  // Two rounds, alternating the read methods, so a chain consumed by one read
+  // would be observed by the next.
+  for (let round = 0; round < 2; round++) {
+    const x509 = socket.getPeerX509Certificate();
+    assert.strictEqual(x509.fingerprint256, leaf, side);
+    assert.strictEqual(x509.issuerCertificate.fingerprint256,
+                       intermediate, side);
+
+    const detailed = socket.getPeerCertificate(true);
+    assert.strictEqual(detailed.fingerprint256, leaf, side);
+    assert.strictEqual(detailed.issuerCertificate.fingerprint256,
+                       intermediate, side);
+    assert.strictEqual(
+      detailed.issuerCertificate.issuerCertificate.fingerprint256, root, side);
+
+    assert.strictEqual(socket.getPeerCertificate().fingerprint256, leaf, side);
+  }
+}
+
+const server = tls.createServer({
+  key: fixtures.readKey('leaf-from-intermediate-key.pem'),
+  cert: Buffer.concat(serverChain),
+  ca: clientChain[2],
+  requestCert: true,
+}, common.mustCall((socket) => {
+  checkPeerCertificate(socket, clientChain, 'server');
+  socket.end();
+}));
+
+server.listen(0, common.mustCall(() => {
+  const socket = tls.connect({
+    port: server.address().port,
+    key: fixtures.readKey('agent10-key.pem'),
+    cert: Buffer.concat(clientChain),
+    ca: serverChain[2],
+  }, common.mustCall(() => {
+    checkPeerCertificate(socket, serverChain, 'client');
+
+    // The client receives the server chain verbatim, so its X509 certificate
+    // links all the way to the root, exercising the recursive issuer build
+    // more than one level deep.
+    const [, , root] = fingerprints(serverChain);
+    const x509 = socket.getPeerX509Certificate();
+    assert.strictEqual(x509.issuerCertificate.issuerCertificate.fingerprint256,
+                       root);
+  }));
+  socket.on('close', common.mustCall(() => server.close()));
+}));
diff --git a/test/parallel/test-tls-pfx-authorizationerror.js b/test/parallel/test-tls-pfx-authorizationerror.js
index 53fcc0b16b5b..e115eea80fea 100644
--- a/test/parallel/test-tls-pfx-authorizationerror.js
+++ b/test/parallel/test-tls-pfx-authorizationerror.js
@@ -10,14 +10,38 @@ const fixtures = require('../common/fixtures');
 
 const assert = require('assert');
 const tls = require('tls');
+const { hasFIPS } = require('../common/crypto');
 
-const pfx = fixtures.readKey('agent1.pfx');
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+const fips4 = hasFIPS(4);
+const pfx = fixtures.readKey(fips35 ? 'agent1-fips.pfx' : 'agent1.pfx');
+const passphrase = fips35 ? 'password' : 'sample';
+
+if (fips3) {
+  assert.throws(() => tls.createServer({
+    pfx: fixtures.readKey('agent1.pfx'),
+    passphrase: 'sample',
+  }), {
+    code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+  });
+
+  if (!fips35) {
+    return;
+  }
+
+  if (fips4) {
+    assert.throws(() => tls.createServer({ pfx, passphrase: 'sample' }), {
+      message: 'password strength too weak',
+    });
+  }
+}
 
 const server = tls
   .createServer(
     {
       pfx: pfx,
-      passphrase: 'sample',
+      passphrase,
       requestCert: true,
       rejectUnauthorized: false
     },
@@ -33,7 +57,7 @@ const server = tls
       {
         port: this.address().port,
         pfx: pfx,
-        passphrase: 'sample',
+        passphrase,
         rejectUnauthorized: false
       },
       common.mustCall(() => {
diff --git a/test/parallel/test-tls-psk-alpn-callback-exception-handling.js b/test/parallel/test-tls-psk-alpn-callback-exception-handling.js
index 16ae56eef8af..7c2d98043720 100644
--- a/test/parallel/test-tls-psk-alpn-callback-exception-handling.js
+++ b/test/parallel/test-tls-psk-alpn-callback-exception-handling.js
@@ -10,11 +10,12 @@
 // throw exceptions during validation.
 
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
diff --git a/test/parallel/test-tls-psk-circuit.js b/test/parallel/test-tls-psk-circuit.js
index c9c93d533501..9cd4a68676ec 100644
--- a/test/parallel/test-tls-psk-circuit.js
+++ b/test/parallel/test-tls-psk-circuit.js
@@ -5,12 +5,13 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
 
-const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 
@@ -69,9 +70,12 @@ test({ psk: USERS.UserA, identity: 'UserA' }, { minVersion: 'TLSv1.3' });
 test({ psk: USERS.UserB, identity: 'UserB' });
 test({ psk: USERS.UserB, identity: 'UserB' }, { minVersion: 'TLSv1.3' });
 // Unrecognized user should fail handshake
-const expectedHandshakeErr = hasOpenSSL(4, 0) ?
-  'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
-    'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
+// OpenSSL 4.1 uses the same alert as for an invalid binder when no certificate
+// is available: https://github.com/openssl/openssl/pull/31026
+const expectedHandshakeErr = hasOpenSSL(4, 1) ?
+  'ERR_SSL_TLSV1_ALERT_DECRYPT_ERROR' : hasOpenSSL(4, 0) ?
+    'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
+      'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
 test({ psk: USERS.UserB, identity: 'UserC' }, {}, expectedHandshakeErr);
 // Recognized user but incorrect secret should fail handshake
 const expectedIllegalParameterErr = hasOpenSSL(3, 4) ? 'ERR_SSL_TLSV1_ALERT_DECRYPT_ERROR' :
diff --git a/test/parallel/test-tls-psk-server.js b/test/parallel/test-tls-psk-server.js
index 692550fc1c19..29d164f019da 100644
--- a/test/parallel/test-tls-psk-server.js
+++ b/test/parallel/test-tls-psk-server.js
@@ -5,7 +5,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
diff --git a/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js b/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js
index cca22067a0fe..b013d9f02c7a 100644
--- a/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js
+++ b/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js
@@ -1,10 +1,12 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').assertOpenSSLSecurityLevelsUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-server-verify.js b/test/parallel/test-tls-server-verify.js
index 439e32131030..c7487f593eb7 100644
--- a/test/parallel/test-tls-server-verify.js
+++ b/test/parallel/test-tls-server-verify.js
@@ -26,7 +26,7 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { opensslCli } = require('../common/crypto');
+const { opensslCli, isBoringSSL } = require('../common/crypto');
 
 if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
@@ -125,7 +125,7 @@ let testCases =
      ] },
   ];
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   // Remove the delayed client-certificate verification case. It depends on TLS
   // renegotiation to request a client certificate after the initial handshake,
   // but BoringSSL does not support caller-initiated renegotiation.
diff --git a/test/parallel/test-tls-session-cache.js b/test/parallel/test-tls-session-cache.js
index ae560e567980..54b7eeca2e9b 100644
--- a/test/parallel/test-tls-session-cache.js
+++ b/test/parallel/test-tls-session-cache.js
@@ -26,7 +26,9 @@ if (!common.hasCrypto) {
 }
 const {
   hasOpenSSL,
+  hasFIPS,
   opensslCli,
+  isBoringSSL: commonIsBoringSSL,
 } = require('../common/crypto');
 
 if (!opensslCli) {
@@ -37,7 +39,7 @@ const fixtures = require('../common/fixtures');
 const assert = require('assert');
 const tls = require('tls');
 const { spawn } = require('child_process');
-const isBoringSSL = process.features.openssl_is_boringssl;
+const isBoringSSL = commonIsBoringSSL;
 
 doTest({ tickets: false }, function() {
   doTest({ tickets: true }, function() {
@@ -59,7 +61,8 @@ function doTest(testOptions, callback) {
     secureProtocol: 'TLS_method',
     // BoringSSL supports the RSA cipher selector, but not OpenSSL's
     // cipher-string policy command syntax.
-    ciphers: isBoringSSL ? 'RSA' : 'RSA@SECLEVEL=0'
+    ciphers: hasFIPS(3) ? 'ECDHE-RSA-AES256-GCM-SHA384' :
+      (isBoringSSL ? 'RSA' : 'RSA@SECLEVEL=0')
   };
   let requestCount = 0;
   let resumeCount = 0;
@@ -108,8 +111,9 @@ function doTest(testOptions, callback) {
   server.listen(0, common.mustCall(function() {
     const args = [
       's_client',
-      isBoringSSL ? '-tls1_2' : '-tls1',
-      '-cipher', (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+      isBoringSSL || hasFIPS(3) ? '-tls1_2' : '-tls1',
+      '-cipher', hasFIPS(3) ? 'ECDHE-RSA-AES256-GCM-SHA384' :
+        (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
       '-connect', `localhost:${this.address().port}`,
       '-servername', 'ohgod',
       '-key', fixtures.path('keys/rsa_private.pem'),
diff --git a/test/parallel/test-tls-set-ciphers-error.js b/test/parallel/test-tls-set-ciphers-error.js
index b79bd512ffe1..102186f9e399 100644
--- a/test/parallel/test-tls-set-ciphers-error.js
+++ b/test/parallel/test-tls-set-ciphers-error.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 {
   const options = {
@@ -21,7 +21,7 @@ const { hasOpenSSL } = require('../common/crypto');
   assert.throws(() => tls.createServer(options, common.mustNotCall()),
                 /no[_ ]cipher[_ ]match/i);
   options.ciphers = 'TLS_not_a_cipher';
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     tls.createServer(options).close();
   } else {
     assert.throws(() => tls.createServer(options, common.mustNotCall()),
diff --git a/test/parallel/test-tls-set-ciphers.js b/test/parallel/test-tls-set-ciphers.js
index 82a19bb9e90f..57fb35991121 100644
--- a/test/parallel/test-tls-set-ciphers.js
+++ b/test/parallel/test-tls-set-ciphers.js
@@ -6,10 +6,10 @@ if (!common.hasCrypto) {
 
 const {
   hasOpenSSL,
-  hasOpenSSL3,
+  hasFIPS,
 } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('missing crypto, or OpenSSL version lower than 3');
 }
 
@@ -96,57 +96,83 @@ if (hasOpenSSL(4, 0)) {
   expectedTLSAlertError = 'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE';
 }
 
-// Have shared ciphers.
-test(U, 'AES256-SHA', 'AES256-SHA');
-test('AES256-SHA', U, 'AES256-SHA');
-
-test(U, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
-test('TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
-test('TLS_AES_256_GCM_SHA384:!TLS_CHACHA20_POLY1305_SHA256', U, 'TLS_AES_256_GCM_SHA384');
-
-// Do not have shared ciphers.
-test('TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256',
-     U, expectedTLSAlertError, 'ERR_SSL_NO_SHARED_CIPHER');
-
-test('AES256-SHA', 'AES256-SHA256', U, expectedTLSAlertError,
-     'ERR_SSL_NO_SHARED_CIPHER');
-test('AES256-SHA:TLS_AES_256_GCM_SHA384',
-     'TLS_CHACHA20_POLY1305_SHA256:AES256-SHA256',
-     U, expectedTLSAlertError, 'ERR_SSL_NO_SHARED_CIPHER');
-
-// Cipher order ignored, TLS1.3 chosen before TLS1.2.
-test('AES256-SHA:TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
-test(U, 'AES256-SHA:TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
-
-// Cipher order ignored, TLS1.3 before TLS1.2 and
-// cipher suites are not disabled if TLS ciphers are set only
-// TODO: maybe these tests should be reworked so maxVersion clamping
-// is done explicitly and not implicitly in the test() function
-test('AES256-SHA', U, 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' });
-test(U, 'AES256-SHA', 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' });
-
-// TLS_AES_128_CCM_8_SHA256 & TLS_AES_128_CCM_SHA256 are not enabled by
-// default, but work.
-// However, for OpenSSL32 AES_128 is not enabled due to the
-// default security level
-if (!hasOpenSSL(3, 2)) {
-  test('TLS_AES_128_CCM_8_SHA256', U,
-       U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
-
-  test('TLS_AES_128_CCM_8_SHA256', 'TLS_AES_128_CCM_8_SHA256',
-       'TLS_AES_128_CCM_8_SHA256');
+if (hasFIPS(3)) {
+  const tls12Cipher = 'ECDHE-RSA-AES256-GCM-SHA384';
+
+  // FIPS-approved TLS 1.2 and TLS 1.3 cipher suites work.
+  test(U, tls12Cipher, tls12Cipher);
+  test(tls12Cipher, U, tls12Cipher);
+  test(U, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+  test('TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
+
+  // The FIPS provider rejects ChaCha20-Poly1305.
+  test('TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256',
+       U, expectedTLSAlertError, 'ERR_SSL_NO_CIPHERS_AVAILABLE');
+
+  // Invalid cipher values are still validated before provider selection.
+  test(9, tls12Cipher, U, 'ERR_INVALID_ARG_TYPE', U);
+  test(tls12Cipher, 9, U, U, 'ERR_INVALID_ARG_TYPE');
+  test(':', tls12Cipher, U, 'ERR_INVALID_ARG_VALUE', U);
+  test(tls12Cipher, ':', U, U, 'ERR_INVALID_ARG_VALUE');
+
+  // Empty and null values continue to select the defaults.
+  test('TLS_AES_256_GCM_SHA384', '', 'TLS_AES_256_GCM_SHA384');
+  test('', 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+  test(null, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+  test('TLS_AES_256_GCM_SHA384', null, 'TLS_AES_256_GCM_SHA384');
+} else {
+  // Have shared ciphers.
+  test(U, 'AES256-SHA', 'AES256-SHA');
+  test('AES256-SHA', U, 'AES256-SHA');
+
+  test(U, 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+  test('TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
+  test('TLS_AES_256_GCM_SHA384:!TLS_CHACHA20_POLY1305_SHA256', U, 'TLS_AES_256_GCM_SHA384');
+
+  // Do not have shared ciphers.
+  test('TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256',
+       U, expectedTLSAlertError, 'ERR_SSL_NO_SHARED_CIPHER');
+
+  test('AES256-SHA', 'AES256-SHA256', U, expectedTLSAlertError,
+       'ERR_SSL_NO_SHARED_CIPHER');
+  test('AES256-SHA:TLS_AES_256_GCM_SHA384',
+       'TLS_CHACHA20_POLY1305_SHA256:AES256-SHA256',
+       U, expectedTLSAlertError, 'ERR_SSL_NO_SHARED_CIPHER');
+
+  // Cipher order ignored, TLS1.3 chosen before TLS1.2.
+  test('AES256-SHA:TLS_AES_256_GCM_SHA384', U, 'TLS_AES_256_GCM_SHA384');
+  test(U, 'AES256-SHA:TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+
+  // Cipher order ignored, TLS1.3 before TLS1.2 and
+  // cipher suites are not disabled if TLS ciphers are set only
+  // TODO: maybe these tests should be reworked so maxVersion clamping
+  // is done explicitly and not implicitly in the test() function
+  test('AES256-SHA', U, 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' });
+  test(U, 'AES256-SHA', 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' });
+
+  // TLS_AES_128_CCM_8_SHA256 & TLS_AES_128_CCM_SHA256 are not enabled by
+  // default, but work.
+  // However, for OpenSSL32 AES_128 is not enabled due to the
+  // default security level
+  if (!hasOpenSSL(3, 2)) {
+    test('TLS_AES_128_CCM_8_SHA256', U,
+         U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
+
+    test('TLS_AES_128_CCM_8_SHA256', 'TLS_AES_128_CCM_8_SHA256',
+         'TLS_AES_128_CCM_8_SHA256');
+  }
+
+  // Invalid cipher values
+  test(9, 'AES256-SHA', U, 'ERR_INVALID_ARG_TYPE', U);
+  test('AES256-SHA', 9, U, U, 'ERR_INVALID_ARG_TYPE');
+  test(':', 'AES256-SHA', U, 'ERR_INVALID_ARG_VALUE', U);
+  test('AES256-SHA', ':', U, U, 'ERR_INVALID_ARG_VALUE');
+
+  // Using '' is synonymous for "use default ciphers"
+  test('TLS_AES_256_GCM_SHA384', '', 'TLS_AES_256_GCM_SHA384');
+  test('', 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
+
+  // Using null should be treated the same as undefined.
+  test(null, 'AES256-SHA', 'AES256-SHA');
+  test('AES256-SHA', null, 'AES256-SHA');
 }
-
-// Invalid cipher values
-test(9, 'AES256-SHA', U, 'ERR_INVALID_ARG_TYPE', U);
-test('AES256-SHA', 9, U, U, 'ERR_INVALID_ARG_TYPE');
-test(':', 'AES256-SHA', U, 'ERR_INVALID_ARG_VALUE', U);
-test('AES256-SHA', ':', U, U, 'ERR_INVALID_ARG_VALUE');
-
-// Using '' is synonymous for "use default ciphers"
-test('TLS_AES_256_GCM_SHA384', '', 'TLS_AES_256_GCM_SHA384');
-test('', 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
-
-// Using null should be treated the same as undefined.
-test(null, 'AES256-SHA', 'AES256-SHA');
-test('AES256-SHA', null, 'AES256-SHA');
diff --git a/test/parallel/test-tls-set-default-ca-certificates-recovery.js b/test/parallel/test-tls-set-default-ca-certificates-recovery.js
index ea6f98d5686e..d4154a2da62e 100644
--- a/test/parallel/test-tls-set-default-ca-certificates-recovery.js
+++ b/test/parallel/test-tls-set-default-ca-certificates-recovery.js
@@ -3,6 +3,7 @@
 // This tests error recovery and fallback behavior for tls.setDefaultCACertificates()
 
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto) common.skip('missing crypto');
 
 const assert = require('assert');
@@ -27,7 +28,7 @@ function testRecovery(expectedCerts) {
   {
     const invalidCert = '-----BEGIN CERTIFICATE-----\nvalid cert content\n-----END CERTIFICATE-----';
     assert.throws(() => tls.setDefaultCACertificates([fixtureCert, invalidCert]), {
-      code: process.features.openssl_is_boringssl ?
+      code: isBoringSSL ?
         'ERR_OSSL_PEM_ASN.1_ENCODING_ROUTINES' :
         'ERR_OSSL_PEM_ASN1_LIB',
     });
diff --git a/test/parallel/test-tls-set-sigalgs.js b/test/parallel/test-tls-set-sigalgs.js
index e1bf8b93f8a3..ca111e83ef2b 100644
--- a/test/parallel/test-tls-set-sigalgs.js
+++ b/test/parallel/test-tls-set-sigalgs.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 // Test sigalgs: option for TLS.
@@ -41,7 +41,7 @@ function test(csigalgs, ssigalgs, shared_sigalgs, cerr, serr) {
       assert(pair.client.conn);
       // BoringSSL's OpenSSL-compatible SSL_get_shared_sigalgs() API always
       // returns zero, so a successful handshake still reports an empty list.
-      const expectedSharedSigalgs = process.features.openssl_is_boringssl ?
+      const expectedSharedSigalgs = isBoringSSL ?
         [] :
         shared_sigalgs;
       assert.deepStrictEqual(
@@ -74,7 +74,7 @@ test('RSA-PSS+SHA256:RSA-PSS+SHA512:ECDSA+SHA256',
 const handshakeErr = hasOpenSSL(4, 0) ?
   'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
     'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
-const noSharedSigalgsErr = process.features.openssl_is_boringssl ?
+const noSharedSigalgsErr = isBoringSSL ?
   'ERR_SSL_NO_COMMON_SIGNATURE_ALGORITHMS' :
   'ERR_SSL_NO_SHARED_SIGNATURE_ALGORITHMS';
 test('RSA-PSS+SHA384', 'ECDSA+SHA256',
diff --git a/test/parallel/test-tls-ticket-cluster.js b/test/parallel/test-tls-ticket-cluster.js
index f183b53f24c0..fa3c23c2a6e2 100644
--- a/test/parallel/test-tls-ticket-cluster.js
+++ b/test/parallel/test-tls-ticket-cluster.js
@@ -20,11 +20,13 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testTls13SessionTicketSemanticsDiffer();
   return;
 }
diff --git a/test/parallel/test-tls-ticket.js b/test/parallel/test-tls-ticket.js
index 8316f5e8da8d..b6aa7a6de9c3 100644
--- a/test/parallel/test-tls-ticket.js
+++ b/test/parallel/test-tls-ticket.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -30,7 +32,7 @@ const net = require('net');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
 
-if (process.features.openssl_is_boringssl &&
+if (isBoringSSL &&
     tls.DEFAULT_MAX_VERSION !== 'TLSv1.2') {
   require('../common/boringssl').testTls13SessionTicketSemanticsDiffer();
   return;
diff --git a/test/parallel/test-tls-write-error.js b/test/parallel/test-tls-write-error.js
index 8a8d820a09cc..08b943aab713 100644
--- a/test/parallel/test-tls-write-error.js
+++ b/test/parallel/test-tls-write-error.js
@@ -5,7 +5,9 @@ if (!common.hasCrypto)
 
 const { TestTLSSocket, ccs } = require('../common/tls');
 const fixtures = require('../common/fixtures');
+const assert = require('assert');
 const https = require('https');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // Regression test for an use-after-free bug in the TLS implementation that
 // would occur when `SSL_write()` failed.
@@ -18,14 +20,23 @@ const opts = {
   key: server_key,
   cert: server_cert,
 };
+const rejectsClientHello = hasFIPS(3) && !hasFIPS(3, 5);
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   opts.ciphers = 'ALL@SECLEVEL=0';
 }
 
 const server = https.createServer(opts, (req, res) => {
   res.write('hello');
-}).listen(0, common.mustCall(() => {
+});
+
+if (rejectsClientHello) {
+  server.once('tlsClientError', common.mustCall((err) => {
+    assert.strictEqual(err.code, 'ERR_SSL_WRONG_SIGNATURE_TYPE');
+  }));
+}
+
+server.listen(0, common.mustCall(() => {
   const client = new TestTLSSocket(server_cert);
 
   client.connect({
@@ -37,6 +48,12 @@ const server = https.createServer(opts, (req, res) => {
   }));
 
   client.once('data', common.mustCall((buf) => {
+    if (rejectsClientHello) {
+      client.end();
+      server.close();
+      return;
+    }
+
     let remaining = buf;
     do {
       remaining = client.parseTLSFrame(remaining);
diff --git a/test/parallel/test-trace-env.js b/test/parallel/test-trace-env.js
index 7a7b80fa4c10..4d1a8165277e 100644
--- a/test/parallel/test-trace-env.js
+++ b/test/parallel/test-trace-env.js
@@ -19,8 +19,8 @@ spawnSyncAndAssert(process.execPath, ['--trace-env', fixtures.path('empty.js')],
     if (common.hasCrypto) {
       assert.match(output, /get "NODE_EXTRA_CA_CERTS"/);
 
-      const { hasOpenSSL3 } = require('../common/crypto');
-      if (hasOpenSSL3) {
+      const { hasOpenSSL } = require('../common/crypto');
+      if (hasOpenSSL(3)) {
         assert.match(output, /get "OPENSSL_CONF"/);
       }
     }
diff --git a/test/parallel/test-urlpattern.js b/test/parallel/test-urlpattern.js
index 42bdd114f43d..ae0a03562226 100644
--- a/test/parallel/test-urlpattern.js
+++ b/test/parallel/test-urlpattern.js
@@ -5,6 +5,20 @@ require('../common');
 const assert = require('assert');
 const { URLPattern } = require('url');
 
+{
+  assert.deepStrictEqual(
+    Object.getOwnPropertyDescriptor(URLPattern.prototype, Symbol.toStringTag),
+    {
+      configurable: true,
+      enumerable: false,
+      value: 'URLPattern',
+      writable: false,
+    });
+  assert.strictEqual(
+    Object.prototype.toString.call(new URLPattern()),
+    '[object URLPattern]');
+}
+
 // Verify that if an error is thrown while accessing any of the
 // init options, the error is appropriately propagated.
 assert.throws(() => {
@@ -50,3 +64,43 @@ assert.throws(() => {
   assert.strictEqual(result.pathname.input, '/test');
   assert.strictEqual(result.pathname.groups.value, 'test');
 }
+
+{
+  const accessed = [];
+  const expected = [
+    'baseURL',
+    'hash',
+    'hostname',
+    'password',
+    'pathname',
+    'port',
+    'protocol',
+    'search',
+    'username',
+  ];
+  const init = new Proxy({}, {
+    get(target, name, receiver) {
+      accessed.push(name);
+      return Reflect.get(target, name, receiver);
+    },
+  });
+
+  new URLPattern(init);
+  assert.deepStrictEqual(accessed, expected);
+}
+
+{
+  const input = new URLPattern({ pathname: '/x' })
+    .exec({
+      protocol: 'https',
+      pathname: '/x',
+      username: undefined,
+    }).inputs[0];
+
+  assert.deepStrictEqual(Object.keys(input), ['pathname', 'protocol']);
+  assert.strictEqual('username' in input, false);
+  assert.deepStrictEqual({ ...input }, {
+    pathname: '/x',
+    protocol: 'https',
+  });
+}
diff --git a/test/parallel/test-util-debounce.js b/test/parallel/test-util-debounce.js
new file mode 100644
index 000000000000..15d93e610418
--- /dev/null
+++ b/test/parallel/test-util-debounce.js
@@ -0,0 +1,381 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const { createHook } = require('node:async_hooks');
+const { setTimeout } = require('node:timers/promises');
+const { debounce } = require('node:util');
+const { TIMEOUT_MAX } = require('internal/timers');
+
+for (const value of [undefined, null, true, 0, 'fn', {}, [], Symbol()]) {
+  assert.throws(() => debounce(value, 1), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+}
+
+for (const value of [undefined, null, true, '1', {}, [], Symbol()]) {
+  assert.throws(() => debounce(() => {}, value), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+}
+
+for (const value of [-1, 0.5, NaN, Infinity, TIMEOUT_MAX + 1]) {
+  assert.throws(() => debounce(() => {}, value), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+}
+
+for (const value of [null, true, 1, 'options', []]) {
+  assert.throws(() => debounce(() => {}, 1, value), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+}
+
+assert.throws(() => debounce(() => {}, 1, { rejectOnCancel: 1 }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => debounce(() => {}, 1, { leading: 1 }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => debounce(() => {}, 1, { signal: {} }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+
+{
+  const reason = new Error('already aborted');
+  assert.throws(
+    () => debounce(() => {}, 1, { signal: AbortSignal.abort(reason) }),
+    (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+  );
+}
+
+(async () => {
+  {
+    const debounced = debounce(common.mustCall(function(...args) {
+      assert.strictEqual(this, debounced);
+      assert.strictEqual(debounced.pending, null);
+      assert.deepStrictEqual(args, ['last', 2]);
+      return args[1];
+    }), 100);
+
+    assert.strictEqual(typeof debounced.cancel, 'function');
+    assert.strictEqual(typeof debounced.flush, 'function');
+    assert.strictEqual(typeof debounced.ref, 'function');
+    assert.strictEqual(typeof debounced.unref, 'function');
+    assert.strictEqual(debounced.unref(), debounced);
+    assert.strictEqual(debounced.ref(), debounced);
+    assert.strictEqual(debounced.pending, null);
+    assert.strictEqual(debounced.pendingCount, 0);
+
+    const first = debounced('first', 1);
+    const second = debounced('last', 2);
+    assert(first instanceof Promise);
+    assert(second instanceof Promise);
+    assert.notStrictEqual(first, second);
+    assert.strictEqual(debounced.pending, second);
+    assert.strictEqual(debounced.pendingCount, 2);
+    assert.strictEqual(debounced.unref(), debounced);
+    assert.strictEqual(debounced.ref(), debounced);
+
+    debounced.flush();
+    assert.strictEqual(debounced.pending, null);
+    assert.strictEqual(debounced.pendingCount, 0);
+    debounced.flush();
+    assert.deepStrictEqual(await Promise.all([first, second]), [2, 2]);
+  }
+
+  {
+    const values = [];
+    const debounced = debounce(common.mustCall((value) => {
+      values.push(value);
+      return value;
+    }, 3), 100, { leading: true });
+
+    const first = debounced(1);
+    assert.deepStrictEqual(values, [1]);
+    assert.strictEqual(debounced.pending, null);
+    assert.strictEqual(debounced.pendingCount, 0);
+
+    // With no trailing call pending, flush does not end the debounce window.
+    debounced.flush();
+    const second = debounced(2);
+    const third = debounced(3);
+    assert.deepStrictEqual(values, [1]);
+    assert.strictEqual(debounced.pending, third);
+    assert.strictEqual(debounced.pendingCount, 2);
+
+    debounced.flush();
+    assert.deepStrictEqual(values, [1, 3]);
+    assert.deepStrictEqual(
+      await Promise.all([first, second, third]),
+      [1, 3, 3],
+    );
+
+    const fourth = debounced(4);
+    assert.deepStrictEqual(values, [1, 3, 4]);
+    assert.strictEqual(await fourth, 4);
+    debounced.cancel();
+  }
+
+  {
+    const debounced = debounce(common.mustCall((value) => value), 1, {
+      leading: true,
+    });
+    assert.strictEqual(await debounced(42), 42);
+    assert.strictEqual(debounced.pending, null);
+    await setTimeout(10);
+  }
+
+  {
+    let recursive;
+    const values = [];
+    const debounced = debounce(common.mustCall((value) => {
+      values.push(value);
+      if (value === 1) recursive = debounced(2);
+      return value;
+    }, 2), 100);
+
+    const first = debounced(1);
+    debounced.flush();
+    assert.deepStrictEqual(values, [1]);
+    assert.strictEqual(debounced.pending, recursive);
+    assert.strictEqual(await first, 1);
+
+    debounced.flush();
+    assert.deepStrictEqual(values, [1, 2]);
+    assert.strictEqual(await recursive, 2);
+  }
+
+  {
+    let recursive;
+    const values = [];
+    const debounced = debounce(common.mustCall((value) => {
+      values.push(value);
+      if (value === 1) recursive = debounced(2);
+      return value;
+    }, 2), 100, { leading: true });
+
+    const first = debounced(1);
+    assert.deepStrictEqual(values, [1]);
+    assert.strictEqual(debounced.pending, recursive);
+    assert.strictEqual(await first, 1);
+
+    debounced.flush();
+    assert.deepStrictEqual(values, [1, 2]);
+    assert.strictEqual(await recursive, 2);
+  }
+
+  {
+    let recursive;
+    const values = [];
+    const debounced = debounce(common.mustCall((value) => {
+      values.push(value);
+      if (value === 2) recursive = debounced(3);
+      return value;
+    }, 3), 100, { leading: true });
+
+    const first = debounced(1);
+    const second = debounced(2);
+    debounced.flush();
+    assert.deepStrictEqual(values, [1, 2, 3]);
+    assert.deepStrictEqual(
+      await Promise.all([first, second, recursive]),
+      [1, 2, 3],
+    );
+    assert.strictEqual(debounced.pending, null);
+    debounced.cancel();
+  }
+
+  {
+    const debounced = debounce(common.mustCall(async (value) => {
+      await Promise.resolve();
+      return value;
+    }), 100);
+    const result = debounced(42);
+    debounced.flush();
+    assert.strictEqual(await result, 42);
+  }
+
+  {
+    const expected = new Error('failure');
+    const debounced = debounce(common.mustCall(() => { throw expected; }), 100);
+    const result = debounced();
+    debounced.flush();
+    await assert.rejects(result, (error) => error === expected);
+  }
+
+  {
+    const debounced = debounce(common.mustNotCall(), 100);
+    const first = debounced();
+    const second = debounced();
+    const reason = new Error('cancelled');
+    debounced.cancel(reason);
+    assert.strictEqual(debounced.pending, null);
+    debounced.cancel();
+    await assert.rejects(
+      first,
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+    await assert.rejects(
+      second,
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+  }
+
+  {
+    const debounced = debounce(common.mustCall((value) => value), 100, {
+      rejectOnCancel: true,
+    });
+    const first = debounced(1);
+    const firstRejection = assert.rejects(first, {
+      code: 'ABORT_ERR',
+      name: 'AbortError',
+    });
+    const second = debounced(2);
+    assert.strictEqual(debounced.pendingCount, 1);
+    await firstRejection;
+    debounced.flush();
+    assert.strictEqual(await second, 2);
+  }
+
+  {
+    const reason = new Error('stop');
+    const controller = new AbortController();
+    const debounced = debounce(common.mustNotCall(), 100, {
+      signal: controller.signal,
+    });
+    const result = debounced();
+    controller.abort(reason);
+    await assert.rejects(
+      result,
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+    assert.strictEqual(debounced.pending, null);
+  }
+
+  {
+    const reason = new Error('stop future calls');
+    const controller = new AbortController();
+    const debounced = debounce(common.mustNotCall(), 100, {
+      signal: controller.signal,
+    });
+    controller.abort(reason);
+    await assert.rejects(
+      debounced(),
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+    await assert.rejects(
+      debounced(),
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+    assert.strictEqual(debounced.pending, null);
+    assert.strictEqual(debounced.pendingCount, 0);
+  }
+
+  {
+    const reason = new Error('abort during leading call');
+    const controller = new AbortController();
+    const state = {};
+    controller.signal.addEventListener('abort', common.mustCall(() => {
+      state.result = state.debounced();
+    }));
+    state.debounced = debounce(common.mustNotCall(), 100, {
+      leading: true,
+      signal: controller.signal,
+    });
+    controller.abort(reason);
+    await assert.rejects(
+      state.result,
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+  }
+
+  {
+    const reason = new Error('abort during flush');
+    const controller = new AbortController();
+    const state = {};
+    controller.signal.addEventListener('abort', common.mustCall(() => {
+      state.debounced.flush();
+    }));
+    state.debounced = debounce(common.mustNotCall(), 100, {
+      signal: controller.signal,
+    });
+    const result = state.debounced();
+    controller.abort(reason);
+    await assert.rejects(
+      result,
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+  }
+
+  {
+    const controller = new AbortController();
+    const debounced = debounce(common.mustCall(() => 1), 100, {
+      signal: controller.signal,
+    });
+    const result = debounced();
+    debounced.flush();
+    controller.abort();
+    assert.strictEqual(await result, 1);
+  }
+
+  {
+    const debounced = debounce(common.mustCall((value) => value), 1);
+    assert.strictEqual(await debounced(42), 42);
+  }
+
+  {
+    const debounced = debounce(common.mustCall((value) => value, 2), 100);
+    const first = debounced(1);
+    debounced.flush();
+    assert.strictEqual(await first, 1);
+    const second = debounced(2);
+    debounced.flush();
+    assert.strictEqual(await second, 2);
+  }
+
+  {
+    function original(first, second) {
+      return first + second;
+    }
+    const debounced = debounce(original, 100);
+    assert.strictEqual(debounced.name, original.name);
+    assert.strictEqual(debounced.length, original.length);
+  }
+
+  {
+    let timeoutCount = 0;
+    const hook = createHook({
+      init(_asyncId, type) {
+        if (type === 'Timeout') timeoutCount++;
+      },
+    });
+    const debounced = debounce(common.mustCall((value) => value), 100);
+    hook.enable();
+    const first = debounced(1);
+    const second = debounced(2);
+    const third = debounced(3);
+    hook.disable();
+    assert.strictEqual(timeoutCount, 1);
+    debounced.flush();
+    assert.deepStrictEqual(await Promise.all([first, second, third]), [3, 3, 3]);
+  }
+
+  {
+    const debounced = debounce(common.mustNotCall(), 100);
+    debounced();
+    const pending = debounced();
+    const { promise, resolve } = Promise.withResolvers();
+    process.once('unhandledRejection', common.mustCall((error, unhandled) => {
+      assert.strictEqual(error.code, 'ABORT_ERR');
+      assert.strictEqual(unhandled, pending);
+      resolve();
+    }));
+    debounced.cancel();
+    await promise;
+  }
+
+  // Give canceled timers time to expose any accidental extra invocation.
+  await setTimeout(110);
+})().then(common.mustCall());
diff --git a/test/parallel/test-util-inspect.js b/test/parallel/test-util-inspect.js
index 1278e4eed471..7c3c8f245b7b 100644
--- a/test/parallel/test-util-inspect.js
+++ b/test/parallel/test-util-inspect.js
@@ -1475,11 +1475,11 @@ if (typeof Symbol !== 'undefined') {
   assert.strictEqual(util.inspect(new ArraySubclass(1, 2, 3)),
                      'ArraySubclass(3) [ 1, 2, 3 ]');
   assert.strictEqual(util.inspect(new SetSubclass([1, 2, 3])),
-                     'SetSubclass(3) { 1, 2, 3 }');
+                     'SetSubclass(3) [Set] { 1, 2, 3 }');
   assert.strictEqual(util.inspect(new MapSubclass([['foo', 42]])),
-                     "MapSubclass(1) { 'foo' => 42 }");
+                     "MapSubclass(1) [Map] { 'foo' => 42 }");
   assert.strictEqual(util.inspect(new PromiseSubclass(() => {})),
-                     'PromiseSubclass { <pending> }');
+                     'PromiseSubclass [Promise] { <pending> }');
   assert.strictEqual(util.inspect(new SymbolNameClass()),
                      'Symbol(name) {}');
   assert.strictEqual(
@@ -1490,29 +1490,6 @@ if (typeof Symbol !== 'undefined') {
     util.inspect(Object.setPrototypeOf(x, null)),
     '[ObjectSubclass: null prototype] { foo: 42 }'
   );
-
-  class MiddleErrorPart extends Error {}
-  assert(util.inspect(new MiddleErrorPart('foo')).includes('MiddleErrorPart: foo'));
-
-  class MapClass extends Map {}
-  assert.strictEqual(util.inspect(new MapClass([['key', 'value']])),
-                     "MapClass(1) { 'key' => 'value' }");
-
-  class AbcMap extends Map {}
-  assert.strictEqual(util.inspect(new AbcMap([['key', 'value']])),
-                     "AbcMap(1) { 'key' => 'value' }");
-
-  class SetAbc extends Set {}
-  assert.strictEqual(util.inspect(new SetAbc([1, 2, 3])),
-                     'SetAbc(3) { 1, 2, 3 }');
-
-  class FooSet extends Set {}
-  assert.strictEqual(util.inspect(new FooSet([1, 2, 3])),
-                     'FooSet(3) { 1, 2, 3 }');
-
-  class Settings extends Set {}
-  assert.strictEqual(util.inspect(new Settings([1, 2, 3])),
-                     'Settings(3) [Set] { 1, 2, 3 }');
 }
 
 // Empty and circular before depth.
@@ -4070,3 +4047,16 @@ ${error.stack.split('\n').slice(1).join('\n')}`,
   const expected = "{ a: 'short string', b: [ 1, 2 ], c: { d: true } }";
   assert.strictEqual(util.inspect(obj, { breakLength: Infinity }), expected);
 }
+
+{
+  class Class {
+    get [Symbol.toStringTag]() {
+      return 'Namespaced.Class';
+    }
+  }
+
+  class DerivedClass extends Class {}
+
+  assert.strictEqual(inspect(new Class()), 'Namespaced.Class {}');
+  assert.strictEqual(inspect(new DerivedClass()), 'DerivedClass [Namespaced.Class] {}');
+}
diff --git a/test/parallel/test-util-throttle-timing.js b/test/parallel/test-util-throttle-timing.js
new file mode 100644
index 000000000000..56b6c7716a92
--- /dev/null
+++ b/test/parallel/test-util-throttle-timing.js
@@ -0,0 +1,170 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const { mock } = require('node:test');
+const { setImmediate } = require('node:timers/promises');
+const { internalBinding } = require('internal/test/binding');
+
+// Throttle uses the libuv clock as well as timers. Control both before loading
+// the implementation, which captures setTimeout and clearTimeout.
+mock.timers.enable({ apis: ['Date', 'setTimeout'] });
+mock.method(internalBinding('timers'), 'getLibuvNow', () => Date.now());
+const { throttle } = require('node:util');
+
+process.on('unhandledRejection', common.mustNotCall());
+
+(async () => {
+  {
+    const values = [];
+    const times = [];
+    const start = Date.now();
+    const throttled = throttle(common.mustCall(function(value) {
+      assert.strictEqual(this, throttled);
+      values.push(value);
+      times.push(Date.now() - start);
+      return value;
+    }, 5), 2, 40);
+
+    assert.strictEqual(typeof throttled.cancel, 'function');
+    assert.strictEqual(typeof throttled.hasImmediateCapacity, 'function');
+    assert.strictEqual(typeof throttled.ref, 'function');
+    assert.strictEqual(typeof throttled.unref, 'function');
+    assert.strictEqual(throttled.pending, null);
+    assert.strictEqual(throttled.pendingCount, 0);
+    assert.strictEqual(throttled.activeCount, 0);
+    assert.strictEqual(throttled.hasImmediateCapacity(), true);
+
+    const first = throttled(1);
+    const second = throttled(2);
+    const third = throttled(3);
+    const fourth = throttled(4);
+    const fifth = throttled(5);
+
+    assert(first instanceof Promise);
+    assert(second instanceof Promise);
+    assert.notStrictEqual(first, second);
+    assert.deepStrictEqual(values, [1, 2]);
+    assert.strictEqual(throttled.hasImmediateCapacity(), false);
+    assert.strictEqual(throttled.pending, fifth);
+    assert.strictEqual(throttled.pendingCount, 3);
+    assert.strictEqual(throttled.unref(), throttled);
+    assert.strictEqual(throttled.ref(), throttled);
+
+    mock.timers.tick(39);
+    assert.deepStrictEqual(values, [1, 2]);
+    mock.timers.tick(1);
+    assert.deepStrictEqual(values, [1, 2, 3, 4]);
+    assert.strictEqual(throttled.pendingCount, 1);
+    mock.timers.tick(39);
+    assert.deepStrictEqual(values, [1, 2, 3, 4]);
+    mock.timers.tick(1);
+
+    assert.deepStrictEqual(
+      await Promise.all([first, second, third, fourth, fifth]),
+      [1, 2, 3, 4, 5],
+    );
+    assert.deepStrictEqual(values, [1, 2, 3, 4, 5]);
+    assert.strictEqual(throttled.pending, null);
+    assert.strictEqual(throttled.pendingCount, 0);
+    assert.strictEqual(throttled.activeCount, 0);
+    assert.deepStrictEqual(times, [0, 0, 40, 40, 80]);
+  }
+
+  {
+    const values = [];
+    const throttled = throttle(common.mustCall((value) => {
+      values.push(value);
+      return value;
+    }, 2), 1, 20, { maxPending: 1 });
+    const first = throttled(1);
+    const second = throttled(2);
+    const dropped = throttled(3);
+
+    assert.deepStrictEqual(values, [1]);
+    assert.strictEqual(throttled.pendingCount, 1);
+    await setImmediate();
+    await assert.rejects(dropped, { code: 'ERR_THROTTLED' });
+    mock.timers.tick(19);
+    assert.deepStrictEqual(values, [1]);
+    mock.timers.tick(1);
+    assert.deepStrictEqual(await Promise.all([first, second]), [1, 2]);
+    assert.deepStrictEqual(values, [1, 2]);
+  }
+
+  {
+    const values = [];
+    const throttled = throttle(common.mustCall((value) => {
+      values.push(value);
+      return value;
+    }, 3), 2, 30, { overflow: 'drop' });
+    const first = throttled(1);
+    const second = throttled(2);
+    await assert.rejects(throttled(3), { code: 'ERR_THROTTLED' });
+    assert.deepStrictEqual(await Promise.all([first, second]), [1, 2]);
+
+    mock.timers.tick(29);
+    assert.strictEqual(throttled.hasImmediateCapacity(), false);
+    await assert.rejects(throttled(4), { code: 'ERR_THROTTLED' });
+    mock.timers.tick(1);
+    assert.strictEqual(throttled.hasImmediateCapacity(), true);
+    assert.strictEqual(await throttled(5), 5);
+    assert.deepStrictEqual(values, [1, 2, 5]);
+  }
+
+  // A rolling window releases one slot at a time when timers run on schedule.
+  // If dispatch is delayed until both slots expire, both calls may run together.
+  for (const delayed of [false, true]) {
+    const times = [];
+    const start = Date.now();
+    const throttled = throttle(common.mustCall((value) => {
+      times.push(Date.now() - start);
+      return value;
+    }, 4), 2, 80, { strict: true });
+
+    const first = throttled(1);
+    mock.timers.tick(40);
+    const second = throttled(2);
+    const third = throttled(3);
+    const fourth = throttled(4);
+
+    mock.timers.tick(39);
+    assert.deepStrictEqual(times, [0, 40]);
+    if (delayed) {
+      mock.timers.tick(41);
+    } else {
+      mock.timers.tick(1);
+      assert.deepStrictEqual(times, [0, 40, 80]);
+      mock.timers.tick(39);
+      assert.deepStrictEqual(times, [0, 40, 80]);
+      mock.timers.tick(1);
+    }
+
+    assert.deepStrictEqual(
+      await Promise.all([first, second, third, fourth]),
+      [1, 2, 3, 4],
+    );
+    assert.deepStrictEqual(times, delayed ? [0, 40, 120, 120] : [0, 40, 80, 120]);
+  }
+
+  {
+    let recursive;
+    const values = [];
+    const throttled = throttle(common.mustCall((value) => {
+      values.push(value);
+      if (value === 1) recursive = throttled(2);
+      return value;
+    }, 2), 1, 20);
+
+    const first = throttled(1);
+    assert.deepStrictEqual(values, [1]);
+    assert.strictEqual(throttled.pending, recursive);
+    assert.strictEqual(throttled.pendingCount, 1);
+    mock.timers.tick(19);
+    assert.deepStrictEqual(values, [1]);
+    mock.timers.tick(1);
+    assert.deepStrictEqual(await Promise.all([first, recursive]), [1, 2]);
+    assert.deepStrictEqual(values, [1, 2]);
+  }
+})().then(common.mustCall()).finally(() => mock.reset());
diff --git a/test/parallel/test-util-throttle.js b/test/parallel/test-util-throttle.js
new file mode 100644
index 000000000000..b22fb4630e7e
--- /dev/null
+++ b/test/parallel/test-util-throttle.js
@@ -0,0 +1,345 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const { createHook } = require('node:async_hooks');
+const { setImmediate } = require('node:timers/promises');
+const { throttle } = require('node:util');
+const { TIMEOUT_MAX } = require('internal/timers');
+
+process.on('unhandledRejection', common.mustNotCall());
+
+for (const value of [undefined, null, true, 0, 'fn', {}, [], Symbol()]) {
+  assert.throws(() => throttle(value, 1, 1), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+}
+
+for (const value of [undefined, null, true, '1', {}, [], Symbol()]) {
+  assert.throws(() => throttle(() => {}, value, 1), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+}
+
+for (const value of [-1, 0, 0.5, NaN, Infinity]) {
+  assert.throws(() => throttle(() => {}, value, 1), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+}
+
+for (const value of [undefined, null, true, '1', {}, [], Symbol()]) {
+  assert.throws(() => throttle(() => {}, 1, value), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+}
+
+for (const value of [-1, 0.5, NaN, Infinity, TIMEOUT_MAX + 1]) {
+  assert.throws(() => throttle(() => {}, 1, value), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+}
+
+for (const value of [null, true, 1, 'options', []]) {
+  assert.throws(() => throttle(() => {}, 1, 1, value), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+}
+
+assert.throws(() => throttle(() => {}, 1, 1, { signal: {} }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => throttle(() => {}, 1, 1, { strict: 1 }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+
+for (const value of [null, true, 0, 'invalid', {}, []]) {
+  assert.throws(() => throttle(() => {}, 1, 1, { overflow: value }), {
+    code: 'ERR_INVALID_ARG_VALUE',
+  });
+}
+
+for (const option of ['concurrency', 'maxPending']) {
+  for (const value of [null, true, '1', {}, [], Symbol()]) {
+    assert.throws(() => throttle(() => {}, 1, 1, { [option]: value }), {
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+  }
+}
+
+for (const value of [-1, 0, 0.5, NaN, -Infinity]) {
+  assert.throws(() => throttle(() => {}, 1, 1, { concurrency: value }), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+}
+
+for (const value of [-1, 0.5, NaN, -Infinity]) {
+  assert.throws(() => throttle(() => {}, 1, 1, { maxPending: value }), {
+    code: 'ERR_OUT_OF_RANGE',
+  });
+}
+
+// Explicit Infinity values are accepted.
+throttle(() => {}, 1, 1, {
+  concurrency: Infinity,
+  maxPending: Infinity,
+});
+
+{
+  const reason = new Error('already aborted');
+  assert.throws(
+    () => throttle(() => {}, 1, 1, {
+      signal: AbortSignal.abort(reason),
+    }),
+    (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+  );
+}
+
+// Keep windows open across synchronous assertions, even if the process is
+// descheduled. Window expiration is covered in test-util-throttle-timing.js.
+(async () => {
+  {
+    let running = 0;
+    let maxRunning = 0;
+    let timeoutCount = 0;
+    const releases = [];
+    const values = [];
+    const hook = createHook({
+      init(_asyncId, type) {
+        if (type === 'Timeout') timeoutCount++;
+      },
+    });
+    const throttled = throttle(common.mustCall((value) => {
+      running++;
+      maxRunning = Math.max(maxRunning, running);
+      values.push(value);
+      const { promise, resolve } = Promise.withResolvers();
+      releases.push(() => {
+        running--;
+        resolve(value);
+      });
+      return promise;
+    }, 4), 10, 1_000, { concurrency: 2 });
+
+    hook.enable();
+    const calls = [
+      throttled(1),
+      throttled(2),
+      throttled(3),
+      throttled(4),
+    ];
+    hook.disable();
+
+    assert.deepStrictEqual(values, [1, 2]);
+    assert.strictEqual(throttled.hasImmediateCapacity(), false);
+    assert.strictEqual(throttled.activeCount, 2);
+    assert.strictEqual(throttled.pendingCount, 2);
+    assert.strictEqual(timeoutCount, 0);
+
+    releases[0]();
+    await setImmediate();
+    assert.deepStrictEqual(values, [1, 2, 3]);
+    assert.strictEqual(throttled.activeCount, 2);
+    assert.strictEqual(throttled.pendingCount, 1);
+
+    releases[1]();
+    await setImmediate();
+    assert.deepStrictEqual(values, [1, 2, 3, 4]);
+    assert.strictEqual(throttled.activeCount, 2);
+    assert.strictEqual(throttled.pendingCount, 0);
+
+    releases[2]();
+    releases[3]();
+    assert.deepStrictEqual(await Promise.all(calls), [1, 2, 3, 4]);
+    assert.strictEqual(throttled.activeCount, 0);
+    assert.strictEqual(maxRunning, 2);
+  }
+
+  {
+    const deferred = Promise.withResolvers();
+    const throttled = throttle(common.mustCall(() => deferred.promise), 10, 100, {
+      concurrency: 1,
+      overflow: 'drop',
+    });
+    const first = throttled();
+    const dropped = throttled();
+
+    assert.strictEqual(throttled.activeCount, 1);
+    assert.strictEqual(throttled.pendingCount, 0);
+    assert.strictEqual(throttled.hasImmediateCapacity(), false);
+    await setImmediate();
+    await assert.rejects(dropped, { code: 'ERR_THROTTLED' });
+    deferred.resolve('result');
+    assert.strictEqual(await first, 'result');
+    assert.strictEqual(throttled.activeCount, 0);
+  }
+
+  {
+    let timeoutCount = 0;
+    const hook = createHook({
+      init(_asyncId, type) {
+        if (type === 'Timeout') timeoutCount++;
+      },
+    });
+    const values = [];
+    const throttled = throttle(common.mustCall((value) => {
+      values.push(value);
+      return value;
+    }, 3), 2, TIMEOUT_MAX, { overflow: 'drop' });
+
+    hook.enable();
+    const first = throttled(1);
+    const second = throttled(2);
+    const dropped = throttled(3);
+    hook.disable();
+
+    assert.deepStrictEqual(values, [1, 2]);
+    assert.strictEqual(timeoutCount, 0);
+    assert.strictEqual(throttled.pending, null);
+    assert.strictEqual(throttled.pendingCount, 0);
+    await setImmediate();
+    await assert.rejects(dropped, { code: 'ERR_THROTTLED' });
+    assert.deepStrictEqual(await Promise.all([first, second]), [1, 2]);
+
+    throttled.cancel();
+    assert.strictEqual(await throttled(4), 4);
+    assert.deepStrictEqual(values, [1, 2, 4]);
+  }
+
+  {
+    const reason = new Error('cancelled');
+    const throttled = throttle(common.mustCall((value) => value, 2), 1, TIMEOUT_MAX);
+    const first = throttled(1);
+    const second = throttled(2);
+    const third = throttled(3);
+    const secondRejection = assert.rejects(
+      second,
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+    const thirdRejection = assert.rejects(
+      third,
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+
+    throttled.cancel(reason);
+    assert.strictEqual(throttled.pending, null);
+    assert.strictEqual(throttled.pendingCount, 0);
+    assert.strictEqual(await first, 1);
+    await Promise.all([secondRejection, thirdRejection]);
+
+    // Canceling resets the limiter, so the next call can run immediately.
+    assert.strictEqual(await throttled(4), 4);
+    throttled.cancel();
+  }
+
+  {
+    const reason = new Error('stop');
+    const controller = new AbortController();
+    const throttled = throttle(common.mustCall((value) => value), 1, TIMEOUT_MAX, {
+      signal: controller.signal,
+    });
+    const first = throttled(1);
+    const second = throttled(2);
+    const secondRejection = assert.rejects(
+      second,
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+
+    controller.abort(reason);
+    assert.strictEqual(throttled.hasImmediateCapacity(), false);
+    assert.strictEqual(await first, 1);
+    await secondRejection;
+    assert.strictEqual(throttled.pending, null);
+    assert.strictEqual(throttled.pendingCount, 0);
+    await assert.rejects(
+      throttled(3),
+      (error) => error.code === 'ABORT_ERR' && error.cause === reason,
+    );
+  }
+
+  {
+    const expected = new Error('failure');
+    const throttled = throttle(common.mustCall((value) => {
+      if (value === 2) throw expected;
+      return value;
+    }, 2), 1, 20);
+
+    assert.strictEqual(await throttled(1), 1);
+    await assert.rejects(throttled(2), (error) => error === expected);
+  }
+
+  {
+    const expected = new Error('async failure');
+    const throttled = throttle(common.mustCall(async () => {
+      throw expected;
+    }), 1, 0);
+    await assert.rejects(throttled(), (error) => error === expected);
+  }
+
+  {
+    function original(first, second) {
+      return first + second;
+    }
+    const throttled = throttle(original, 1, 0);
+    assert.strictEqual(throttled.name, original.name);
+    assert.strictEqual(throttled.length, original.length);
+    assert.strictEqual(await throttled(1, 2), 3);
+  }
+
+  {
+    const values = [];
+    const throttled = throttle(common.mustCall((value) => {
+      values.push(value);
+      return value;
+    }, 5), 1, 0);
+    const calls = [];
+    for (let i = 0; i < 5; i++) calls.push(throttled(i));
+    assert.deepStrictEqual(values, [0, 1, 2, 3, 4]);
+    assert.deepStrictEqual(await Promise.all(calls), [0, 1, 2, 3, 4]);
+  }
+
+  {
+    let timeoutCount = 0;
+    const hook = createHook({
+      init(_asyncId, type) {
+        if (type === 'Timeout') timeoutCount++;
+      },
+    });
+    const throttled = throttle(common.mustCall((value) => value), 1, TIMEOUT_MAX);
+
+    hook.enable();
+    assert.strictEqual(throttled.hasImmediateCapacity(), true);
+    const call = throttled(1);
+    assert.strictEqual(throttled.hasImmediateCapacity(), false);
+    if (throttled.hasImmediateCapacity()) throttled(2);
+    hook.disable();
+
+    assert.strictEqual(timeoutCount, 0);
+    assert.strictEqual(throttled.pendingCount, 0);
+    assert.strictEqual(await call, 1);
+  }
+
+  {
+    let timeoutCount = 0;
+    const hook = createHook({
+      init(_asyncId, type) {
+        if (type === 'Timeout') timeoutCount++;
+      },
+    });
+    const throttled = throttle(common.mustCall((value) => value), 1, TIMEOUT_MAX);
+    hook.enable();
+    const first = throttled(1);
+    const second = throttled(2);
+    const third = throttled(3);
+    hook.disable();
+    const secondRejection = assert.rejects(second, { code: 'ABORT_ERR' });
+    const thirdRejection = assert.rejects(third, { code: 'ABORT_ERR' });
+
+    assert.strictEqual(timeoutCount, 1);
+    assert.strictEqual(throttled.unref(), throttled);
+    assert.strictEqual(throttled.ref(), throttled);
+    throttled.cancel();
+    assert.strictEqual(await first, 1);
+    await Promise.all([secondRejection, thirdRejection]);
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-web-locks-no-livelock.js b/test/parallel/test-web-locks-no-livelock.js
new file mode 100644
index 000000000000..d654acb2b353
--- /dev/null
+++ b/test/parallel/test-web-locks-no-livelock.js
@@ -0,0 +1,51 @@
+// Flags: --expose-internals
+// Regression test for https://github.com/nodejs/node/issues/62644.
+'use strict';
+
+const common = require('../common');
+if (!common.isDebug) {
+  common.skip('Only works in debug mode');
+}
+
+const assert = require('node:assert');
+const { once } = require('node:events');
+const {
+  isMainThread,
+  parentPort,
+  workerData,
+  Worker,
+} = require('node:worker_threads');
+
+const resource = `web-locks-no-livelock`;
+
+if (!isMainThread) {
+  // A pending lock request alone does not keep the worker alive, so keep a
+  // message listener until the parent terminates this Environment.
+  parentPort.on('message', () => {});
+  navigator.locks.request(workerData, () => {});
+  parentPort.postMessage('ready');
+} else {
+  const { internalBinding } = require('internal/test/binding');
+  const { getGenericUsageCount } = internalBinding('debug');
+  const wakeCounter = 'LockManager.WakeEnvironment';
+
+  (async () => {
+    let worker;
+    let pendingInMain;
+    await navigator.locks.request(resource, common.mustCall(async () => {
+      // The worker queues an exclusive request for the resource held above.
+      worker = new Worker(__filename, { workerData: resource });
+      await once(worker, 'message');
+
+      // Queueing a second blocked request must not wake the worker: its
+      // request cannot make progress, so the two Environments would wake
+      // each other forever (livelock).
+      const wakeCount = getGenericUsageCount(wakeCounter);
+      pendingInMain = navigator.locks.request(resource, common.mustCall());
+      assert.strictEqual(getGenericUsageCount(wakeCounter), wakeCount);
+    }));
+
+    await pendingInMain;
+    await worker.terminate();
+  })().then(common.mustCall());
+}
diff --git a/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js b/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js
index 316d706e7b79..8ac5125b276c 100644
--- a/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js
+++ b/test/parallel/test-webcrypto-aead-decrypt-detached-buffer.js
@@ -6,10 +6,17 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const fips3 = hasFIPS(3);
 
-async function test(algorithmName, keyLength, ivLength, format = 'raw') {
+async function test(
+  algorithmName,
+  keyLength,
+  ivLength,
+  format = 'raw',
+  causeMessage,
+) {
   const key = await subtle.importKey(
     format,
     new Uint8Array(keyLength),
@@ -21,19 +28,40 @@ async function test(algorithmName, keyLength, ivLength, format = 'raw') {
   const data = new Uint8Array(32);
   data.buffer.transfer();
 
+  const expected = causeMessage === undefined ?
+    { name: 'OperationError' } :
+    (err) => err.name === 'OperationError' &&
+             err.cause?.message === causeMessage;
   await assert.rejects(
     subtle.decrypt({ name: algorithmName, iv: new Uint8Array(ivLength) }, key, data),
-    { name: 'OperationError' },
+    expected,
   );
 }
 
 const tests = [
   test('AES-GCM', 32, 12),
-  test('ChaCha20-Poly1305', 32, 12, 'raw-secret'),
 ];
 
+if (fips3) {
+  tests.push(assert.rejects(
+    subtle.importKey(
+      'raw-secret',
+      new Uint8Array(32),
+      'ChaCha20-Poly1305',
+      false,
+      ['encrypt', 'decrypt']),
+    { name: 'NotSupportedError' }));
+} else {
+  tests.push(test('ChaCha20-Poly1305', 32, 12, 'raw-secret'));
+}
+
 if (hasOpenSSL(3)) {
-  tests.push(test('AES-OCB', 32, 12, 'raw-secret'));
+  tests.push(test(
+    'AES-OCB',
+    32,
+    12,
+    'raw-secret',
+    fips3 ? 'error:0308010C:digital envelope routines::unsupported' : undefined));
 }
 
 Promise.all(tests).then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-constructors.js b/test/parallel/test-webcrypto-constructors.js
index 782265edc294..3d13b6c92bba 100644
--- a/test/parallel/test-webcrypto-constructors.js
+++ b/test/parallel/test-webcrypto-constructors.js
@@ -6,7 +6,9 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const fips4 = hasFIPS(4);
 
 // Test CryptoKey constructor
 {
@@ -152,19 +154,41 @@ const notSubtle = Reflect.construct(function() {}, [], SubtleCrypto);
 }
 
 {
-  subtle.importKey(
-    'raw',
-    globalThis.crypto.getRandomValues(new Uint8Array(4)),
-    'PBKDF2',
-    false,
-    ['deriveKey'],
-  ).then((key) => {
+  const keyData = globalThis.crypto.getRandomValues(
+    new Uint8Array(fips4 ? 8 : 4));
+  const importedKeys = [
+    subtle.importKey('raw', keyData, 'PBKDF2', false, ['deriveKey']),
+  ];
+  if (fips4) {
+    importedKeys.push(
+      subtle.importKey(
+        'raw',
+        globalThis.crypto.getRandomValues(new Uint8Array(4)),
+        'PBKDF2',
+        false,
+        ['deriveKey']));
+  }
+
+  Promise.all(importedKeys).then(async ([key, weakKey]) => {
     subtle.importKey = common.mustNotCall();
-    return subtle.deriveKey({
+    if (fips4) {
+      await assert.rejects(subtle.deriveKey({
+        name: 'PBKDF2',
+        hash: 'SHA-512',
+        salt: new Uint8Array(),
+        iterations: 5,
+      }, weakKey, {
+        name: 'AES-GCM',
+        length: 256,
+      }, true, ['encrypt', 'decrypt']), { name: 'OperationError' });
+    }
+
+    await subtle.deriveKey({
       name: 'PBKDF2',
       hash: 'SHA-512',
-      salt: globalThis.crypto.getRandomValues(new Uint8Array()),
-      iterations: 5,
+      salt: globalThis.crypto.getRandomValues(
+        new Uint8Array(fips4 ? 16 : 0)),
+      iterations: fips4 ? 1000 : 5,
     }, key, {
       name: 'AES-GCM',
       length: 256
diff --git a/test/parallel/test-webcrypto-crypto-job-mode.js b/test/parallel/test-webcrypto-crypto-job-mode.js
index 327c6a6f154c..5f5f1761a4c7 100644
--- a/test/parallel/test-webcrypto-crypto-job-mode.js
+++ b/test/parallel/test-webcrypto-crypto-job-mode.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { types: { isCryptoKey } } = require('util');
 const { internalBinding } = require('internal/test/binding');
 const {
@@ -211,7 +211,7 @@ async function withObjectPrototypeSetters(names, fn) {
     }
   }
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     const pair = await subtle.generateKey(
       { name: 'ML-KEM-768' },
       true,
diff --git a/test/parallel/test-webcrypto-cryptokey-brand-check.js b/test/parallel/test-webcrypto-cryptokey-brand-check.js
index 3fe8aaa181a2..9174aebe8f05 100644
--- a/test/parallel/test-webcrypto-cryptokey-brand-check.js
+++ b/test/parallel/test-webcrypto-cryptokey-brand-check.js
@@ -1,13 +1,10 @@
 'use strict';
 
-// The four CryptoKey prototype getters (`type`, `extractable`,
-// `algorithm`, `usages`) are user-configurable per Web IDL, so they
-// can be invoked with an arbitrary `this`. The native callbacks that
-// implement them must brand-check their receiver and throw cleanly
-// (ERR_INVALID_THIS) rather than crashing the process or returning
-// garbage. This test exercises four progressively more hostile
-// receiver shapes, including subverting `instanceof` via
-// `Symbol.hasInstance`, to make sure the C++ brand check holds.
+// CryptoKey prototype getters and methods can be invoked with an
+// arbitrary `this`. They must brand-check their receiver and throw
+// cleanly (ERR_INVALID_THIS) rather than crashing the process or
+// returning garbage. This test exercises invalid receiver shapes,
+// including subverting `instanceof` via `Symbol.hasInstance`.
 //
 // It also verifies that `util.types.isCryptoKey()` cannot be fooled
 // by prototype spoofing.
@@ -17,7 +14,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('node:assert');
-const { types: { isCryptoKey } } = require('node:util');
+const { inspect, types: { isCryptoKey } } = require('node:util');
 const { subtle } = globalThis.crypto;
 
 (async () => {
@@ -29,22 +26,16 @@ const { subtle } = globalThis.crypto;
 
   const CryptoKey = key.constructor;
 
-  // Capture the underlying prototype getters once, so that subsequent
+  // Capture the underlying prototype members once, so that subsequent
   // tampering with `CryptoKey.prototype` cannot affect what we call.
-  const getters = {
-    type: Object.getOwnPropertyDescriptor(CryptoKey.prototype, 'type').get,
-    extractable:
-      Object.getOwnPropertyDescriptor(CryptoKey.prototype, 'extractable').get,
-    algorithm:
-      Object.getOwnPropertyDescriptor(CryptoKey.prototype, 'algorithm').get,
-    usages:
-      Object.getOwnPropertyDescriptor(CryptoKey.prototype, 'usages').get,
-  };
+  const descriptors = Object.getOwnPropertyDescriptors(CryptoKey.prototype);
 
   // Sanity: each getter works on a real CryptoKey.
-  Object.entries(getters).forEach(([name, getter]) => {
-    assert.notStrictEqual(getter.call(key), undefined, `baseline ${name}`);
-  });
+  for (const name of Reflect.ownKeys(descriptors)) {
+    const { get } = descriptors[name];
+    if (get !== undefined)
+      Reflect.apply(get, key, []);
+  }
   assert.strictEqual(isCryptoKey(key), true);
   assert.strictEqual(Object.hasOwn(CryptoKey, 'getSlots'), false);
   const internalProto = Object.getPrototypeOf(key);
@@ -54,37 +45,53 @@ const { subtle } = globalThis.crypto;
   assert.strictEqual(Object.getPrototypeOf(internalProto), CryptoKey.prototype);
 
   const invalidThis = { code: 'ERR_INVALID_THIS', name: 'TypeError' };
+  const invalidArgType = { code: 'ERR_INVALID_ARG_TYPE', name: 'TypeError' };
+
+  async function assertInvalidReceiver(receiver) {
+    for (const name of Reflect.ownKeys(descriptors)) {
+      if (name === 'constructor') continue;
+      const descriptor = descriptors[name];
+      const args = name === inspect.custom ? [0, {}] : [];
+      for (const kind of ['get', 'set', 'value']) {
+        const member = descriptor[kind];
+        if (typeof member !== 'function') continue;
+        await assert.rejects(
+          async () => Reflect.apply(member, receiver, args),
+          invalidThis,
+          `CryptoKey.${String(name)} (${kind})`,
+        );
+      }
+    }
+  }
 
   // Plain object receiver.
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call({}), invalidThis);
-  });
+  await assertInvalidReceiver({});
 
   // Null-prototype object receiver.
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call({ __proto__: null }), invalidThis);
-  });
+  await assertInvalidReceiver({ __proto__: null });
 
   // Primitive receiver.
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call(1), invalidThis);
-  });
+  await assertInvalidReceiver(1);
 
   // Null.
-  Object.entries(getters).forEach(([, getter]) => {
-    // eslint-disable-next-line no-useless-call
-    assert.throws(() => getter.call(null), invalidThis);
-  });
+  await assertInvalidReceiver(null);
 
   // Undefined.
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call(), invalidThis);
-  });
+  await assertInvalidReceiver(undefined);
 
   // Function
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call(function() {}), invalidThis);
-  });
+  await assertInvalidReceiver(function() {});
+
+  const revoked = Proxy.revocable(key, {});
+  revoked.revoke();
+  for (const receiver of [
+    { __proto__: CryptoKey.prototype },
+    { __proto__: key },
+    new Proxy(key, {}),
+    revoked.proxy,
+  ]) {
+    await assertInvalidReceiver(receiver);
+  }
 
   // Prototype spoofing with InternalCryptoKey.prototype must not pass
   // util.types.isCryptoKey().
@@ -94,10 +101,10 @@ const { subtle } = globalThis.crypto;
   assert.strictEqual(isCryptoKey(spoofed), false);
   await assert.rejects(
     subtle.sign('HMAC', spoofed, Buffer.from('payload')),
-    invalidThis);
+    invalidArgType);
   await assert.rejects(
     subtle.exportKey('jwk', spoofed),
-    invalidThis);
+    invalidArgType);
 
   // Subvert `instanceof CryptoKey` via Symbol.hasInstance, then
   // invoke the native getters on a forged object. The C++ tag
@@ -110,9 +117,7 @@ const { subtle } = globalThis.crypto;
   const fake = { foo: 'bar' };
   assert.strictEqual(fake instanceof CryptoKey, true);
   assert.strictEqual(isCryptoKey(fake), false);
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call(fake), invalidThis);
-  });
+  await assertInvalidReceiver(fake);
 
   // Subverted `instanceof` plus a real BaseObject of a different
   // kind (a Buffer) as the receiver. Without the C++ tag check
@@ -120,13 +125,11 @@ const { subtle } = globalThis.crypto;
   const buf = Buffer.alloc(16);
   assert.strictEqual(buf instanceof CryptoKey, true);
   assert.strictEqual(isCryptoKey(buf), false);
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call(buf), invalidThis);
-  });
+  await assertInvalidReceiver(buf);
 
   // The real CryptoKey continues to work after all of the above.
-  assert.strictEqual(getters.type.call(key), 'secret');
-  assert.strictEqual(getters.extractable.call(key), true);
-  assert.strictEqual(getters.algorithm.call(key).name, 'HMAC');
-  assert.deepStrictEqual(getters.usages.call(key), ['sign']);
+  assert.strictEqual(descriptors.type.get.call(key), 'secret');
+  assert.strictEqual(descriptors.extractable.get.call(key), true);
+  assert.strictEqual(descriptors.algorithm.get.call(key).name, 'HMAC');
+  assert.deepStrictEqual(descriptors.usages.get.call(key), ['sign']);
 })().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-cryptokey-clone-transfer.js b/test/parallel/test-webcrypto-cryptokey-clone-transfer.js
index 4983e1c0bda3..2567ac69454d 100644
--- a/test/parallel/test-webcrypto-cryptokey-clone-transfer.js
+++ b/test/parallel/test-webcrypto-cryptokey-clone-transfer.js
@@ -17,6 +17,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('node:assert');
+const { KeyObject } = require('node:crypto');
 const { inspect } = require('node:util');
 const { once } = require('node:events');
 const { Worker, MessageChannel } = require('node:worker_threads');
@@ -320,6 +321,17 @@ async function checkRsaPssTransferToWorker({ publicKey, privateKey }) {
         { name: 'AES-GCM', iv }, k, ciphertext);
       assert.deepStrictEqual(Buffer.from(decrypted), plaintext);
     }
+
+    const bytes = new Uint8Array(await subtle.exportKey('raw', key));
+    const nullPrototypeClone = structuredClone(key);
+    Object.setPrototypeOf(nullPrototypeClone, null);
+    assert.deepStrictEqual(
+      new Uint8Array(await subtle.exportKey('raw', nullPrototypeClone)), bytes);
+    const typeGetter = Object.getOwnPropertyDescriptor(key.constructor.prototype, 'type').get;
+    const customInspect = key[inspect.custom];
+    assert.strictEqual(typeGetter.call(nullPrototypeClone), 'secret');
+    assert.strictEqual(typeof customInspect.call(nullPrototypeClone, 0, {}), 'string');
+    assert.deepStrictEqual(KeyObject.from(structuredClone(key)).export(), Buffer.from(bytes));
   }
 
   // ECDSA keypair (public extractable, private non-extractable)
diff --git a/test/parallel/test-webcrypto-cryptokey-hidden-slots.js b/test/parallel/test-webcrypto-cryptokey-hidden-slots.js
index 792a1a59c4c5..75b977073dab 100644
--- a/test/parallel/test-webcrypto-cryptokey-hidden-slots.js
+++ b/test/parallel/test-webcrypto-cryptokey-hidden-slots.js
@@ -22,6 +22,7 @@ if (!common.hasCrypto)
 const assert = require('node:assert');
 const {
   createHmac,
+  getFips,
   KeyObject,
   sign: cryptoSign,
   verify: cryptoVerify,
@@ -50,7 +51,7 @@ common.expectWarning({
   const { publicKey: rsaPublicKey } = await subtle.generateKey(
     {
       name: 'RSA-PSS',
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-256',
     },
diff --git a/test/parallel/test-webcrypto-deduplicate-usages.js b/test/parallel/test-webcrypto-deduplicate-usages.js
index ebd1b4683fc6..56feda2c7bdc 100644
--- a/test/parallel/test-webcrypto-deduplicate-usages.js
+++ b/test/parallel/test-webcrypto-deduplicate-usages.js
@@ -13,7 +13,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const { createSecretKey } = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
 function assertSameSet(actual, expected, msg) {
@@ -50,6 +50,10 @@ function assertSameSet(actual, expected, msg) {
       expected: ['encrypt', 'decrypt', 'wrapKey', 'unwrapKey'] },
   ];
 
+  if (hasFIPS(3))
+    symmetric.splice(symmetric.findIndex(({ algorithm }) =>
+      algorithm.name === 'ChaCha20-Poly1305'), 1);
+
   if (hasOpenSSL(3)) {
     symmetric.push({
       algorithm: { name: 'AES-OCB', length: 128 },
@@ -107,7 +111,11 @@ function assertSameSet(actual, expected, msg) {
       privateExpected: ['deriveKey', 'deriveBits'] },
   ];
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasFIPS(3))
+    asymmetric.splice(asymmetric.findIndex(({ algorithm }) =>
+      algorithm.name === 'X25519'), 1);
+
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     asymmetric.push({
       algorithm: { name: 'ML-DSA-65' },
       usages: ['verify', 'sign', 'verify', 'sign'],
@@ -289,7 +297,7 @@ function assertSameSet(actual, expected, msg) {
     assert.deepStrictEqual(imported.usages, ['sign']);
   })());
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     // ML-DSA JWK roundtrip.
     tests.push((async () => {
       const { privateKey } = await subtle.generateKey(
@@ -322,12 +330,17 @@ function assertSameSet(actual, expected, msg) {
 
   // ChaCha20-Poly1305 raw-secret import.
   tests.push((async () => {
-    const key = await subtle.importKey(
+    const imported = subtle.importKey(
       'raw-secret',
       new Uint8Array(32),
       { name: 'ChaCha20-Poly1305' },
       true,
       ['decrypt', 'encrypt', 'decrypt', 'encrypt']);
+    if (hasFIPS(3)) {
+      await assert.rejects(imported, { name: 'NotSupportedError' });
+      return;
+    }
+    const key = await imported;
     assertSameSet(key.usages, ['encrypt', 'decrypt']);
     assert.strictEqual(key.usages.length, 2);
   })());
@@ -477,7 +490,11 @@ function assertSameSet(actual, expected, msg) {
       privateExpected: ['deriveKey', 'deriveBits'] },
   ];
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasFIPS(3))
+    jwkPairVectors.splice(jwkPairVectors.findIndex(({ algorithm }) =>
+      algorithm.name === 'X25519'), 1);
+
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     jwkPairVectors.push({
       algorithm: { name: 'ML-DSA-65' },
       usages: ['verify', 'sign', 'verify', 'sign'],
diff --git a/test/parallel/test-webcrypto-derivebits-argon2.js b/test/parallel/test-webcrypto-derivebits-argon2.js
index e2b465ab206b..129b716c5919 100644
--- a/test/parallel/test-webcrypto-derivebits-argon2.js
+++ b/test/parallel/test-webcrypto-derivebits-argon2.js
@@ -5,10 +5,12 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 2))
   common.skip('requires OpenSSL >= 3.2');
+if (hasFIPS(3))
+  common.skip('Argon2 is not available in FIPS mode');
 
 const assert = require('assert');
 const { createSecretKey } = require('crypto');
diff --git a/test/parallel/test-webcrypto-derivebits-cfrg.js b/test/parallel/test-webcrypto-derivebits-cfrg.js
index 757c81272536..d2fbb2998ae1 100644
--- a/test/parallel/test-webcrypto-derivebits-cfrg.js
+++ b/test/parallel/test-webcrypto-derivebits-cfrg.js
@@ -6,7 +6,9 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const rejectsXCurves = hasFIPS(3, 5);
 
 const kTests = [
   {
@@ -20,7 +22,7 @@ const kTests = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kTests.push(
     {
       name: 'X448',
@@ -77,6 +79,15 @@ async function prepareKeys() {
     Object.keys(keys).map(async (name) => {
       const { size, result, privateKey, publicKey } = keys[name];
 
+      if (rejectsXCurves) {
+        await assert.rejects(
+          subtle.deriveBits({ name, public: publicKey }, privateKey, 8 * size),
+          (err) => err.name === 'OperationError' &&
+                   err.cause?.message ===
+                     'error:03000096:digital envelope routines::operation not supported for this keytype');
+        return;
+      }
+
       {
         // Good parameters
         const bits = await subtle.deriveBits({
diff --git a/test/parallel/test-webcrypto-derivebits-hkdf.js b/test/parallel/test-webcrypto-derivebits-hkdf.js
index d2057d1f782e..fafd6a7afa58 100644
--- a/test/parallel/test-webcrypto-derivebits-hkdf.js
+++ b/test/parallel/test-webcrypto-derivebits-hkdf.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
 function getDeriveKeyInfo(name, length, hash, ...usages) {
@@ -28,7 +28,7 @@ const kDerivedKeyTypes = [
   ['AES-KW', 256, undefined, 'wrapKey', 'unwrapKey'],
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kDerivedKeyTypes.push(
     ['HMAC', 256, 'SHA3-256', 'sign', 'verify'],
     ['HMAC', 256, 'SHA3-384', 'sign', 'verify'],
@@ -91,7 +91,7 @@ const kDerivations = {
         empty: '9e4b719033742101e90f1ad61e2ff3b4' +
                '256863667296d74389f1f02af2c4e6a6'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: '386b0693d7a58c4ddf01b49bfbbd2fa87c6f911991543995170ba20ed28df599',
           empty: 'd029bc828b6c6c8bb16ce3d25f5058f19c7d2517745e11c5d65c6d242e82e47f',
@@ -131,7 +131,7 @@ const kDerivations = {
         empty: 'c8e12774135305c9147f2cc4766e5ead' +
                '25d8f457b9a1953d52677361ced558fb'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: '9befc557f5baf4075b5fb38c014b41b92ab7534150baf64201069e8807d0e83d',
           empty: '54d1fa1aa7cad99dab0622b772170e775c103756183bac36a228fd817a98a3f6',
@@ -173,7 +173,7 @@ const kDerivations = {
         empty: 'e579d1f9e7f08e6f990ffcfcce1ed201' +
                'c5e37e62cdf606f0ba4aca80427fbc44'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: '24f38fd1905554b7cbf8395cc3976292d11ce24a0b3131da0fd4b109832d27e3',
           empty: '33d0a5151c0f52e4bb7fb67cf7a17063127624dc3e685903f49ebb07872084d1',
@@ -213,7 +213,7 @@ const kDerivations = {
         empty: 'b4f7e7557674d501cbfbc0148ad800c0' +
                '750189fe295a2aca5e1bf4122c85edf9'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: 'fe32459f7339dd2e8df6c6fc874ed9e81e3b7aad669edad9b71196f53ed95b12',
           empty: '04519be1eb94079c91306cc5b21946b3de6a78ad35ec83d4f4a37bafbda678d7',
@@ -639,6 +639,27 @@ async function testWrongKeyType(
   assert.deepStrictEqual(bits, new ArrayBuffer(0));
 })().then(common.mustCall());
 
+// HKDF output is limited to 255 digest blocks.
+(async function() {
+  const key = await crypto.subtle.importKey(
+    'raw', new Uint8Array(0), 'HKDF', false, ['deriveBits']);
+  const algorithm = {
+    name: 'HKDF',
+    hash: 'SHA-256',
+    info: new Uint8Array(0),
+    salt: new Uint8Array(0),
+  };
+
+  const bits = await crypto.subtle.deriveBits(algorithm, key, 65280);
+  assert.strictEqual(bits.byteLength, 8160);
+
+  await assert.rejects(
+    crypto.subtle.deriveBits(algorithm, key, 65288), {
+      name: 'OperationError',
+      message: 'length exceeds the maximum derived bit length',
+    });
+})().then(common.mustCall());
+
 // OpenSSL limits info to 1024 bytes
 (async function() {
   const key = await crypto.subtle.importKey('raw', new Uint8Array(0), 'HKDF', false, ['deriveBits']);
diff --git a/test/parallel/test-webcrypto-derivebits.js b/test/parallel/test-webcrypto-derivebits.js
index 50892be7400e..e1e3da6ce26e 100644
--- a/test/parallel/test-webcrypto-derivebits.js
+++ b/test/parallel/test-webcrypto-derivebits.js
@@ -7,7 +7,11 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const requiresLongHkdfInputs = hasFIPS(3) && !hasFIPS(3, 5);
+const rejectsWeakPbkdf2Inputs = hasFIPS(4);
+const rejectsXCurves = hasFIPS(3, 5);
 
 // This is only a partial test. The WebCrypto Web Platform Tests
 // will provide much greater coverage.
@@ -56,12 +60,20 @@ const { subtle } = globalThis.crypto;
   }
 
   const kTests = [
-    ['hello', 'there', 'my friend', 'SHA-256', 512,
-     '14d93b0ccd99d4f2cbd9fbfe9c830b5b8a43e3e45e329' +
-     '41ef21bdeb0fa87b6b6bfa5c54466aa5bf76cdc2685fb' +
-     'a4408ea5b94c049fe035649b46f92fdc519374'],
-    ['hello', 'there', 'my friend', 'SHA-384', 128,
-     'e36cf2cf943d8f3a88adb80f478745c3'],
+    [requiresLongHkdfInputs ? 'hello hello hello' : 'hello',
+     'there', requiresLongHkdfInputs ? 'my friend indeed' : 'my friend',
+     'SHA-256', 512,
+     requiresLongHkdfInputs ?
+       'bc2b7841512a6f4563f723c317909ac305ddbfbdec1daf0055d0587b5db8d635' +
+       'a22f97b0dfbcc12dcd2d096123385227b16e95e5bccc0d6751491f38c5e48428' :
+       '14d93b0ccd99d4f2cbd9fbfe9c830b5b8a43e3e45e329' +
+       '41ef21bdeb0fa87b6b6bfa5c54466aa5bf76cdc2685fb' +
+       'a4408ea5b94c049fe035649b46f92fdc519374'],
+    [requiresLongHkdfInputs ? 'hello hello hello' : 'hello',
+     'there', requiresLongHkdfInputs ? 'my friend indeed' : 'my friend',
+     'SHA-384', 128,
+     requiresLongHkdfInputs ? 'ee2d1d7dc759c26f2ab8ee6d7cfa0c23' :
+       'e36cf2cf943d8f3a88adb80f478745c3'],
   ];
 
   const tests = Promise.all(kTests.map((args) => test(...args)));
@@ -88,17 +100,46 @@ const { subtle } = globalThis.crypto;
   }
 
   const kTests = [
-    ['hello', 'there', 10, 'SHA-256', 512,
-     'f72d1cf4853fffbd16a42751765d11f8dc7939498ee7b7' +
-     'ce7678b4cb16fad88098110a83e71f4483ce73203f7a64' +
-     '719d293280f780f9fafdcf46925c5c0588b3'],
-    ['hello', 'there', 5, 'SHA-384', 128,
-     '201509b012c9cd2fbe7ea938f0c509b3'],
+    ['password', 'there there here', 1000, 'SHA-256', 512,
+     '8802c34ee684a523f9304a6335394c0a5f02350d51383d' +
+     '17d3cf89fa0808591ddede3c832fe4691c7f361ade53b9' +
+     '36bf94347055bcf86fd662abe038fb945d17'],
+    ['password', 'there there here', 2000, 'SHA-384', 128,
+     '7c650b88798cea1a390802a6f97e05b0'],
   ];
 
   const tests = Promise.all(kTests.map((args) => test(...args)));
 
   tests.then(common.mustCall());
+
+  if (rejectsWeakPbkdf2Inputs) {
+    assert.rejects(
+      test('hello', 'there', 10, 'SHA-256', 512),
+      { name: 'OperationError' })
+      .then(common.mustCall());
+  }
+}
+
+// Test PBKDF2 rejects iteration counts beyond the native signed int range
+{
+  async function test() {
+    const key = await subtle.importKey(
+      'raw',
+      new Uint8Array([1]),
+      'PBKDF2',
+      false,
+      ['deriveBits']);
+    await assert.rejects(
+      subtle.deriveBits({
+        name: 'PBKDF2',
+        hash: 'SHA-256',
+        salt: new Uint8Array([2]),
+        iterations: 2 ** 31,
+      }, key, 8),
+      { name: 'NotSupportedError' });
+  }
+
+  test().then(common.mustCall());
 }
 
 // Test X25519 and X448 bit derivation
@@ -123,10 +164,20 @@ const { subtle } = globalThis.crypto;
     assert.deepStrictEqual(secret1, secret2);
   }
 
-  test('X25519').then(common.mustCall());
-  if (!process.features.openssl_is_boringssl) {
-    test('X448').then(common.mustCall());
+  if (rejectsXCurves) {
+    for (const name of ['X25519', 'X448']) {
+      assert.rejects(
+        test(name),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.message === 'error:0308010C:digital envelope routines::unsupported')
+        .then(common.mustCall());
+    }
   } else {
-    common.printSkipMessage('Skipping unsupported X448 test case');
+    test('X25519').then(common.mustCall());
+    if (!isBoringSSL) {
+      test('X448').then(common.mustCall());
+    } else {
+      common.printSkipMessage('Skipping unsupported X448 test case');
+    }
   }
 }
diff --git a/test/parallel/test-webcrypto-derivekey-cfrg.js b/test/parallel/test-webcrypto-derivekey-cfrg.js
index c5a5b1f3518f..133292cbefff 100644
--- a/test/parallel/test-webcrypto-derivekey-cfrg.js
+++ b/test/parallel/test-webcrypto-derivekey-cfrg.js
@@ -6,7 +6,9 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const rejectsXCurves = hasFIPS(3, 5);
 
 const kTests = [
   {
@@ -20,7 +22,7 @@ const kTests = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kTests.push(
     {
       name: 'X448',
@@ -80,6 +82,15 @@ async function prepareKeys() {
     Object.keys(keys).map(async (name) => {
       const { result, privateKey, publicKey } = keys[name];
 
+      if (rejectsXCurves) {
+        await assert.rejects(
+          subtle.deriveKey({ name, public: publicKey }, privateKey, ...otherArgs),
+          (err) => err.name === 'OperationError' &&
+                   err.cause?.message ===
+                     'error:03000096:digital envelope routines::operation not supported for this keytype');
+        return;
+      }
+
       {
         // Good parameters
         const key = await subtle.deriveKey({
diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js
index f9323bca2caf..325c4472d802 100644
--- a/test/parallel/test-webcrypto-derivekey.js
+++ b/test/parallel/test-webcrypto-derivekey.js
@@ -5,11 +5,13 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
 const { KeyObject } = require('crypto');
+const rejectsXCurves = hasFIPS(3, 5);
+const fips4 = hasFIPS(4);
 
 // This is only a partial test. The WebCrypto Web Platform Tests
 // will provide much greater coverage.
@@ -74,24 +76,24 @@ const { KeyObject } = require('crypto');
   }
 
   const kTests = [
-    ['hello', 'there', 'my friend', 'SHA-1',
-     '365ca5d3f42d050c74302e420c83975327950f1913a151eecd00526bf52614a0'],
-    ['hello', 'there', 'my friend', 'SHA-256',
-     '14d93b0ccd99d4f2cbd9fbfe9c830b5b8a43e3e45e32941ef21bdeb0fa87b6b6'],
-    ['hello', 'there', 'my friend', 'SHA-384',
-     'e36cf2cf943d8f3a88adb80f478745c336ac811b1a86d03a7d10eb0b6b52295c'],
-    ['hello', 'there', 'my friend', 'SHA-512',
-     '1e42d43fcacba361716f65853bd5f3c479f679612f0180eab3c51ed6c9d2b47d'],
+    ['hello hello hello', 'there', 'my friend indeed', 'SHA-1',
+     'aac1ecdc73147af6a418393da6875bff5f566c0a473e25d54b4dfc3cb7cb2ace'],
+    ['hello hello hello', 'there', 'my friend indeed', 'SHA-256',
+     'bc2b7841512a6f4563f723c317909ac305ddbfbdec1daf0055d0587b5db8d635'],
+    ['hello hello hello', 'there', 'my friend indeed', 'SHA-384',
+     'ee2d1d7dc759c26f2ab8ee6d7cfa0c2313e82650a4514673c867063dc1849040'],
+    ['hello hello hello', 'there', 'my friend indeed', 'SHA-512',
+     'a7abd704d0be364c6d4a530b6f93fcaff95474a2eee5a127ff86c5d095a2a812'],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
-      ['hello', 'there', 'my friend', 'SHA3-256',
-       '2a49a3b6fb219117af9e251c6c65f16600cbca13bd0be6e70d96b0b9fa4cf3fd'],
-      ['hello', 'there', 'my friend', 'SHA3-384',
-       '0437bb59b95f2db2c7684c0b439028cb0fdd6f0f5d03b9f489066a87ae147221'],
-      ['hello', 'there', 'my friend', 'SHA3-512',
-       '3bbc469d38214371921e52c6f147e96cb7eb370421a81f53dea8b4851dfb8bce'],
+      ['hello hello hello', 'there', 'my friend indeed', 'SHA3-256',
+       '89b3751df2ada85322a57ec82f7d0a5c233c6def91c92e681bc5118bd5768dca'],
+      ['hello hello hello', 'there', 'my friend indeed', 'SHA3-384',
+       'b4fa7b9929a595bbaa370eb959b194c1232d5a329abd02a5fa166a1424962fcf'],
+      ['hello hello hello', 'there', 'my friend indeed', 'SHA3-512',
+       'ac5d90a6bc848961e78a491887539b29c532a9c0d0b39cec464df071a63e0061'],
     );
   } else {
     common.printSkipMessage('Skipping unsupported SHA-3 test cases');
@@ -127,30 +129,36 @@ const { KeyObject } = require('crypto');
   }
 
   const kTests = [
-    ['hello', 'there', 5, 'SHA-1',
-     'f8f65a5fd92c9b74916083a7e9b0001c46bc89e2a14c48014cf1e0e1dbabf635'],
-    ['hello', 'there', 5, 'SHA-256',
-     '2e575eae24267db32106c7dba01615e5417557e8c5cf33ba15a311cb0c2907ee'],
-    ['hello', 'there', 5, 'SHA-384',
-     '201509b012c9cd2fbe7ea938f0c509b36ecb140f38bf9130e96923f55f46756d'],
-    ['hello', 'there', 5, 'SHA-512',
-     '2e8d981741f98193e0af9c79870af0e985089341221edad9a130d297eae1984b'],
+    ['hello hello hello', 'my friend indeed', 1000, 'SHA-1',
+     'b747604ca226287ccae90d8d8c119645a80d1154625a56b2debb3f9b172eb134'],
+    ['hello hello hello', 'my friend indeed', 1000, 'SHA-256',
+     '3cc64f6cfcbdb9c42b63b471016f17d1966b70934b4719a12ce95382940252f2'],
+    ['hello hello hello', 'my friend indeed', 1000, 'SHA-384',
+     '5ce64241beef3a3931dbfac6eef7303b5bdbea13449d4eeb4f89c3e9f9357c65'],
+    ['hello hello hello', 'my friend indeed', 1000, 'SHA-512',
+     '12790ce09027db067d680670f4dc704715b5120d139e8fde810afc34fb66f9f1'],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
-      ['hello', 'there', 5, 'SHA3-256',
-       '0aed29b61b3ca3978aea34a9793276574ea997b69e8d03727438199f90571649'],
-      ['hello', 'there', 5, 'SHA3-384',
-       '7aa4a274aa19b4623c5d3091c4b06355de85ff6f25e53a83e3126cbb86ae68df'],
-      ['hello', 'there', 5, 'SHA3-512',
-       '4d909c47a81c625f866d1f9406248e6bc3c7ea89225fbccf1f08820254c9ef56']
+      ['hello hello hello', 'my friend indeed', 1000, 'SHA3-256',
+       '0f69b46660cba27b95215d5676492c64ed6abf6d426669a4a02b0ca3a1c36c11'],
+      ['hello hello hello', 'my friend indeed', 1000, 'SHA3-384',
+       'a2e86a2d4cdf9844d70ae37f71302356ce2b9a899f5d778fc9af64d32e351d70'],
+      ['hello hello hello', 'my friend indeed', 1000, 'SHA3-512',
+       '03431052c37d626ae3fc1df582ff2a4d610642fc27e1b8130ca5980c0b0756ac']
     );
   } else {
     common.printSkipMessage('Skipping unsupported SHA-3 test cases');
   }
 
-  const tests = Promise.all(kTests.map((args) => test(...args)));
+  const promises = kTests.map((args) => test(...args));
+  if (fips4) {
+    promises.push(assert.rejects(
+      test('hello', 'there', 5, 'SHA-256', ''),
+      { name: 'OperationError' }));
+  }
+  const tests = Promise.all(promises);
 
   tests.then(common.mustCall());
 }
@@ -167,7 +175,7 @@ const { KeyObject } = require('crypto');
     [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     vectors.push(
       [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
       [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
@@ -227,7 +235,7 @@ const { KeyObject } = require('crypto');
     [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     vectors.push(
       [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
       [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
@@ -254,8 +262,18 @@ const { KeyObject } = require('crypto');
   (async () => {
     for (const [derivedKeyAlgorithm, usage, expected] of vectors) {
       const derived = await subtle.deriveKey(
-        { name: 'PBKDF2', salt: new Uint8Array([]), hash: 'SHA-256', iterations: 20 },
-        await subtle.importKey('raw', new Uint8Array([]), { name: 'PBKDF2' }, false, ['deriveKey']),
+        {
+          name: 'PBKDF2',
+          salt: new Uint8Array(16),
+          hash: 'SHA-256',
+          iterations: 1000,
+        },
+        await subtle.importKey(
+          'raw',
+          new Uint8Array(8),
+          { name: 'PBKDF2' },
+          false,
+          ['deriveKey']),
         derivedKeyAlgorithm,
         false,
         [usage]);
@@ -265,23 +283,33 @@ const { KeyObject } = require('crypto');
   })().then(common.mustCall());
 }
 
-if (hasOpenSSL(3)) {
+if (hasOpenSSL(3) && !hasFIPS()) {
   (async () => {
     const derivedKeyAlgorithm = { name: 'KMAC128', length: 0 };
     const usages = ['sign'];
     for (const [algorithm, baseKeyAlgorithm] of [
       [
-        { name: 'HKDF', salt: new Uint8Array(), info: new Uint8Array(), hash: 'SHA-256' },
+        {
+          name: 'HKDF',
+          salt: new Uint8Array(16),
+          info: new Uint8Array(),
+          hash: 'SHA-256',
+        },
         { name: 'HKDF' },
       ],
       [
-        { name: 'PBKDF2', salt: new Uint8Array(), hash: 'SHA-256', iterations: 20 },
+        {
+          name: 'PBKDF2',
+          salt: new Uint8Array(16),
+          hash: 'SHA-256',
+          iterations: 1000,
+        },
         { name: 'PBKDF2' },
       ],
     ]) {
       const baseKey = await subtle.importKey(
         'raw',
-        new Uint8Array(),
+        new Uint8Array(baseKeyAlgorithm.name === 'HKDF' ? 16 : 8),
         baseKeyAlgorithm,
         false,
         ['deriveKey']);
@@ -293,11 +321,11 @@ if (hasOpenSSL(3)) {
         usages);
       assert.strictEqual(derived.algorithm.length, 0);
 
-      const signature = await subtle.sign({
+      const signature = subtle.sign({
         name: 'KMAC128',
         outputLength: 256,
       }, derived, new Uint8Array());
-      assert.strictEqual(signature.byteLength, 32);
+      assert.strictEqual((await signature).byteLength, 32);
     }
   })().then(common.mustCall());
 }
@@ -333,10 +361,20 @@ if (hasOpenSSL(3)) {
     assert.deepStrictEqual(raw1, raw2);
   }
 
-  test('X25519').then(common.mustCall());
-  if (!process.features.openssl_is_boringssl) {
-    test('X448').then(common.mustCall());
+  if (rejectsXCurves) {
+    for (const name of ['X25519', 'X448']) {
+      assert.rejects(
+        test(name),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.message === 'error:0308010C:digital envelope routines::unsupported')
+        .then(common.mustCall());
+    }
   } else {
-    common.printSkipMessage('Skipping unsupported X448 test case');
+    test('X25519').then(common.mustCall());
+    if (!isBoringSSL) {
+      test('X448').then(common.mustCall());
+    } else {
+      common.printSkipMessage('Skipping unsupported X448 test case');
+    }
   }
 }
diff --git a/test/parallel/test-webcrypto-digest-turboshake-rfc.js b/test/parallel/test-webcrypto-digest-turboshake-rfc.js
index 271fde76ab23..462204654121 100644
--- a/test/parallel/test-webcrypto-digest-turboshake-rfc.js
+++ b/test/parallel/test-webcrypto-digest-turboshake-rfc.js
@@ -5,6 +5,11 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasFIPS } = require('../common/crypto');
+
+if (hasFIPS())
+  common.skip('TurboSHAKE and KangarooTwelve are not available in FIPS mode');
+
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
 
diff --git a/test/parallel/test-webcrypto-digest-turboshake.js b/test/parallel/test-webcrypto-digest-turboshake.js
index a6f4b2d50f94..bd09362caa25 100644
--- a/test/parallel/test-webcrypto-digest-turboshake.js
+++ b/test/parallel/test-webcrypto-digest-turboshake.js
@@ -5,6 +5,11 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasFIPS } = require('../common/crypto');
+
+if (hasFIPS())
+  common.skip('TurboSHAKE and KangarooTwelve are not available in FIPS mode');
+
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
 
diff --git a/test/parallel/test-webcrypto-digest.js b/test/parallel/test-webcrypto-digest.js
index 8e1b6797ee86..47a56a912d69 100644
--- a/test/parallel/test-webcrypto-digest.js
+++ b/test/parallel/test-webcrypto-digest.js
@@ -9,7 +9,8 @@ const assert = require('assert');
 const { Buffer } = require('buffer');
 const { subtle } = globalThis.crypto;
 const { createHash, getHashes } = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
+const fips = hasFIPS();
 
 const kTests = [
   ['SHA-1', ['sha1'], 160],
@@ -18,7 +19,7 @@ const kTests = [
   ['SHA-512', ['sha512'], 512],
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kTests.push(
     [{ name: 'cSHAKE128', outputLength: 256 }, ['shake128', { outputLength: 256 >> 3 }], 256],
     [{ name: 'cSHAKE256', outputLength: 512 }, ['shake256', { outputLength: 512 >> 3 }], 512],
@@ -149,7 +150,7 @@ const kDigestedData = {
           '60b22aab8d36a4c2a3affdb71234f49276737c575ddf7' +
           '4d14054cbd6fdb98fd0ddcbcb46f91ad76b6ee'
   },
-  ...(!process.features.openssl_is_boringssl ? {
+  ...(!isBoringSSL ? {
     'cshake128': {
       empty: '7f9c2ba4e88f827d616045507605853ed73b8093f6e' +
             'fbc88eb1a6eacfa66ef26',
@@ -290,6 +291,8 @@ if (getHashes().includes('shake128')) {
         message: 'Unsupported CShakeParams functionName',
       });
 
+    if (fips) return;
+
     await assert.rejects(
       subtle.digest(
         {
@@ -407,7 +410,8 @@ if (getHashes().includes('shake128')) {
       nistCShakeSample1.data));
     const expected = Buffer.from(nistCShakeSample1.expected, 'hex');
     assert.strictEqual(truncated.byteLength, expected.byteLength);
-    assert.deepStrictEqual(truncated.subarray(0, 31), expected.subarray(0, 31));
+    assert.deepStrictEqual(
+      truncated.subarray(0, 31), expected.subarray(0, 31));
     assert.strictEqual(truncated[31] & 0b00000001, 0);
     assert.strictEqual(truncated[31] | 0b00000001, expected[31]);
   })().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-encap-decap-ml-kem.js b/test/parallel/test-webcrypto-encap-decap-ml-kem.js
index e31be79e6bfe..128cb0d9575d 100644
--- a/test/parallel/test-webcrypto-encap-decap-ml-kem.js
+++ b/test/parallel/test-webcrypto-encap-decap-ml-kem.js
@@ -6,9 +6,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -289,7 +289,7 @@ async function testDecapsulateBits({ name, publicKeyPem, privateKeyPem, results
   const variations = [];
 
   for (const vector of vectors) {
-    if (process.features.openssl_is_boringssl && vector.name === 'ML-KEM-512') {
+    if (isBoringSSL && vector.name === 'ML-KEM-512') {
       common.printSkipMessage(`Skipping unsupported ${vector.name} test`);
       continue;
     }
diff --git a/test/parallel/test-webcrypto-encrypt-decrypt-aes.js b/test/parallel/test-webcrypto-encrypt-decrypt-aes.js
index d7a7dca6584c..14cc0127188a 100644
--- a/test/parallel/test-webcrypto-encrypt-decrypt-aes.js
+++ b/test/parallel/test-webcrypto-encrypt-decrypt-aes.js
@@ -8,6 +8,7 @@ if (!common.hasCrypto)
 const { hasOpenSSL } = require('../common/crypto');
 
 const assert = require('assert');
+const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
 async function testEncrypt({ keyBuffer, algorithm, plaintext, result }) {
@@ -237,6 +238,14 @@ if (hasOpenSSL(3)) {
   } = require('../fixtures/crypto/aes_ocb')();
 
   (async function() {
+    if (getFips() === 1) {
+      await assert.rejects(
+        testEncrypt(passing[0]),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.message === 'error:0308010C:digital envelope routines::unsupported');
+      return;
+    }
+
     const variations = [];
 
     passing.forEach((vector) => {
diff --git a/test/parallel/test-webcrypto-encrypt-decrypt-chacha20-poly1305.js b/test/parallel/test-webcrypto-encrypt-decrypt-chacha20-poly1305.js
index 723fd26ea570..45225115fd52 100644
--- a/test/parallel/test-webcrypto-encrypt-decrypt-chacha20-poly1305.js
+++ b/test/parallel/test-webcrypto-encrypt-decrypt-chacha20-poly1305.js
@@ -6,8 +6,19 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
+if (hasFIPS(3)) {
+  assert.rejects(
+    subtle.generateKey(
+      { name: 'ChaCha20-Poly1305' },
+      false,
+      ['encrypt', 'decrypt']),
+    { name: 'NotSupportedError' }).then(common.mustCall());
+  return;
+}
+
 async function testEncrypt({ keyBuffer, algorithm, plaintext, result }) {
   // Using a copy of plaintext to prevent tampering of the original
   plaintext = Buffer.from(plaintext);
diff --git a/test/parallel/test-webcrypto-encrypt-decrypt.js b/test/parallel/test-webcrypto-encrypt-decrypt.js
index c4ca52862fe0..ae8cd7fcfdb0 100644
--- a/test/parallel/test-webcrypto-encrypt-decrypt.js
+++ b/test/parallel/test-webcrypto-encrypt-decrypt.js
@@ -6,7 +6,8 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
 // This is only a partial test. The WebCrypto Web Platform Tests
@@ -58,7 +59,7 @@ const { subtle } = globalThis.crypto;
 }
 
 // Test Encrypt/Decrypt RSA-OAEP w/ SHA-3
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const buf = globalThis.crypto.getRandomValues(new Uint8Array(50));
 
   async function test() {
@@ -207,7 +208,15 @@ if (hasOpenSSL(3)) {
       Buffer.from(buf).toString('hex'));
   }
 
-  test().then(common.mustCall());
+  if (getFips() === 1) {
+    assert.rejects(
+      test(),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.message === 'error:0308010C:digital envelope routines::unsupported')
+      .then(common.mustCall());
+  } else {
+    test().then(common.mustCall());
+  }
 } else {
   common.printSkipMessage('Skipping unsupported AES-OCB test cases');
 }
diff --git a/test/parallel/test-webcrypto-export-import-cfrg.js b/test/parallel/test-webcrypto-export-import-cfrg.js
index 60d99319691b..921bd394d2f6 100644
--- a/test/parallel/test-webcrypto-export-import-cfrg.js
+++ b/test/parallel/test-webcrypto-export-import-cfrg.js
@@ -8,7 +8,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const rejectsXCurves = hasFIPS(3, 5);
 
 const keyData = {
   'Ed25519': {
@@ -94,7 +96,7 @@ const testVectors = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   testVectors.push(
     {
       name: 'Ed448',
@@ -404,13 +406,58 @@ async function testImportRaw({ name, publicUsages }) {
     for (const extractable of [true, false]) {
       tests.push(testImportSpki(vector, extractable));
       tests.push(testImportPkcs8(vector, extractable));
-      tests.push(testImportJwk(vector, extractable));
+      if (rejectsXCurves && vector.name.startsWith('X')) {
+        tests.push(assert.rejects(
+          testImportJwk(vector, extractable),
+          { name: 'DataError' }));
+      } else {
+        tests.push(testImportJwk(vector, extractable));
+      }
+    }
+    if (rejectsXCurves && vector.name.startsWith('X')) {
+      tests.push(assert.rejects(testImportRaw(vector), { name: 'DataError' }));
+    } else {
+      tests.push(testImportRaw(vector));
     }
-    tests.push(testImportRaw(vector));
   }
   await Promise.all(tests);
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const jwk = keyData[name].jwk;
+    const publicJwk = {
+      kty: jwk.kty,
+      crv: jwk.crv,
+      x: jwk.x,
+    };
+    const isKeyAgreement = name.startsWith('X');
+    const invalidUsage = isKeyAgreement ?
+      privateUsages[0] : publicUsages[0];
+    const invalidJwk = isKeyAgreement ? publicJwk : jwk;
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...invalidJwk, key_ops: [invalidUsage, invalidUsage] },
+        { name },
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    const validUsage = privateUsages[0];
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [validUsage, validUsage] },
+        { name },
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 {
   const rsaPublic = crypto.createPublicKey(
     fixtures.readKey('rsa_public_2048.pem'));
diff --git a/test/parallel/test-webcrypto-export-import-ec.js b/test/parallel/test-webcrypto-export-import-ec.js
index 2c1740fc620c..c025136b9745 100644
--- a/test/parallel/test-webcrypto-export-import-ec.js
+++ b/test/parallel/test-webcrypto-export-import-ec.js
@@ -120,6 +120,12 @@ async function testImportSpki({ name, publicUsages }, namedCurve, extractable) {
     assert.strictEqual(
       Buffer.from(spki).toString('hex'),
       keyData[namedCurve].spki.toString('hex'));
+
+    await assert.rejects(
+      subtle.exportKey('pkcs8', key), {
+        message: 'Key must be a private key',
+        name: 'InvalidAccessError',
+      });
   } else {
     await assert.rejects(
       subtle.exportKey('spki', key), {
@@ -162,6 +168,12 @@ async function testImportPkcs8(
     assert.strictEqual(
       Buffer.from(pkcs8).toString('hex'),
       keyData[namedCurve].pkcs8.toString('hex'));
+
+    await assert.rejects(
+      subtle.exportKey('spki', key), {
+        message: 'Key must be a public key',
+        name: 'InvalidAccessError',
+      });
   } else {
     await assert.rejects(
       subtle.exportKey('pkcs8', key), {
@@ -396,6 +408,42 @@ async function testImportRaw({ name, publicUsages }, namedCurve) {
   await Promise.all(tests);
 })().then(common.mustCall());
 
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  const jwk = keyData['P-256'].jwk;
+  const publicJwk = {
+    kty: jwk.kty,
+    crv: jwk.crv,
+    x: jwk.x,
+    y: jwk.y,
+  };
+
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const invalidUsage = name === 'ECDH' ?
+      privateUsages[0] : publicUsages[0];
+    const invalidJwk = name === 'ECDH' ? publicJwk : jwk;
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...invalidJwk, key_ops: [invalidUsage, invalidUsage] },
+        { name, namedCurve: 'P-256' },
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    const validUsage = privateUsages[0];
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [validUsage, validUsage] },
+        { name, namedCurve: 'P-256' },
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 
 // https://github.com/nodejs/node/issues/45859
 (async function() {
diff --git a/test/parallel/test-webcrypto-export-import-ml-dsa.js b/test/parallel/test-webcrypto-export-import-ml-dsa.js
index 5cafdfd41b27..440530a52a70 100644
--- a/test/parallel/test-webcrypto-export-import-ml-dsa.js
+++ b/test/parallel/test-webcrypto-export-import-ml-dsa.js
@@ -5,9 +5,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -104,7 +104,7 @@ async function testImportPkcs8({ name, privateUsages }, extractable) {
       extractable,
       privateUsages);
   } catch (err) {
-    if (process.features.openssl_is_boringssl) {
+    if (isBoringSSL) {
       assert.strictEqual(err.name, 'DataError');
       assert.strictEqual(err.cause.code, 'ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED');
       common.printSkipMessage('Skipping unsupported private key format test');
@@ -488,7 +488,41 @@ async function testImportRawSeed({ name, privateUsages }, extractable) {
   });
 })().then(common.mustCall());
 
-if (!process.features.openssl_is_boringssl) {
+// JWK key usage validation precedes `key_ops` validation.
+(async function() {
+  const privateJwk = keyData['ML-DSA-65'].jwk;
+  const publicJwk = { ...privateJwk, priv: undefined };
+
+  for (const [jwk, usage] of [
+    [privateJwk, 'verify'],
+    [publicJwk, 'sign'],
+  ]) {
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [usage, usage] },
+        'ML-DSA-65',
+        true,
+        [usage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+  }
+
+  for (const [jwk, usage] of [
+    [privateJwk, 'sign'],
+    [publicJwk, 'verify'],
+  ]) {
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...jwk, key_ops: [usage, usage] },
+        'ML-DSA-65',
+        true,
+        [usage]),
+      { name: 'DataError', message: /Duplicate key operation/ });
+  }
+})().then(common.mustCall());
+
+if (!isBoringSSL) {
   (async function() {
     for (const { name, privateUsages } of testVectors) {
       const pem = fixtures.readKey(getKeyFileName(name.toLowerCase(), 'private_priv_only'), 'ascii');
diff --git a/test/parallel/test-webcrypto-export-import-ml-kem.js b/test/parallel/test-webcrypto-export-import-ml-kem.js
index 32f072e555b1..100d330e0b42 100644
--- a/test/parallel/test-webcrypto-export-import-ml-kem.js
+++ b/test/parallel/test-webcrypto-export-import-ml-kem.js
@@ -5,9 +5,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -104,7 +104,7 @@ async function testImportPkcs8({ name, privateUsages }, extractable) {
       extractable,
       privateUsages);
   } catch (err) {
-    if (process.features.openssl_is_boringssl) {
+    if (isBoringSSL) {
       assert.strictEqual(err.name, 'DataError');
       assert.strictEqual(err.cause.code,
                          'ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED');
@@ -455,7 +455,7 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable)
 (async function() {
   const tests = [];
   for (const vector of testVectors) {
-    if (process.features.openssl_is_boringssl && vector.name === 'ML-KEM-512') {
+    if (isBoringSSL && vector.name === 'ML-KEM-512') {
       common.printSkipMessage('Skipping unsupported ML-KEM-512 test');
       continue;
     }
@@ -500,20 +500,36 @@ if (!process.features.openssl_is_boringssl) {
   common.printSkipMessage('Skipping unsupported private key format test');
 }
 
-// Regression test: JWK `key_ops` validation must recognize ML-KEM operations
-// (encapsulateKey, encapsulateBits, decapsulateKey, decapsulateBits) so that
-// duplicate entries are rejected
+// JWK key usage validation precedes `key_ops` validation.
 (async function() {
-  for (const op of ['encapsulateKey', 'encapsulateBits',
-                    'decapsulateKey', 'decapsulateBits']) {
-    const jwk = { ...keyData['ML-KEM-768'].jwk, key_ops: [op, op] };
+  const privateJwk = keyData['ML-KEM-768'].jwk;
+  const encapsulationOps = ['encapsulateKey', 'encapsulateBits'];
+  const decapsulationOps = ['decapsulateKey', 'decapsulateBits'];
+
+  for (const op of encapsulationOps) {
+    const jwk = { ...privateJwk, key_ops: [op, op] };
+    await assert.rejects(
+      subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+  }
+
+  // Duplicate entries are still rejected when the requested usages are valid.
+  for (const op of encapsulationOps) {
+    const jwk = { ...privateJwk, priv: undefined, key_ops: [op, op] };
+    await assert.rejects(
+      subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
+      { name: 'DataError', message: /Duplicate key operation/ });
+  }
+
+  for (const op of decapsulationOps) {
+    const jwk = { ...privateJwk, key_ops: [op, op] };
     await assert.rejects(
       subtle.importKey('jwk', jwk, { name: 'ML-KEM-768' }, true, [op]),
       { name: 'DataError', message: /Duplicate key operation/ });
   }
 })().then(common.mustCall());
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   (async function() {
     for (const { name, privateUsages } of testVectors) {
       const pem = fixtures.readKey(getKeyFileName(name.toLowerCase(), 'private_priv_only'), 'ascii');
diff --git a/test/parallel/test-webcrypto-export-import-rsa.js b/test/parallel/test-webcrypto-export-import-rsa.js
index 9eb611533a77..4674b124fc38 100644
--- a/test/parallel/test-webcrypto-export-import-rsa.js
+++ b/test/parallel/test-webcrypto-export-import-rsa.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -19,7 +21,7 @@ const hashes = [
   'SHA-512',
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   hashes.push(
     'SHA3-256',
     'SHA3-384',
@@ -647,6 +649,35 @@ const testVectors = [
   await Promise.all(variations);
 })().then(common.mustCall());
 
+// Type-specific JWK usage validation precedes `key_ops` validation.
+(async function() {
+  const privateJwk = keyData[1024].jwk;
+
+  for (const { name, publicUsages, privateUsages } of testVectors) {
+    const algorithm = { name, hash: 'SHA-256' };
+    const invalidUsage = publicUsages[0];
+    const validUsage = privateUsages[0];
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...privateJwk, key_ops: [invalidUsage, invalidUsage] },
+        algorithm,
+        true,
+        [invalidUsage]),
+      { name: 'SyntaxError', message: /Unsupported key usage/ });
+
+    await assert.rejects(
+      subtle.importKey(
+        'jwk',
+        { ...privateJwk, key_ops: [validUsage, validUsage] },
+        algorithm,
+        true,
+        [validUsage]),
+      { name: 'DataError', message: 'Duplicate key operation' });
+  }
+})().then(common.mustCall());
+
 {
   const ecPublic = crypto.createPublicKey(
     fixtures.readKey('ec_p256_public.pem'));
diff --git a/test/parallel/test-webcrypto-export-import.js b/test/parallel/test-webcrypto-export-import.js
index c7399c69d9c9..385ae8c65e9d 100644
--- a/test/parallel/test-webcrypto-export-import.js
+++ b/test/parallel/test-webcrypto-export-import.js
@@ -6,11 +6,16 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
-const { createPrivateKey, createPublicKey, createSecretKey } = require('crypto');
+const {
+  createPrivateKey,
+  createPublicKey,
+  createSecretKey,
+  getFips,
+} = require('crypto');
 
 {
   async function test() {
@@ -281,66 +286,68 @@ if (hasOpenSSL(3)) {
       { name: 'SyntaxError', message: 'Usages cannot be empty when importing a secret key.' });
 
     {
-      const importedZeroImplicit = await subtle.importKey(
-        'raw-secret',
-        new Uint8Array(),
-        name,
-        true,
-        ['sign', 'verify']);
-      const importedZeroImplicitRaw =
-        await subtle.exportKey('raw-secret', importedZeroImplicit);
-      assert.strictEqual(importedZeroImplicit.algorithm.length, 0);
-      assert.strictEqual(importedZeroImplicitRaw.byteLength, 0);
+      if (getFips() !== 1) {
+        const importedZeroImplicit = await subtle.importKey(
+          'raw-secret',
+          new Uint8Array(),
+          name,
+          true,
+          ['sign', 'verify']);
+        const importedZeroImplicitRaw =
+          await subtle.exportKey('raw-secret', importedZeroImplicit);
+        assert.strictEqual(importedZeroImplicit.algorithm.length, 0);
+        assert.strictEqual(importedZeroImplicitRaw.byteLength, 0);
 
-      const importedZeroExplicit = await subtle.importKey(
-        'raw-secret',
-        new Uint8Array(),
-        { name, length: 0 },
-        true,
-        ['sign', 'verify']);
-      const importedZeroExplicitRaw =
-        await subtle.exportKey('raw-secret', importedZeroExplicit);
-      assert.strictEqual(importedZeroExplicit.algorithm.length, 0);
-      assert.strictEqual(importedZeroExplicitRaw.byteLength, 0);
-
-      await assert.rejects(
-        subtle.importKey(
+        const importedZeroExplicit = await subtle.importKey(
           'raw-secret',
-          new Uint8Array([0xff]),
+          new Uint8Array(),
           { name, length: 0 },
           true,
-          ['sign', 'verify']),
-        { name: 'DataError', message: 'Invalid key length' });
-
-      const generated = await subtle.generateKey(
-        { name, length: 9 },
-        true,
-        ['sign', 'verify']);
-      const generatedRaw = await subtle.exportKey('raw-secret', generated);
-      assert.strictEqual(generated.algorithm.length, 9);
-      assert.strictEqual(generatedRaw.byteLength, 2);
-      assert.strictEqual(new Uint8Array(generatedRaw)[1] & 0b01111111, 0);
+          ['sign', 'verify']);
+        const importedZeroExplicitRaw =
+          await subtle.exportKey('raw-secret', importedZeroExplicit);
+        assert.strictEqual(importedZeroExplicit.algorithm.length, 0);
+        assert.strictEqual(importedZeroExplicitRaw.byteLength, 0);
+
+        await assert.rejects(
+          subtle.importKey(
+            'raw-secret',
+            new Uint8Array([0xff]),
+            { name, length: 0 },
+            true,
+            ['sign', 'verify']),
+          { name: 'DataError', message: 'Invalid key length' });
+
+        const generated = await subtle.generateKey(
+          { name, length: 9 },
+          true,
+          ['sign', 'verify']);
+        const generatedRaw = await subtle.exportKey('raw-secret', generated);
+        assert.strictEqual(generated.algorithm.length, 9);
+        assert.strictEqual(generatedRaw.byteLength, 2);
+        assert.strictEqual(new Uint8Array(generatedRaw)[1] & 0b01111111, 0);
 
-      const importedExplicit = await subtle.importKey(
-        'raw-secret',
-        new Uint8Array([0xff, 0xff]),
-        { name, length: 9 },
-        true,
-        ['sign', 'verify']);
-      const importedExplicitRaw = await subtle.exportKey('raw-secret', importedExplicit);
-      assert.strictEqual(importedExplicit.algorithm.length, 9);
-      assert.deepStrictEqual(
-        new Uint8Array(importedExplicitRaw),
-        new Uint8Array([0xff, 0x80]));
-
-      await assert.rejects(
-        subtle.importKey(
+        const importedExplicit = await subtle.importKey(
           'raw-secret',
-          new Uint8Array([0xff]),
+          new Uint8Array([0xff, 0xff]),
           { name, length: 9 },
           true,
-          ['sign', 'verify']),
-        { name: 'DataError', message: 'Invalid key length' });
+          ['sign', 'verify']);
+        const importedExplicitRaw = await subtle.exportKey('raw-secret', importedExplicit);
+        assert.strictEqual(importedExplicit.algorithm.length, 9);
+        assert.deepStrictEqual(
+          new Uint8Array(importedExplicitRaw),
+          new Uint8Array([0xff, 0x80]));
+
+        await assert.rejects(
+          subtle.importKey(
+            'raw-secret',
+            new Uint8Array([0xff]),
+            { name, length: 9 },
+            true,
+            ['sign', 'verify']),
+          { name: 'DataError', message: 'Invalid key length' });
+      }
     }
   }
 
@@ -397,7 +404,7 @@ if (hasOpenSSL(3)) {
   async function test() {
     const { publicKey, privateKey } = await subtle.generateKey({
       name: 'RSA-PSS',
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-384'
     }, true, ['sign', 'verify']);
@@ -511,7 +518,7 @@ if (hasOpenSSL(3)) {
 }
 
 // SHA-3 hashes and JWK "alg"
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const rsa = fixtures.readKey('rsa_private_2048.pem');
   const privateKey = createPrivateKey(rsa);
   const publicKey = createPublicKey(privateKey);
diff --git a/test/parallel/test-webcrypto-fips-exceptions.mjs b/test/parallel/test-webcrypto-fips-exceptions.mjs
new file mode 100644
index 000000000000..d9c26a1674d6
--- /dev/null
+++ b/test/parallel/test-webcrypto-fips-exceptions.mjs
@@ -0,0 +1,199 @@
+// Flags: --expose-internals
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { createRequire } from 'node:module';
+import { hasFIPS } from '../common/crypto.js';
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+if (!hasFIPS(3))
+  common.skip('requires OpenSSL >= 3 in FIPS mode');
+
+const require = createRequire(import.meta.url);
+const { internalBinding } = require('internal/test/binding');
+const { getCryptoKeyHandle } = require('internal/crypto/keys');
+const {
+  CShakeJob,
+  KangarooTwelveJob,
+  KmacJob,
+  TurboShakeJob,
+  kCryptoJobWebCrypto,
+  kSignJobModeSign,
+} = internalBinding('crypto');
+const { subtle } = globalThis.crypto;
+const { SubtleCrypto } = globalThis;
+const data = new Uint8Array();
+
+async function assertFipsException(operation, algorithm, fn, message) {
+  assert.strictEqual(SubtleCrypto.supports(operation, algorithm), false);
+  await assert.rejects(fn(), {
+    name: 'NotSupportedError',
+    message,
+  });
+}
+
+for (const algorithm of [
+  { name: 'turboshake128', outputLength: 128 },
+  { name: 'TurboSHAKE256', outputLength: 256 },
+  { name: 'KT128', outputLength: 128 },
+  { name: 'KT256', outputLength: 256, customization: data },
+]) {
+  await assertFipsException(
+    'digest',
+    algorithm,
+    () => subtle.digest(algorithm, data),
+    'Unrecognized algorithm name');
+}
+
+for (const createJob of [
+  () => new TurboShakeJob(
+    kCryptoJobWebCrypto, 'TurboSHAKE128', 0x1f, 16, data),
+  () => new KangarooTwelveJob(
+    kCryptoJobWebCrypto, 'KT128', undefined, 16, data),
+  () => new CShakeJob(
+    kCryptoJobWebCrypto,
+    'cSHAKE128',
+    data,
+    Buffer.from('KMAC'),
+    undefined,
+    128),
+]) {
+  assert.throws(createJob, {
+    code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION',
+    message: 'Unsupported crypto operation',
+  });
+}
+
+const emptyCShake = {
+  name: 'cSHAKE128',
+  outputLength: 256,
+  customization: data,
+  functionName: data,
+};
+assert.strictEqual(SubtleCrypto.supports('digest', emptyCShake), true);
+
+for (const length of [1, 513]) {
+  const algorithm = {
+    name: 'cSHAKE128',
+    outputLength: 256,
+    customization: new Uint8Array(length),
+  };
+  await assertFipsException(
+    'digest',
+    algorithm,
+    () => subtle.digest(algorithm, data),
+    'Unsupported CShakeParams customization');
+}
+
+const functionName = {
+  name: 'cSHAKE256',
+  outputLength: 256,
+  functionName: Buffer.from('KMAC'),
+};
+await assertFipsException(
+  'digest',
+  functionName,
+  () => subtle.digest(functionName, data),
+  'Unsupported CShakeParams functionName');
+
+const bothCShakeParams = {
+  ...functionName,
+  customization: new Uint8Array(1),
+};
+await assertFipsException(
+  'digest',
+  bothCShakeParams,
+  () => subtle.digest(bothCShakeParams, data),
+  'Unsupported CShakeParams customization');
+
+for (const length of [0, 24, 33]) {
+  const algorithm = { name: 'KMAC128', length };
+  await assertFipsException(
+    'generateKey',
+    algorithm,
+    () => subtle.generateKey(algorithm, false, ['sign', 'verify']),
+    'Invalid key length');
+  await assertFipsException(
+    'importKey',
+    algorithm,
+    () => subtle.importKey(
+      'raw-secret',
+      new Uint8Array(length === 24 ? 4 : Math.ceil(length / 8)),
+      algorithm,
+      false,
+      ['sign', 'verify']),
+    'Invalid key length');
+}
+
+const minimumKmac = { name: 'KMAC128', length: 32 };
+assert.strictEqual(
+  SubtleCrypto.supports('generateKey', minimumKmac), true);
+assert.strictEqual(
+  SubtleCrypto.supports('importKey', minimumKmac), true);
+await assert.rejects(
+  subtle.importKey(
+    'raw-secret',
+    new Uint8Array(5),
+    minimumKmac,
+    false,
+    ['sign', 'verify']), {
+    name: 'DataError',
+    message: 'Invalid key length',
+  });
+
+for (const length of [0, 3]) {
+  await assert.rejects(
+    subtle.importKey(
+      'raw-secret',
+      new Uint8Array(length),
+      'KMAC128',
+      false,
+      ['sign', 'verify']), {
+      name: 'NotSupportedError',
+      message: 'Invalid key length',
+    });
+}
+const key = await subtle.importKey(
+  'raw-secret',
+  new Uint8Array(4),
+  'KMAC128',
+  false,
+  ['sign', 'verify']);
+assert.strictEqual(key.algorithm.length, 32);
+
+await assert.rejects(
+  new KmacJob(
+    kCryptoJobWebCrypto,
+    kSignJobModeSign,
+    getCryptoKeyHandle(key),
+    'KMAC128',
+    undefined,
+    32,
+    9,
+    data,
+    undefined).run(),
+  (err) => {
+    assert.strictEqual(err.name, 'OperationError');
+    assert.strictEqual(err.cause?.name, 'Error');
+    assert.strictEqual(err.cause?.message, 'Deriving bits failed');
+    return true;
+  });
+
+const minimumOutput = { name: 'KMAC128', outputLength: 8 };
+assert.strictEqual(SubtleCrypto.supports('sign', minimumOutput), true);
+assert.strictEqual(SubtleCrypto.supports('verify', minimumOutput), true);
+for (const outputLength of [0, 9]) {
+  const algorithm = { name: 'KMAC128', outputLength };
+  await assertFipsException(
+    'sign',
+    algorithm,
+    () => subtle.sign(algorithm, key, data),
+    'Invalid KmacParams outputLength');
+  await assertFipsException(
+    'verify',
+    algorithm,
+    () => subtle.verify(algorithm, key, data, data),
+    'Invalid KmacParams outputLength');
+}
diff --git a/test/parallel/test-webcrypto-get-public-key.mjs b/test/parallel/test-webcrypto-get-public-key.mjs
index 622ec4adca68..06a4b13d3de2 100644
--- a/test/parallel/test-webcrypto-get-public-key.mjs
+++ b/test/parallel/test-webcrypto-get-public-key.mjs
@@ -9,8 +9,10 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const { kSupportedAlgorithms } = require('internal/crypto/util');
+const { hasFIPS } = require('../common/crypto');
 const { SubtleCrypto } = globalThis;
 const { subtle } = globalThis.crypto;
+const rejectsXCurves = hasFIPS(3, 5);
 
 const RSA_KEY_GEN = {
   modulusLength: 2048,
@@ -54,6 +56,14 @@ for (const name of ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024']) {
   keyGeneration[name] = vector(name, ['decapsulateBits'], ['encapsulateBits']);
 }
 
+for (const name of [
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]) {
+  keyGeneration[name] = vector(name, ['decapsulateBits'], ['encapsulateBits']);
+}
+
 const unsupportedGetPublicKeyAlgorithms = new Set([
   'AES-CBC',
   'AES-CTR',
@@ -80,6 +90,15 @@ for (const name of Object.keys(kSupportedAlgorithms.exportKey)) {
 
   assert.strictEqual(SubtleCrypto.supports('getPublicKey', name), true);
 
+  if (rejectsXCurves &&
+      (name === 'X25519' || name === 'X448')) {
+    await assert.rejects(
+      subtle.generateKey(test.algorithm, false, test.privateUsages),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.message === 'error:0308010C:digital envelope routines::unsupported');
+    continue;
+  }
+
   const { privateKey } = await subtle.generateKey(
     test.algorithm, false, test.privateUsages);
   const usages = test.publicUsages;
diff --git a/test/parallel/test-webcrypto-kem-hybrids.js b/test/parallel/test-webcrypto-kem-hybrids.js
new file mode 100644
index 000000000000..0d1ec410c160
--- /dev/null
+++ b/test/parallel/test-webcrypto-kem-hybrids.js
@@ -0,0 +1,689 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3, 5))
+  common.skip('requires OpenSSL >= 3.5');
+
+const assert = require('assert');
+const { once } = require('events');
+const { KeyObject } = require('crypto');
+const { MessageChannel } = require('worker_threads');
+const { subtle } = globalThis.crypto;
+const { SubtleCrypto } = globalThis;
+
+if (hasFIPS()) {
+  (async () => {
+    for (const name of [
+      'MLKEM768-P256',
+      'MLKEM768-X25519',
+      'MLKEM1024-P384',
+    ]) {
+      for (const operation of [
+        'generateKey',
+        'importKey',
+        'exportKey',
+        'getPublicKey',
+        'encapsulateBits',
+        'decapsulateBits',
+      ]) {
+        assert.strictEqual(SubtleCrypto.supports(operation, name), false);
+      }
+      assert.strictEqual(
+        SubtleCrypto.supports('encapsulateKey', name, 'HKDF'),
+        false);
+      assert.strictEqual(
+        SubtleCrypto.supports('decapsulateKey', name, 'HKDF'),
+        false);
+      await assert.rejects(
+        subtle.generateKey(
+          name,
+          true,
+          ['encapsulateBits', 'decapsulateBits']),
+        { name: 'NotSupportedError', message: 'Unrecognized algorithm name' });
+    }
+  })().then(common.mustCall());
+  return;
+}
+
+const vectors = [
+  {
+    name: 'MLKEM768-P256',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aa' +
+               'c4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d72' +
+               '14049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c7' +
+               '91e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c7' +
+               '7c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7' +
+               'f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b6' +
+               '7445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c630' +
+               '1fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb' +
+               '979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f' +
+               '81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a587' +
+               '8f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b9' +
+               '00bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212' +
+               'eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b' +
+               '3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725' +
+               'fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88c' +
+               'dc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e2' +
+               '42b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f367404' +
+               '2b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776' +
+               'f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2' +
+               '050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be41' +
+               '9144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bb' +
+               'd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44a' +
+               'af2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb' +
+               '17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561' +
+               '793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6' +
+               'a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd' +
+               '0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb' +
+               '1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4' +
+               'c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d89' +
+               '77c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105' +
+               'e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f' +
+               '4e08bbb54cc2049c039c845be659999c8fa48d7f62327c146cf1bc0b0bb1b91b30174b7bc220' +
+               'd422023bff6b0dee263532c503f3982e4d3e27071b855578a9a9aa63b8a8c339bf',
+    ciphertext: 'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4ef' +
+                'ca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35' +
+                'd4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e44' +
+                '3f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe33' +
+                '4e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa' +
+                '7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6d' +
+                'ad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f' +
+                '6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6' +
+                '524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c8' +
+                '7e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f2763' +
+                '56fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796b' +
+                'd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853f' +
+                'c4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad' +
+                '055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498c' +
+                'fd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd' +
+                '2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8' +
+                '878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab3' +
+                '76f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471' +
+                '603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4' +
+                '012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c' +
+                '02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4' +
+                'cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa6649' +
+                '1ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881' +
+                'e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd8131' +
+                '9a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274ac' +
+                'a2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad49' +
+                '3c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e60287703' +
+                '7de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea' +
+                '94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc04428a824ea7cf56ad2a64ed368b' +
+                '71315d80cee846007cff1d2eea2c3f0f921537304ae598f98dd10d1f102811a4e2d161c3fd8b' +
+                'bb193d4b25bee950ac839c0f9d',
+    sharedSecret: '9bd018e869bb01b63fb8f5da374a73d347ea14cb2bc570b13d0908e2288ec456',
+  },
+  {
+    name: 'MLKEM768-X25519',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aa' +
+               'c4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d72' +
+               '14049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c7' +
+               '91e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c7' +
+               '7c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7' +
+               'f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b6' +
+               '7445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c630' +
+               '1fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb' +
+               '979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f' +
+               '81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a587' +
+               '8f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b9' +
+               '00bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212' +
+               'eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b' +
+               '3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725' +
+               'fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88c' +
+               'dc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e2' +
+               '42b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f367404' +
+               '2b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776' +
+               'f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2' +
+               '050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be41' +
+               '9144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bb' +
+               'd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44a' +
+               'af2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb' +
+               '17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561' +
+               '793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6' +
+               'a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd' +
+               '0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb' +
+               '1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4' +
+               'c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d89' +
+               '77c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105' +
+               'e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f' +
+               '4e08bbb54cc2f63601b7f85accfeea2d17964c66b5194b0f08e18519faaee194e3c102823062',
+    ciphertext: 'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4ef' +
+                'ca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35' +
+                'd4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e44' +
+                '3f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe33' +
+                '4e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa' +
+                '7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6d' +
+                'ad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f' +
+                '6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6' +
+                '524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c8' +
+                '7e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f2763' +
+                '56fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796b' +
+                'd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853f' +
+                'c4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad' +
+                '055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498c' +
+                'fd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd' +
+                '2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8' +
+                '878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab3' +
+                '76f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471' +
+                '603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4' +
+                '012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c' +
+                '02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4' +
+                'cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa6649' +
+                '1ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881' +
+                'e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd8131' +
+                '9a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274ac' +
+                'a2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad49' +
+                '3c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e60287703' +
+                '7de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea' +
+                '94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc6b3d57762f8badb69433f9c6d060' +
+                'f85f5e5c6b6803a816d141c075f63541ad10',
+    sharedSecret: 'e5ba94031ea6efd69c09c254f6d9783136ba6037e2d4c43bcccf19d6f3f4343a',
+  },
+  {
+    name: 'MLKEM1024-P384',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: 'a10bc8b554cd51980cdbbccc3041420fd320fe8b74c7a84278c63c17070dc231b61ab269b9d6' +
+               '77d920261186654b4571f51797d5c342b8070bc6c92bca16adecc631e4e94c7508b111730c74' +
+               '9c73e2d6a6f97155cb269ccc06a71a21bef3d269463c935048a7f4636c7b320073709023f7b0' +
+               '4d0530571a9a6f718280870bb63875d3f599bc229b95869cd5bb5d26640856d40b828198fdf2' +
+               'c099998ffdf772e462336c521cd326b5e4997bd95c135c57bd02c7afa80a2923d510951778ee' +
+               '5125b2aa18f90445453b85789224725b259279698ac9426c882baabc38d4fb3a3f6831180918' +
+               'b9825e0e418154d78aebab5e7e7066e69b2567476bf1177fe079a38298be6f01b098c33851ab' +
+               '25312b52e32a5750c2b73d293c0b810473b310aaf062f19914c7377b2e90388f575bf5e68534' +
+               '53b95a74aa18d62d4ae37e6996a48ab5217488a92d7b01e315c50b68204143792afc4f8367c0' +
+               'ce065ab32014bdb5515fe0594608aad1218994724afaaaa2df0355f46666b6e02a387b6d3da4' +
+               '713edb610bb048c3a2078b800e9ea483f2009c96d24c71b2cbc8e1200c0277383c5c27895e29' +
+               '8c3607701ce58702a91903274a041408234cb0021ef2b1c5131419b444dc84b89d147d1fe43c' +
+               '43f676d906735d9ca2a59c2232d97fd4aa1ae2bb3d1b170ca553cb2574954fdc6689fac623cb' +
+               'aa31982d82424d5a564fef7a8ba51b44df15053b2b45bec4aa1ed49929123daf754175c59382' +
+               '58c608b24d062042ab4bbee5e553a5ea627521738ae5ab2e06bd98b020787b2f5fa51eb4c46c' +
+               '2bf90e55a49560340667f88ac41432b7f551dfd98c037c79f79b41b985a8b1f51345550cd816' +
+               '714362040778c43e378a288394bd028c8c31b5a904bc4a5648a596035cb38f0e276e12c9a96f' +
+               '8425056b05a136642dd2cb75463036485ba1a50539e420e1e31dfac529cad6c68ec067467494' +
+               '73e050a4ac92b7199beceb239b6c12c8e716b66607aeca64a5850b01f99d0b176a7759781ed7' +
+               '7cb1ba40d17ac5c6cb06c942c002c2cf6efcb121f10ad2a45ff781426e7104cbdca73b81865a' +
+               'b22b00ba834355ae485a262f354248932c2be178369a3dd7e2428fdc379346ab2b754c43db65' +
+               '7460cb09c5c48b5810cb7a5c6156cf87440c9e36a4869a8ac458b382fc178915a9ce1bcdda7c' +
+               '48807c207e656ffb80bf33e32bc8c7b20ef60572612ceac99ad1c56ce5a764b29b74c17a5b51' +
+               '0b1afcb18a1afc35c12ac213725325f9b7a2eb338fe4c0080c31a58a995db7027d900e785448' +
+               '87f90ada467d0e383c119c5399310bc6735874e8804ff6c2bae57f2c3357cb627033c12a5924' +
+               'b20ce5abf113172bd2b77086cac543811793bba71734c9f005ac2656460bc30a442b38872575' +
+               '8a623e37ba6e293abfb84f344229f373c214ca776a7c05adc465fed93b9cf77f0022ab71f1ad' +
+               'de369dd8f420a58c057c14cc18dc47da7c12b086473eab419652967001c4e42a381c8ba539a8' +
+               '75d21a9945133bab9bc1e53a600de77cbfb2aeab6b19ced4c6eaa8998ee6a1577255f7132d80' +
+               'a32d6c0c6ec44c9c4b28699a645bb0bc958e00275077925309519b0824c7000dfa61912ec049' +
+               '063a067d00b059053e508a5bfee63473869c8a8510af898cd7572854f5c38af96f5f97a73726' +
+               '32ea7bb4b6fb831c612af71191ff9806b379bcd43c6059b7b1f953741444af713c155d962722' +
+               'b947aa23a32a89b356a6a7508aad63968c1dea78ff18aac27a89aa7b42b0d7481dd3cc649421' +
+               'e51397782218ac5441760ba51a0328d66b436fec32d7aa4d68e0cad1bc14f7241c903480f809' +
+               '983fc2c30d93138cf63b59bc737ac08192893d039187a811bef3d3209eb7b8d1e05b5b251cef' +
+               '760a210b2732867ab32049ba3c354e3858aee7b71df792924730d8e842e484122b50677b0a30' +
+               '6e61cf21b62091da18b937192936a09e5a418cf78b666157dd477af1c36a12320129522840e3' +
+               '70941157808782a5335b0ac10d70e1beafd401074b84b9826cc58aad217bae0f419b2da89613' +
+               '3272d8f22c6f420fcc738fccc1082fc93c7df0994c6bcf2cc8a29037b6bb2b4bcef4b0ee8caf' +
+               '8506bc5ecba082a56806c1cede0b944338a69a668254c1150ae05030e256b2b67661ba027d97' +
+               '576da613ac8c7c29051f1240b96b0c127e264d5e1dbbfe9561a567d5c9103673b446b3ccea6c' +
+               '5f7f34f09348a5d4a58b0498871dc940ee97b50c0336f9a60c3299f99560ac70657a27befa70' +
+               '2265ce590583e04a28326092d3dea2118dd1df5e81d7d3014ec4b5ce67dcb45ef001769dd5d5' +
+               'ada76934d38d740924712bfae672169d8f8744c151346d285fbb653f83aa0f',
+    ciphertext: 'dc63d18bb9715fb6e3ba71cb439fcd3377a75305cc9b144e6758bf5794a272e6b4a0da33234c' +
+                '0ac1bb5b4e60e4c82eb1fb780d59e4e4616641a0595ba031e3ae69d971dcd5fff14e21731a8e' +
+                '1a221f46c7820d214630b707fa1b0de3a484698f3d49e0a75f1212b8c42d330dd909f15eac04' +
+                '02f19ee77fba9447e1c44304b0d8c371c17c5549fdbdec1e0a2e7be9f577d7a4b5b2618d9ba6' +
+                '7ab95a0297cd5c5a13c89cc5a57cbd9a8ae38d66455c9a3d2bc55b498775fee2f6dc224d376d' +
+                '5f526a8354c8ed724f60337e900b85627972383e1fd987d407a8834005814a4fdc94c947e5f3' +
+                '471459288cfb127952b3208f10c914200bbaac5fcebd2bc9e2848492bab17b9288ca8b81d1c2' +
+                'ac9522dcc0b6d5f51e10f3afbb5d65fbf919edef6323c4e92c6b0690c10db25a9182de9e919e' +
+                'a1b3e65ae6150635d5180ebd7d23a2264828bc3ee1fd34dba1924ad0db30c747e05baa9148f1' +
+                'a032769c685e04665fd802a79c4624f69a9198a426eac1b217d903cdacf8844e73365f3a219a' +
+                '700dda27edf6bea33602617c5fd105b301b884bfaaa1163b791ec09f82523fef65c87b75ed06' +
+                '3ceb127729b82c8712e1f41b547d095f55ee71f3f8b47a306cb5d9bdd817854c74a42eebf934' +
+                'a1136dea3fbc546ad8ce51b3171913722f08b0261d197590342bfe4108dcb08c62a98610cbfb' +
+                '8d3b2831f56dcac2220e29a5811f38f0824f21a6cbebc64fd89a09b110dffbe03799ffc74fe5' +
+                '65c80dbf6a66acd7bfd14cb90acba03405a7982d4c1c68caa75f8b72e4dd6401d7dce4db4f6b' +
+                '820a7886a604b66b4e5b9eea5e5eddc2bca458a25977bd1f02874c5d9daf2baf56b3040f24ce' +
+                '7fe14cc14d61c7960db4decb37d9779c8e36d69a7763066d8c1149312d26887a693dc222daa8' +
+                '92dd00cd8f3a558cf605e4c65c011c2e9f0d671ba10af2bb90ee0351ae5078eb7878399ec9eb' +
+                '4ace87a68269618bda12a7aed6fda0385496c5d10ac36b35255f4a31edfa8a2c516b65c63431' +
+                '013ed4909ec7a787a5efb9d3c3887b80ac18a44934b6559bd8a84b18e86fa1b0b9e1d9f92ba4' +
+                '95ba5595d82e5095612b79e805154bf428a7071662c7cefb6450165c6f8f6954c37219bff4a4' +
+                '9894a8aa37f940a40f4ec942c281e6c47ea408199927a724ff1c7460fc8fd47a98d0c9d4d1f0' +
+                '7994d8084f6e084935ad7c2985282fabd5ca13b942e10d35278f4ff4cb1cb96f3c862410e791' +
+                '44a46b4db1a3c3d4d63018ec5c01ca48cb67081482e7d434b4abe5fa3071f2fbb533f745602b' +
+                '0da6183b28e6c5dfa42dab7ae0bbbf7638e106be1bd7312cba399e08c96dbd69a128a2face2d' +
+                '4a02951533a25e82fe63d0aaaa2e8c75150215c93ab06c22f9cab8d1cae7424f8baa09b3260e' +
+                'cfa3c7c8d55a276b4b317f72ec86b1b145a63aca83ef8c1204d8ab0c96ea3f742de39db47020' +
+                '616e139285814f188029ace4587f14cf12b5ed81086d8213cf8cb578341e04e16f519b77ff4c' +
+                '2644a5732639d658d0c4eaf992bd7dbd5011b700a5fa63dc1b24a84a3c80656bab5705dc3a74' +
+                '312c80e8bdb24a7ac6e27bcb8c07ece62c6e5777dd3dc0657181f440c7524d907dd27950bcb2' +
+                '52aef7f8cbf453cee3fe3143a665072c787cea76de323aa41537df2f3a40a518a694b918953b' +
+                'de8d57084e32d3b1fdcf9d153e73f02624beaf6ebe23e6828a6a489583494f3cd790fc96bb6f' +
+                '5d8b198402965e2e668e6581e7cf1c8a47a92198388f2b4cd38df660f0ddd48ad126819c4435' +
+                'af3a12c89113d778ac544fd8079cb8aaa97d2ff1b608da574c4dcd87f4979390de3be405f0e4' +
+                '7788dd0b01662805079fd73c64e9278c036544add3694c838bfcfb08c8a5efb09549442123ea' +
+                'a59fa30fbb9198105f6be00163bac076193f6721c539714108bbfae167f5db8085c5838618f3' +
+                '2a968bbb25c40645a17c17b9bec64aea45832eec5adc25b53e677f67566fbf5ce2d9193a06bd' +
+                '9b477e601d589b25f422defc49105252cd9ca6adcbb36be8a01a8472b4d463f655be14ccff9b' +
+                '0571a2048e31c14b9b23e2d43fafa3f85ece6fd41896cc5c68993dbaa926f285ec94c72887de' +
+                '9564881d735c05f83aa474b3d4cd133a630ac63850771cb5270f6cb7a391170d66af3e4901b6' +
+                'eb0253f3f34ef57d6babd97aa99ce718c3bcb53ff13d4028a0c943bb9681106ce176242cccb7' +
+                '5df1d3f8d3706e5b068b042c3154d5e6292581b36499e6b069b9a490aa67f0675390539da855' +
+                '5e6a4e8a35a86fdfea83e1387bf4acc650ec1edae7c99aa3a48306ee1d1a5e513c0c6901f64d' +
+                '0a3ee285de3c11d49f90cd4323dafda14832f0d8b760c0e5a48633c967cfaf',
+    sharedSecret: '8c028c6ea72a1c59408e2b15dd8fed8008517e861cd2329b159bda1919ea656c',
+  },
+];
+
+const lengths = {
+  'MLKEM768-P256': { publicKey: 1249, ciphertext: 1153, groupElement: 65 },
+  'MLKEM768-X25519': { publicKey: 1216, ciphertext: 1120, groupElement: 32 },
+  'MLKEM1024-P384': { publicKey: 1665, ciphertext: 1665, groupElement: 97 },
+};
+
+async function roundTripViaMessageChannel(key) {
+  const { port1, port2 } = new MessageChannel();
+  port1.postMessage(key);
+  const [received] = await once(port2, 'message');
+  port1.close();
+  port2.close();
+  return received;
+}
+
+function buffers(vector) {
+  return {
+    seed: Buffer.from(vector.seed, 'hex'),
+    publicKey: Buffer.from(vector.publicKey, 'hex'),
+    ciphertext: Buffer.from(vector.ciphertext, 'hex'),
+    sharedSecret: Buffer.from(vector.sharedSecret, 'hex'),
+  };
+}
+
+async function testAlgorithmConfigPrototypePollution() {
+  const properties = [
+    'encapsulationKeyLength',
+    'ciphertextLength',
+    'groupOrder',
+    'namedCurve',
+  ];
+  const descriptors = new Map();
+
+  for (const property of properties) {
+    descriptors.set(
+      property,
+      Object.getOwnPropertyDescriptor(Object.prototype, property));
+    Object.defineProperty(Object.prototype, property, {
+      __proto__: null,
+      configurable: true,
+      get: common.mustNotCall(`Object.prototype.${property} getter`),
+      set: common.mustNotCall(`Object.prototype.${property} setter`),
+    });
+  }
+
+  try {
+    await subtle.generateKey(
+      'MLKEM768-X25519',
+      true,
+      ['encapsulateBits', 'decapsulateBits']);
+  } finally {
+    for (const property of properties) {
+      const descriptor = descriptors.get(property);
+      if (descriptor === undefined) {
+        delete Object.prototype[property];
+      } else {
+        Object.defineProperty(Object.prototype, property, descriptor);
+      }
+    }
+  }
+}
+
+async function testGeneratedRoundTrip(vector) {
+  const algorithm = { name: vector.name };
+  const { ciphertext } = buffers(vector);
+  const keyPair = await subtle.generateKey(
+    algorithm,
+    true,
+    ['encapsulateKey', 'encapsulateBits', 'decapsulateKey', 'decapsulateBits']);
+  assert.strictEqual(Object.getPrototypeOf(keyPair), Object.prototype);
+  assert.deepStrictEqual(Object.keys(keyPair), ['publicKey', 'privateKey']);
+  const { privateKey, publicKey } = keyPair;
+
+  assert.strictEqual(publicKey.type, 'public');
+  assert.strictEqual(privateKey.type, 'private');
+  assert.strictEqual(publicKey.algorithm.name, algorithm.name);
+  assert.strictEqual(privateKey.algorithm.name, algorithm.name);
+  assert.deepStrictEqual(publicKey.usages, ['encapsulateKey', 'encapsulateBits']);
+  assert.deepStrictEqual(privateKey.usages, ['decapsulateKey', 'decapsulateBits']);
+
+  for (const key of [publicKey, privateKey]) {
+    assert.throws(() => KeyObject.from(key), {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: /cannot be represented by a single KeyObject/,
+    });
+  }
+
+  const encapsulated = await subtle.encapsulateBits(algorithm, publicKey);
+  assert.strictEqual(encapsulated.sharedKey.byteLength, 32);
+  assert.strictEqual(encapsulated.ciphertext.byteLength, ciphertext.byteLength);
+
+  const decapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(decapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+
+  const encapsulatedKey = await subtle.encapsulateKey(
+    algorithm,
+    publicKey,
+    { name: 'HMAC', hash: 'SHA-256' },
+    true,
+    ['sign']);
+  const decapsulatedKey = await subtle.decapsulateKey(
+    algorithm,
+    privateKey,
+    encapsulatedKey.ciphertext,
+    { name: 'HMAC', hash: 'SHA-256' },
+    true,
+    ['sign']);
+  assert(KeyObject.from(encapsulatedKey.sharedKey)
+    .export()
+    .equals(KeyObject.from(decapsulatedKey).export()));
+}
+
+async function testVectorRoundTrip(vector) {
+  const algorithm = { name: vector.name };
+  const { seed, publicKey, ciphertext, sharedSecret } = buffers(vector);
+  assert.strictEqual(seed.byteLength, 32);
+  assert.strictEqual(publicKey.byteLength, lengths[vector.name].publicKey);
+  assert.strictEqual(ciphertext.byteLength, lengths[vector.name].ciphertext);
+  assert.strictEqual(sharedSecret.byteLength, 32);
+
+  const privateKey = await subtle.importKey(
+    'raw-seed',
+    seed,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const publicKeyFromPrivate = await subtle.getPublicKey(
+    privateKey,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', publicKeyFromPrivate))
+    .equals(publicKey));
+
+  const jwk = await subtle.exportKey('jwk', privateKey);
+  assert.strictEqual(jwk.kty, 'AKP');
+  assert.strictEqual(jwk.alg, algorithm.name);
+  assert(Buffer.from(jwk.pub, 'base64url').equals(publicKey));
+  assert(Buffer.from(jwk.priv, 'base64url').equals(seed));
+
+  const publicJwk = await subtle.exportKey('jwk', publicKeyFromPrivate);
+  assert.deepStrictEqual(publicJwk, {
+    kty: 'AKP',
+    alg: algorithm.name,
+    pub: jwk.pub,
+    key_ops: ['encapsulateBits'],
+    ext: true,
+  });
+  const jwkPublicKey = await subtle.importKey(
+    'jwk',
+    publicJwk,
+    algorithm,
+    true,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', jwkPublicKey))
+    .equals(publicKey));
+
+  const jwkPrivateKey = await subtle.importKey(
+    'jwk',
+    jwk,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const vectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    jwkPrivateKey,
+    ciphertext);
+  assert(Buffer.from(vectorSharedSecret).equals(sharedSecret));
+
+  const implicitRejectionCiphertext = Buffer.from(ciphertext);
+  const pqCiphertextLength =
+    ciphertext.byteLength - lengths[vector.name].groupElement;
+  implicitRejectionCiphertext.fill(0, 0, pqCiphertextLength);
+  // Preserve the valid traditional group element so this only exercises
+  // ML-KEM implicit rejection.
+  assert(implicitRejectionCiphertext.subarray(pqCiphertextLength)
+    .equals(ciphertext.subarray(pqCiphertextLength)));
+
+  const implicitRejectionSharedSecret = Buffer.from(
+    await subtle.decapsulateBits(
+      algorithm,
+      privateKey,
+      implicitRejectionCiphertext));
+  assert.strictEqual(implicitRejectionSharedSecret.byteLength, 32);
+  assert(!implicitRejectionSharedSecret.equals(sharedSecret));
+  assert(implicitRejectionSharedSecret.equals(Buffer.from(
+    await subtle.decapsulateBits(
+      algorithm,
+      privateKey,
+      implicitRejectionCiphertext))));
+
+  const publicKeyOnly = await subtle.importKey(
+    'raw-public',
+    publicKey,
+    algorithm,
+    true,
+    ['encapsulateBits']);
+  const clonedPrivateKey = structuredClone(privateKey);
+  const clonedPublicKey = structuredClone(publicKeyOnly);
+  const portPrivateKey = await roundTripViaMessageChannel(privateKey);
+  const portPublicKey = await roundTripViaMessageChannel(publicKeyOnly);
+  assert.deepStrictEqual(clonedPrivateKey, privateKey);
+  assert.deepStrictEqual(clonedPublicKey, publicKeyOnly);
+  assert.deepStrictEqual(portPrivateKey, privateKey);
+  assert.deepStrictEqual(portPublicKey, publicKeyOnly);
+  assert(Buffer.from(await subtle.exportKey('raw-seed', clonedPrivateKey))
+    .equals(seed));
+  assert(Buffer.from(await subtle.exportKey('raw-seed', portPrivateKey))
+    .equals(seed));
+  assert(Buffer.from((await subtle.exportKey('jwk', clonedPrivateKey)).priv, 'base64url')
+    .equals(seed));
+  assert(Buffer.from((await subtle.exportKey('jwk', portPrivateKey)).priv, 'base64url')
+    .equals(seed));
+
+  const clonedPublicKeyFromPrivate = await subtle.getPublicKey(
+    clonedPrivateKey,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', clonedPublicKeyFromPrivate))
+    .equals(publicKey));
+
+  const clonedVectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    clonedPrivateKey,
+    ciphertext);
+  assert(Buffer.from(clonedVectorSharedSecret).equals(sharedSecret));
+  const portVectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    portPrivateKey,
+    ciphertext);
+  assert(Buffer.from(portVectorSharedSecret).equals(sharedSecret));
+
+  const { publicKey: differentPublicKey } = await subtle.generateKey(
+    algorithm,
+    true,
+    ['encapsulateBits', 'decapsulateBits']);
+  assert.notDeepStrictEqual(publicKeyOnly, differentPublicKey);
+
+  const encapsulated = await subtle.encapsulateBits(algorithm, publicKeyOnly);
+  const decapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(decapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+  const clonedDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    clonedPrivateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(clonedDecapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+
+  const clonedEncapsulated = await subtle.encapsulateBits(algorithm, clonedPublicKey);
+  const originalDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    clonedEncapsulated.ciphertext);
+  assert(Buffer.from(originalDecapsulated).equals(Buffer.from(clonedEncapsulated.sharedKey)));
+
+  const portEncapsulated = await subtle.encapsulateBits(algorithm, portPublicKey);
+  const portDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    portEncapsulated.ciphertext);
+  assert(Buffer.from(portDecapsulated).equals(Buffer.from(portEncapsulated.sharedKey)));
+}
+
+async function testFailures(vector) {
+  const algorithm = { name: vector.name };
+  const { seed, publicKey, ciphertext } = buffers(vector);
+  const privateKey = await subtle.importKey(
+    'raw-seed',
+    seed,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const publicKeyOnly = await subtle.getPublicKey(privateKey, ['encapsulateBits']);
+  const jwk = await subtle.exportKey('jwk', privateKey);
+
+  // JWK key usage validation precedes `key_ops` validation.
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, key_ops: ['encapsulateBits', 'encapsulateBits'] },
+      algorithm,
+      true,
+      ['encapsulateBits']),
+    {
+      name: 'SyntaxError',
+      message: `Unsupported key usage for ${vector.name} key`,
+    });
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, key_ops: ['decapsulateBits', 'decapsulateBits'] },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError', message: 'Duplicate key operation' });
+
+  await assert.rejects(
+    subtle.importKey('raw-public', Buffer.alloc(publicKey.byteLength - 1), algorithm, true, ['encapsulateBits']),
+    { name: 'DataError' });
+  await assert.rejects(
+    subtle.importKey('raw-seed', Buffer.alloc(seed.byteLength - 1), algorithm, true, ['decapsulateBits']),
+    { name: 'DataError' });
+  await assert.rejects(
+    subtle.importKey('raw-public', publicKey, algorithm, true, ['decapsulateBits']),
+    { name: 'SyntaxError' });
+  await assert.rejects(
+    subtle.importKey('raw-seed', seed, algorithm, true, ['encapsulateBits']),
+    { name: 'SyntaxError' });
+  await assert.rejects(
+    subtle.importKey('raw', publicKey, algorithm, true, ['encapsulateBits']),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.importKey('raw-private', seed, algorithm, true, ['decapsulateBits']),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.exportKey('spki', publicKeyOnly),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.exportKey('pkcs8', privateKey),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.decapsulateBits(algorithm, privateKey, Buffer.alloc(ciphertext.byteLength - 1)),
+    { name: 'OperationError' });
+
+  const badCiphertext = Buffer.from(ciphertext);
+  badCiphertext.fill(
+    0,
+    badCiphertext.byteLength - lengths[vector.name].groupElement);
+  await assert.rejects(
+    subtle.decapsulateBits(algorithm, privateKey, badCiphertext),
+    { name: 'OperationError' });
+
+  if (vector.name !== 'MLKEM768-X25519') {
+    const groupElementLength = lengths[vector.name].groupElement;
+    const nonCanonicalPublicKey = Buffer.from(publicKey);
+    const publicKeyPointOffset =
+      nonCanonicalPublicKey.byteLength - groupElementLength;
+    assert.strictEqual(nonCanonicalPublicKey[publicKeyPointOffset], 0x04);
+    nonCanonicalPublicKey[publicKeyPointOffset] =
+      0x06 | (nonCanonicalPublicKey[nonCanonicalPublicKey.byteLength - 1] & 1);
+    await assert.rejects(
+      subtle.importKey(
+        'raw-public',
+        nonCanonicalPublicKey,
+        algorithm,
+        true,
+        ['encapsulateBits']),
+      { name: 'DataError' });
+
+    const nonCanonicalCiphertext = Buffer.from(ciphertext);
+    const ciphertextPointOffset =
+      nonCanonicalCiphertext.byteLength - groupElementLength;
+    assert.strictEqual(nonCanonicalCiphertext[ciphertextPointOffset], 0x04);
+    nonCanonicalCiphertext[ciphertextPointOffset] =
+      0x06 | (nonCanonicalCiphertext[nonCanonicalCiphertext.byteLength - 1] & 1);
+    await assert.rejects(
+      subtle.decapsulateBits(algorithm, privateKey, nonCanonicalCiphertext),
+      { name: 'OperationError' });
+  }
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, alg: 'ML-KEM-768' },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError' });
+
+  const badPublicKey = Buffer.from(publicKey);
+  badPublicKey[0] ^= 1;
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, pub: badPublicKey.toString('base64url') },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError' });
+}
+
+function testSupports(vector) {
+  const algorithm = { name: vector.name };
+  assert(SubtleCrypto.supports('generateKey', algorithm));
+  assert(SubtleCrypto.supports('importKey', algorithm));
+  assert(SubtleCrypto.supports('exportKey', algorithm));
+  assert(SubtleCrypto.supports('getPublicKey', algorithm));
+  assert(SubtleCrypto.supports('encapsulateBits', algorithm));
+  assert(SubtleCrypto.supports('decapsulateBits', algorithm));
+  assert(SubtleCrypto.supports('encapsulateKey', algorithm, 'HKDF'));
+  assert(SubtleCrypto.supports('decapsulateKey', algorithm, 'HKDF'));
+  assert(!SubtleCrypto.supports('sign', algorithm));
+}
+
+(async () => {
+  await testAlgorithmConfigPrototypePollution();
+  for (const vector of vectors) {
+    testSupports(vector);
+    await testGeneratedRoundTrip(vector);
+    await testVectorRoundTrip(vector);
+    await testFailures(vector);
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-keygen-kmac.js b/test/parallel/test-webcrypto-keygen-kmac.js
index c1125412892e..33716095751f 100644
--- a/test/parallel/test-webcrypto-keygen-kmac.js
+++ b/test/parallel/test-webcrypto-keygen-kmac.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3))
   common.skip('requires OpenSSL >= 3');
@@ -13,38 +13,45 @@ if (!hasOpenSSL(3))
 const assert = require('assert');
 const { types: { isCryptoKey } } = require('util');
 const { subtle } = globalThis.crypto;
+const fips = hasFIPS();
 
 const usages = ['sign', 'verify'];
 
 async function test(name, length) {
-  length ??= name === 'KMAC128' ? 128 : 256;
-  const key = await subtle.generateKey({
-    name,
-    length,
-  }, true, usages);
-
-  assert(key);
-  assert(isCryptoKey(key));
-
-  assert.strictEqual(key.type, 'secret');
-  assert.strictEqual(key.toString(), '[object CryptoKey]');
-  assert.strictEqual(key.extractable, true);
-  assert.deepStrictEqual(key.usages, usages);
-  assert.strictEqual(key.algorithm.name, name);
-  assert.strictEqual(key.algorithm.length, length);
-  assert.strictEqual(key.algorithm, key.algorithm);
-  assert.strictEqual(key.usages, key.usages);
-
-  const raw = await subtle.exportKey('raw-secret', key);
-  assert.strictEqual(raw.byteLength, Math.ceil(length / 8));
+  const expectedLength = length ?? (name === 'KMAC128' ? 128 : 256);
+  const algorithm = { name };
+  if (length !== undefined)
+    algorithm.length = length;
+
+  if (fips && length !== undefined &&
+      (length < 32 || length % 8 !== 0)) return;
+
+  const generatedKey = await subtle.generateKey(algorithm, true, usages);
+
+  assert(generatedKey);
+  assert(isCryptoKey(generatedKey));
+
+  assert.strictEqual(generatedKey.type, 'secret');
+  assert.strictEqual(generatedKey.toString(), '[object CryptoKey]');
+  assert.strictEqual(generatedKey.extractable, true);
+  assert.deepStrictEqual(generatedKey.usages, usages);
+  assert.strictEqual(generatedKey.algorithm.name, name);
+  assert.strictEqual(generatedKey.algorithm.length, expectedLength);
+  assert.strictEqual(generatedKey.algorithm, generatedKey.algorithm);
+  assert.strictEqual(generatedKey.usages, generatedKey.usages);
+
+  const raw = await subtle.exportKey('raw-secret', generatedKey);
+  assert.strictEqual(raw.byteLength, Math.ceil(expectedLength / 8));
 }
 
 const kTests = [
   ['KMAC128', 0],
+  ['KMAC128', 32],
   ['KMAC128', 128],
   ['KMAC128', 256],
   ['KMAC128'],
   ['KMAC256', 0],
+  ['KMAC256', 32],
   ['KMAC256', 128],
   ['KMAC256', 256],
   ['KMAC256'],
diff --git a/test/parallel/test-webcrypto-keygen.js b/test/parallel/test-webcrypto-keygen.js
index 989fdbb47616..951ec07484be 100644
--- a/test/parallel/test-webcrypto-keygen.js
+++ b/test/parallel/test-webcrypto-keygen.js
@@ -6,15 +6,19 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { types: { isCryptoKey } } = require('util');
 const {
   createSecretKey,
+  getFips,
   KeyObject,
 } = require('crypto');
 const { subtle } = globalThis.crypto;
+const rsaMinimumModulusLength = getFips() === 1 ? 2048 : 512;
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
 
 const { bigIntArrayToUnsignedBigInt } = require('internal/crypto/util');
 
@@ -69,7 +73,7 @@ const vectors = {
   },
   'RSASSA-PKCS1-v1_5': {
     algorithm: {
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-256'
     },
@@ -81,7 +85,7 @@ const vectors = {
   },
   'RSA-PSS': {
     algorithm: {
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-256'
     },
@@ -93,7 +97,7 @@ const vectors = {
   },
   'RSA-OAEP': {
     algorithm: {
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-256'
     },
@@ -154,7 +158,7 @@ const vectors = {
   },
 };
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   vectors.Ed448 = {
     result: 'CryptoKeyPair',
     usages: [
@@ -196,7 +200,7 @@ if (hasOpenSSL(3)) {
   }
 }
 
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   for (const name of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
     vectors[name] = {
       result: 'CryptoKeyPair',
@@ -247,6 +251,21 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 // Test bad usages
 {
   async function test(name) {
+    if (fips3 && name === 'ChaCha20-Poly1305') {
+      await assert.rejects(
+        subtle.generateKey({ name }, true, []),
+        { name: 'NotSupportedError' });
+      return;
+    }
+
+    if (fips35 && (name === 'X25519' || name === 'X448')) {
+      await assert.rejects(
+        subtle.generateKey({ name }, true, ['deriveBits']),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.message === 'error:0308010C:digital envelope routines::unsupported');
+      return;
+    }
+
     await assert.rejects(
       subtle.generateKey(
         {
@@ -414,7 +433,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
       subtle.generateKey(
         { name, modulusLength, publicExponent: new Uint8Array([1, 1, 1, 1, 1]), hash }, true, usages),
       {
-        message: /The publicExponent must be equivalent to an unsigned 32-bit value/,
+        message: 'algorithm.publicExponent must fit in an unsigned 32-bit integer',
         name: 'OperationError',
       });
 
@@ -438,22 +457,36 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
       });
     }));
 
-    await Promise.all([[1], [1, 0, 0]].map((publicExponent) => {
+    await Promise.all([
+      [[1], 'algorithm.publicExponent must be at least 3'],
+      [[1, 0, 0], 'algorithm.publicExponent must be odd'],
+    ].map(({ 0: publicExponent, 1: message }) => {
       return assert.rejects(subtle.generateKey({
         name,
         modulusLength,
         publicExponent: new Uint8Array(publicExponent),
         hash
       }, true, usages), {
+        message,
         name: 'OperationError',
       });
     }));
+
+    await assert.rejects(subtle.generateKey({
+      name,
+      modulusLength: rsaMinimumModulusLength - 1,
+      publicExponent: new Uint8Array([3]),
+      hash,
+    }, true, usages), {
+      message: `algorithm.modulusLength must be at least ${rsaMinimumModulusLength}`,
+      name: 'OperationError',
+    });
   }
 
   const kTests = [
     [
       'RSASSA-PKCS1-v1_5',
-      1024,
+      getFips() === 1 ? 2048 : 1024,
       Buffer.from([1, 0, 1]),
       'SHA-1',
       ['sign'],
@@ -461,7 +494,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
     ],
     [
       'RSA-PSS',
-      1024,
+      getFips() === 1 ? 2048 : 1024,
       Buffer.from([1, 0, 1]),
       'SHA-256',
       ['sign'],
@@ -470,22 +503,37 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   ];
 
 
-  if (!process.features.openssl_is_boringssl) {
-    kTests.push(
-      [
-        'RSA-OAEP',
-        1024,
-        Buffer.from([3]),
-        'SHA3-256',
-        ['decrypt', 'unwrapKey'],
-        ['encrypt', 'wrapKey'],
-      ],
-    );
+  let fipsExponentTest;
+  if (!isBoringSSL) {
+    if (fips3) {
+      fipsExponentTest = assert.rejects(
+        subtle.generateKey({
+          name: 'RSA-OAEP',
+          modulusLength: 2048,
+          publicExponent: Buffer.from([3]),
+          hash: 'SHA3-256',
+        }, true, ['decrypt', 'unwrapKey', 'encrypt', 'wrapKey']),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.message === 'error:020000B2:rsa routines::pub exponent out of range');
+    } else {
+      kTests.push(
+        [
+          'RSA-OAEP',
+          1024,
+          Buffer.from([3]),
+          'SHA3-256',
+          ['decrypt', 'unwrapKey'],
+          ['encrypt', 'wrapKey'],
+        ],
+      );
+    }
   } else {
     common.printSkipMessage('Skipping unsupported SHA-3 test case');
   }
 
   const tests = kTests.map((args) => test(...args));
+  if (fipsExponentTest !== undefined)
+    tests.push(fipsExponentTest);
 
   Promise.all(tests).then(common.mustCall());
 }
@@ -674,7 +722,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
     [1024, 'SHA-512', ['sign', 'verify']],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
       [256, 'SHA3-256', ['sign', 'verify']],
       [384, 'SHA3-384', ['sign', 'verify']],
@@ -706,6 +754,13 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' });
 
 // Test OKP Key Generation
 {
+  async function testFipsUnsupported(name) {
+    await assert.rejects(
+      subtle.generateKey({ name }, true, ['deriveKey', 'deriveBits']),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.message === 'error:0308010C:digital envelope routines::unsupported');
+  }
+
   async function test(
     name,
     privateUsages,
@@ -753,7 +808,7 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' });
     ],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
       [
         'Ed448',
@@ -770,13 +825,18 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' });
     common.printSkipMessage('Skipping unsupported Curve448 test cases');
   }
 
-  const tests = kTests.map((args) => test(...args));
+  const tests = kTests.map((args) => {
+    const [name] = args;
+    if (fips35 && (name === 'X25519' || name === 'X448'))
+      return testFipsUnsupported(name);
+    return test(...args);
+  });
 
   Promise.all(tests).then(common.mustCall());
 }
 
 // Test ML-DSA Key Generation
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   async function test(
     name,
     privateUsages,
@@ -819,7 +879,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 }
 
 // Test ML-KEM Key Generation
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   async function test(
     name,
     privateUsages,
@@ -856,7 +916,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 
   const kTests = ['ML-KEM-768', 'ML-KEM-1024'];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.unshift('ML-KEM-512');
   } else {
     common.printSkipMessage('Skipping unsupported ML-KEM-512 test');
diff --git a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
index 5c13561dc260..7e58f7e08027 100644
--- a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
+++ b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
@@ -24,7 +24,21 @@ if (!common.hasCrypto) common.skip('missing crypto');
 
 const require = createRequire(import.meta.url);
 const { kSupportedAlgorithms } = require('internal/crypto/util');
+const { getFips } = require('node:crypto');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
+const fips4 = hasFIPS(4);
+const fips35UnavailableKeyGeneration = new Set([
+  'X25519',
+  'X448',
+]);
+const fips3UnavailableDerivation = new Set([
+  'Argon2d',
+  'Argon2i',
+  'Argon2id',
+]);
 
 Promise.prototype.then = common.mustNotCall('Promise.prototype.then');
 
@@ -333,7 +347,7 @@ function algorithm(name, params = {}) {
 
 function rsaAlgorithm(name) {
   return algorithm(name, {
-    modulusLength: 1024,
+    modulusLength: getFips() === 1 ? 2048 : 1024,
     publicExponent: new Uint8Array([1, 0, 1]),
     hash: 'SHA-256',
   });
@@ -864,6 +878,19 @@ for (const name of [
   }));
 }
 
+for (const name of [
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]) {
+  addFixture(name, kemFixture({
+    name,
+    generateAlgorithm: algorithm(name),
+    importAlgorithm: algorithm(name),
+    spki: false,
+  }));
+}
+
 for (const name of ['HKDF', 'PBKDF2']) {
   addFixture(name, kdfFixture({
     name,
@@ -877,8 +904,8 @@ for (const name of ['HKDF', 'PBKDF2']) {
       }) :
       algorithm(name, {
         hash: 'SHA-256',
-        salt: new Uint8Array(8),
-        iterations: 1,
+        salt: new Uint8Array(fips4 ? 16 : 8),
+        iterations: fips4 ? 1000 : 1,
       }),
   }));
 }
@@ -982,7 +1009,8 @@ const keyLengthTargets = {
 function getSupportedAlgorithmOperations() {
   const algorithms = new Map();
   for (const operation of Object.keys(kSupportedAlgorithms)) {
-    if (operation === 'get key length')
+    if (operation === 'get key length' ||
+        operation === 'get shared key length')
       continue;
     for (const name of Object.keys(kSupportedAlgorithms[operation])) {
       if (!algorithms.has(name))
@@ -1015,6 +1043,7 @@ const operationOrder = [
 const coveredOperations = new Set([
   ...operationOrder,
   'get key length',
+  'get shared key length',
 ]);
 
 for (const operation of Object.keys(kSupportedAlgorithms)) {
@@ -1023,12 +1052,39 @@ for (const operation of Object.keys(kSupportedAlgorithms)) {
     `missing prototype pollution operation coverage for ${operation}`);
 }
 
+const sharedKeyLengthAlgorithms =
+  Object.keys(kSupportedAlgorithms['get shared key length'] ?? {});
+assert.deepStrictEqual(
+  sharedKeyLengthAlgorithms,
+  Object.keys(kSupportedAlgorithms.encapsulate ?? {}));
+assert.deepStrictEqual(
+  sharedKeyLengthAlgorithms,
+  Object.keys(kSupportedAlgorithms.decapsulate ?? {}));
+
 const supportedAlgorithms = getSupportedAlgorithmOperations();
 for (const [name, operations] of supportedAlgorithms) {
   const fixture = fixtures.get(name);
   assert(fixture, `missing prototype pollution fixture for ${name}`);
 
   const ctx = { __proto__: null };
+  if (fips3 && fips3UnavailableDerivation.has(name)) {
+    await fixture.importKey(ctx);
+    await assert.rejects(
+      fixture.deriveBits(ctx),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.message === 'error:0308010C:digital envelope routines::unsupported');
+    continue;
+  }
+  if ((fips3 && name === 'ChaCha20-Poly1305') ||
+      (fips35 && fips35UnavailableKeyGeneration.has(name))) {
+    const expected = name === 'ChaCha20-Poly1305' ?
+      { name: 'NotSupportedError' } :
+      (err) => err.name === 'OperationError' &&
+               err.cause?.message === 'error:0308010C:digital envelope routines::unsupported';
+    await assert.rejects(fixture.generateKey(ctx), expected);
+    continue;
+  }
+
   for (const operation of operationOrder) {
     if (!operations.has(operation))
       continue;
@@ -1036,7 +1092,17 @@ for (const [name, operations] of supportedAlgorithms) {
       typeof fixture[operation],
       'function',
       `missing prototype pollution coverage for ${name} ${operation}`);
-    await fixture[operation](ctx);
+    if (fips3 && name === 'AES-OCB' &&
+        (operation === 'encrypt' || operation === 'decrypt')) {
+      if (operation === 'decrypt')
+        ctx.ciphertext = new Uint8Array();
+      await assert.rejects(
+        fixture[operation](ctx),
+        (err) => err.name === 'OperationError' &&
+                 err.cause?.message === 'error:0308010C:digital envelope routines::unsupported');
+    } else {
+      await fixture[operation](ctx);
+    }
   }
 
   if (typeof fixture.getPublicKey === 'function' &&
@@ -1074,17 +1140,22 @@ for (const name of getKeyLengthAlgorithms) {
     continue;
   }
 
-  await assertCryptoKeyResult(`get key length ${name}`, () =>
+  const deriveKey = () => assertCryptoKeyResult(`get key length ${name}`, () =>
     subtle.deriveKey(
       algorithm('PBKDF2', {
         hash: 'SHA-256',
-        salt: new Uint8Array(8),
-        iterations: 1,
+        salt: new Uint8Array(fips4 ? 16 : 8),
+        iterations: fips4 ? 1000 : 1,
       }),
       pbkdf2Key,
       target.algorithm,
       true,
       target.usages));
+  if (fips3 && name === 'ChaCha20-Poly1305') {
+    await assert.rejects(deriveKey(), { name: 'NotSupportedError' });
+  } else {
+    await deriveKey();
+  }
 }
 
 // Keep one explicit unwrapKey('jwk') negative case: the parsed object must not
diff --git a/test/parallel/test-webcrypto-prototype-pollution.mjs b/test/parallel/test-webcrypto-prototype-pollution.mjs
index a7104c2b7ae4..5ed77fc6021e 100644
--- a/test/parallel/test-webcrypto-prototype-pollution.mjs
+++ b/test/parallel/test-webcrypto-prototype-pollution.mjs
@@ -142,16 +142,24 @@ if (supports('digest', 'cSHAKE128')) {
       outputLength: 256,
       customization: new Uint8Array([1, 2, 3]),
     };
-    const expected = new Uint8Array(await subtle.digest(algorithm, data));
-    const plain = new Uint8Array(
-      await subtle.digest({ name: 'cSHAKE128', outputLength: 256 }, data));
-    assert.notDeepStrictEqual(expected, plain);
-    await withPoisoned(poisonTypedArrayByteLength(0),
-                       common.mustCall(async () => {
-                         assert.deepStrictEqual(
-                           new Uint8Array(await subtle.digest(algorithm, data)),
-                           expected);
-                       }));
+    if (getFips() === 1) {
+      await withPoisoned(poisonTypedArrayByteLength(0), common.mustCall(() =>
+        assert.rejects(subtle.digest(algorithm, data), {
+          name: 'NotSupportedError',
+          message: 'Unsupported CShakeParams customization',
+        })));
+    } else {
+      const expected = new Uint8Array(await subtle.digest(algorithm, data));
+      const plain = new Uint8Array(
+        await subtle.digest({ name: 'cSHAKE128', outputLength: 256 }, data));
+      assert.notDeepStrictEqual(expected, plain);
+      await withPoisoned(poisonTypedArrayByteLength(0),
+                         common.mustCall(async () => {
+                           assert.deepStrictEqual(
+                             new Uint8Array(await subtle.digest(algorithm, data)),
+                             expected);
+                         }));
+    }
   }
 }
 
@@ -290,17 +298,17 @@ await withPoisoned(
 // enforceRangeOptions(): [EnforceRange] uses IntegerPart, not round-half-even.
 {
   const key = await subtle.importKey(
-    'raw-secret', new Uint8Array(4), 'PBKDF2', false, ['deriveBits']);
+    'raw-secret', new Uint8Array(32), 'PBKDF2', false, ['deriveBits']);
   const pbkdf2 = (iterations) => subtle.deriveBits({
     name: 'PBKDF2',
     hash: 'SHA-256',
     salt: new Uint8Array(16),
     iterations,
-  }, key, 8);
+  }, key, 112);
 
-  const expected = new Uint8Array(await pbkdf2(1));
+  const expected = new Uint8Array(await pbkdf2(1000));
   await withPoisoned(inherited('clamp', true), common.mustCall(async () => {
-    assert.deepStrictEqual(new Uint8Array(await pbkdf2(1.5)), expected);
+    assert.deepStrictEqual(new Uint8Array(await pbkdf2(1000.5)), expected);
   }));
 }
 
diff --git a/test/parallel/test-webcrypto-raw-format-aliases.js b/test/parallel/test-webcrypto-raw-format-aliases.js
index 94e9474fde13..bce0c353904d 100644
--- a/test/parallel/test-webcrypto-raw-format-aliases.js
+++ b/test/parallel/test-webcrypto-raw-format-aliases.js
@@ -6,7 +6,9 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const rejectsXCurves = hasFIPS(3, 5);
 
 function getAlgorithmName(algorithm) {
   return typeof algorithm === 'string' ? algorithm : algorithm.name;
@@ -50,7 +52,7 @@ async function assertPublicKeyDoesNotAcceptRawSecret(
     importUsages);
 }
 
-Promise.all([
+const tests = [
   assertSecretKeyDoesNotAcceptRawPublic('HKDF'),
   assertSecretKeyDoesNotAcceptRawPublic('PBKDF2'),
   assertPublicKeyDoesNotAcceptRawSecret(
@@ -65,8 +67,18 @@ Promise.all([
     'Ed25519',
     ['sign', 'verify'],
     ['verify']),
-  assertPublicKeyDoesNotAcceptRawSecret(
+];
+
+if (rejectsXCurves) {
+  tests.push(assert.rejects(
+    subtle.generateKey('X25519', true, ['deriveBits']),
+    (err) => err.name === 'OperationError' &&
+             err.cause?.message === 'error:0308010C:digital envelope routines::unsupported'));
+} else {
+  tests.push(assertPublicKeyDoesNotAcceptRawSecret(
     'X25519',
     ['deriveBits'],
-    []),
-]).then(common.mustCall());
+    []));
+}
+
+Promise.all(tests).then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-sign-verify-ecdsa.js b/test/parallel/test-webcrypto-sign-verify-ecdsa.js
index eb7814efa556..94e3eff02eb9 100644
--- a/test/parallel/test-webcrypto-sign-verify-ecdsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-ecdsa.js
@@ -6,7 +6,10 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { getFips } = require('crypto');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const rejectsSha1Signing = hasFIPS(3) && !hasFIPS(3, 5);
 
 const vectors = require('../fixtures/crypto/ecdsa')();
 
@@ -50,7 +53,7 @@ async function testVerify({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -173,7 +176,7 @@ async function testSign({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -229,6 +232,32 @@ async function testSign({ name,
 
   for (let i = 0; i < vectors.length; ++i) {
     const vector = vectors[i];
+    if (rejectsSha1Signing && vector.hash === 'SHA-1') {
+      const publicKey = await subtle.importKey(
+        'spki',
+        vector.publicKeyBuffer,
+        { name: vector.name, namedCurve: vector.namedCurve },
+        false,
+        ['verify']);
+      const privateKey = await subtle.importKey(
+        'pkcs8',
+        vector.privateKeyBuffer,
+        { name: vector.name, namedCurve: vector.namedCurve },
+        false,
+        ['sign']);
+      assert(await subtle.verify(
+        { name: vector.name, hash: vector.hash },
+        publicKey,
+        vector.signature,
+        vector.plaintext));
+      await assert.rejects(
+        subtle.sign(
+          { name: vector.name, hash: vector.hash },
+          privateKey,
+          vector.plaintext),
+        { name: 'OperationError' });
+      continue;
+    }
     variations.push(testVerify(vector));
     variations.push(testSign(vector));
   }
diff --git a/test/parallel/test-webcrypto-sign-verify-eddsa.js b/test/parallel/test-webcrypto-sign-verify-eddsa.js
index 3c40139754be..2c1b0bd44001 100644
--- a/test/parallel/test-webcrypto-sign-verify-eddsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-eddsa.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const crypto = require('crypto');
@@ -31,7 +31,7 @@ const smallOrderVerifyVectors = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   smallOrderVerifyVectors.push({
     name: 'Ed448',
     publicKey: Buffer.concat([Buffer.from([1]), Buffer.alloc(56)]),
@@ -92,7 +92,7 @@ async function testVerify({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: crypto.getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -152,14 +152,12 @@ async function testVerify({ name,
       message: /Key algorithm mismatch/
     });
 
-  if (name === 'Ed448' && supportsContext) {
+  if (name === 'Ed448') {
     // Test failure when too long context
     await assert.rejects(
-      subtle.verify({ name, context: new Uint8Array(256) }, publicKey, signature, data), (err) => {
-        assert.strictEqual(err.name, 'OperationError');
-        assert.strictEqual(err.cause.code, 'ERR_OUT_OF_RANGE');
-        assert.strictEqual(err.cause.message, 'context string must be at most 255 bytes');
-        return true;
+      subtle.verify({ name, context: new Uint8Array(256) }, publicKey, signature, data), {
+        name: 'OperationError',
+        message: 'ContextParams.context must be at most 255 bytes',
       });
   }
 
@@ -219,7 +217,7 @@ async function testSign({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: crypto.getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -278,14 +276,12 @@ async function testSign({ name,
       message: /Key algorithm mismatch/
     });
 
-  if (name === 'Ed448' && supportsContext) {
+  if (name === 'Ed448') {
     // Test failure when too long context
     await assert.rejects(
-      subtle.sign({ name, context: new Uint8Array(256) }, privateKey, data), (err) => {
-        assert.strictEqual(err.name, 'OperationError');
-        assert.strictEqual(err.cause.code, 'ERR_OUT_OF_RANGE');
-        assert.strictEqual(err.cause.message, 'context string must be at most 255 bytes');
-        return true;
+      subtle.sign({ name, context: new Uint8Array(256) }, privateKey, data), {
+        name: 'OperationError',
+        message: 'ContextParams.context must be at most 255 bytes',
       });
   }
 }
diff --git a/test/parallel/test-webcrypto-sign-verify-hmac.js b/test/parallel/test-webcrypto-sign-verify-hmac.js
index ac3841fad79a..bbe5dd498109 100644
--- a/test/parallel/test-webcrypto-sign-verify-hmac.js
+++ b/test/parallel/test-webcrypto-sign-verify-hmac.js
@@ -6,6 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
 const vectors = require('../fixtures/crypto/hmac')();
@@ -35,7 +36,7 @@ async function testVerify({ hash,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -126,7 +127,7 @@ async function testSign({ hash,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
diff --git a/test/parallel/test-webcrypto-sign-verify-kmac.js b/test/parallel/test-webcrypto-sign-verify-kmac.js
index f93fc293b2a4..ac0b738bcd57 100644
--- a/test/parallel/test-webcrypto-sign-verify-kmac.js
+++ b/test/parallel/test-webcrypto-sign-verify-kmac.js
@@ -5,16 +5,38 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3))
   common.skip('requires OpenSSL >= 3');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
+const fips = hasFIPS();
+const fips4 = hasFIPS(4);
 
 const vectors = require('../fixtures/crypto/kmac')();
 
+function isFipsProviderUnsupported(err) {
+  return err.name === 'OperationError' &&
+    err.cause?.code === 'ERR_OSSL_EVP_UNSUPPORTED';
+}
+
+function usesNonFipsImplementation({ key, keyLength, outputLength }) {
+  const keyLengthInBits = keyLength ?? key.byteLength * 8;
+  return outputLength === 0 ||
+    outputLength % 8 !== 0 ||
+    keyLengthInBits < 32 ||
+    keyLengthInBits % 8 !== 0;
+}
+
+function isFips4Incompatible({ key, keyLength, outputLength }) {
+  const keyLengthInBits = keyLength ?? key.byteLength * 8;
+  return keyLengthInBits < 128 ||
+    keyLengthInBits % 8 !== 0 ||
+    outputLength % 8 !== 0;
+}
+
 async function testVerify({ algorithm,
                             key,
                             keyLength,
@@ -193,8 +215,17 @@ async function testSign({ algorithm,
   const variations = [];
 
   for (const vector of vectors) {
-    variations.push(testVerify(vector));
-    variations.push(testSign(vector));
+    if (fips && usesNonFipsImplementation(vector)) continue;
+
+    if (fips4 && isFips4Incompatible(vector)) {
+      variations.push(assert.rejects(
+        testVerify(vector), isFipsProviderUnsupported));
+      variations.push(assert.rejects(
+        testSign(vector), isFipsProviderUnsupported));
+    } else {
+      variations.push(testVerify(vector));
+      variations.push(testSign(vector));
+    }
   }
 
   await Promise.all(variations);
@@ -209,45 +240,66 @@ async function testSign({ algorithm,
     ['sign', 'verify']);
   const algorithm = {
     name: 'KMAC128',
-    outputLength: 9,
+    outputLength: fips ? 16 : 9,
     customization: new Uint8Array(),
   };
   const data = new Uint8Array([1, 2, 3]);
 
   const signature = await subtle.sign(algorithm, key, data);
   assert.strictEqual(signature.byteLength, 2);
-  assert.strictEqual(new Uint8Array(signature)[1] & 0b01111111, 0);
+  if (!fips)
+    assert.strictEqual(new Uint8Array(signature)[1] & 0b01111111, 0);
   assert(await subtle.verify(algorithm, key, signature, data));
 
-  const signature16 = new Uint8Array(await subtle.sign({
-    ...algorithm,
-    outputLength: 16,
-  }, key, data));
-  signature16[1] &= 0b10000000;
-  assert.notDeepStrictEqual(new Uint8Array(signature), signature16);
+  if (fips) {
+    const signature128 = await subtle.sign({
+      ...algorithm,
+      outputLength: 128,
+    }, key, data);
+    assert.strictEqual(signature128.byteLength, 16);
+    assert(await subtle.verify({
+      ...algorithm,
+      outputLength: 128,
+    }, key, signature128, data));
+  } else {
+    const signature16 = new Uint8Array(await subtle.sign({
+      ...algorithm,
+      outputLength: 16,
+    }, key, data));
+    signature16[1] &= 0b10000000;
+    assert.notDeepStrictEqual(new Uint8Array(signature), signature16);
+  }
 
   const invalidSignature = new Uint8Array(signature);
-  invalidSignature[1] |= 0b00000001;
+  if (fips)
+    invalidSignature[0] ^= 0b00000001;
+  else
+    invalidSignature[1] |= 0b00000001;
   assert(!(await subtle.verify(algorithm, key, invalidSignature, data)));
 
-  const nonByteKey = await subtle.importKey(
-    'raw-secret',
-    new Uint8Array([0xff, 0xff, 0xff, 0xff]),
-    { name: 'KMAC128', length: 25 },
-    false,
-    ['sign', 'verify']);
-  const nonByteKeySignature = await subtle.sign({
-    ...algorithm,
-    outputLength: 16,
-  }, nonByteKey, data);
-  assert.strictEqual(nonByteKeySignature.byteLength, 2);
-  assert(await subtle.verify({
-    ...algorithm,
-    outputLength: 16,
-  }, nonByteKey, nonByteKeySignature, data));
+  if (!fips) {
+    const nonByteKey = await subtle.importKey(
+      'raw-secret',
+      new Uint8Array([0xff, 0xff, 0xff, 0xff]),
+      { name: 'KMAC128', length: 25 },
+      false,
+      ['sign', 'verify']);
+    const nonByteKeySignature = subtle.sign({
+      ...algorithm,
+      outputLength: 16,
+    }, nonByteKey, data);
+    const result = await nonByteKeySignature;
+    assert.strictEqual(result.byteLength, 2);
+    assert(await subtle.verify({
+      ...algorithm,
+      outputLength: 16,
+    }, nonByteKey, result, data));
+  }
 })().then(common.mustCall());
 
 (async function() {
+  if (fips) return;
+
   const data = new Uint8Array([1, 2, 3]);
 
   for (const name of ['KMAC128', 'KMAC256']) {
@@ -265,9 +317,10 @@ async function testSign({ algorithm,
       assert.strictEqual(key.algorithm.length, keyData.byteLength * 8);
 
       const algorithm = { name, outputLength: 256 };
-      const signature = await subtle.sign(algorithm, key, data);
-      assert.strictEqual(signature.byteLength, 32);
-      assert(await subtle.verify(algorithm, key, signature, data));
+      const signature = subtle.sign(algorithm, key, data);
+      const result = await signature;
+      assert.strictEqual(result.byteLength, 32);
+      assert(await subtle.verify(algorithm, key, result, data));
     }
   }
 })().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
index b11e65ade791..6925c0782f81 100644
--- a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
@@ -5,9 +5,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -43,7 +43,7 @@ async function testVerify({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: crypto.getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -101,11 +101,9 @@ async function testVerify({ name,
 
   // Test failure when too long context
   await assert.rejects(
-    subtle.verify({ name, context: new Uint8Array(256) }, publicKey, signature, data), (err) => {
-      assert.strictEqual(err.name, 'OperationError');
-      assert.strictEqual(err.cause.code, 'ERR_OUT_OF_RANGE');
-      assert.strictEqual(err.cause.message, 'context string must be at most 255 bytes');
-      return true;
+    subtle.verify({ name, context: new Uint8Array(256) }, publicKey, signature, data), {
+      name: 'OperationError',
+      message: 'ContextParams.context must be at most 255 bytes',
     });
 
   // Test failure when signature is altered
@@ -156,7 +154,7 @@ async function testSign({ name,
     subtle.generateKey(
       {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: crypto.getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256',
       },
@@ -209,11 +207,9 @@ async function testSign({ name,
 
   // Test failure when too long context
   await assert.rejects(
-    subtle.sign({ name, context: new Uint8Array(256) }, privateKey, data), (err) => {
-      assert.strictEqual(err.name, 'OperationError');
-      assert.strictEqual(err.cause.code, 'ERR_OUT_OF_RANGE');
-      assert.strictEqual(err.cause.message, 'context string must be at most 255 bytes');
-      return true;
+    subtle.sign({ name, context: new Uint8Array(256) }, privateKey, data), {
+      name: 'OperationError',
+      message: 'ContextParams.context must be at most 255 bytes',
     });
 }
 
diff --git a/test/parallel/test-webcrypto-sign-verify-rsa.js b/test/parallel/test-webcrypto-sign-verify-rsa.js
index 0ccbf431f147..8ba0257b1772 100644
--- a/test/parallel/test-webcrypto-sign-verify-rsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-rsa.js
@@ -6,7 +6,10 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const fips3 = hasFIPS(3);
+const rejectsSha1Signing = hasFIPS(3) && !hasFIPS(3, 5);
 
 const rsa_pkcs = require('../fixtures/crypto/rsa_pkcs');
 const rsa_pss = require('../fixtures/crypto/rsa_pss');
@@ -194,6 +197,23 @@ async function testSign({
     });
 }
 
+async function testFipsSignRejected({
+  algorithm,
+  hash,
+  privateKeyBuffer,
+  plaintext,
+}) {
+  const privateKey = await subtle.importKey(
+    'pkcs8',
+    privateKeyBuffer,
+    { name: algorithm.name, hash },
+    false,
+    ['sign']);
+  await assert.rejects(
+    subtle.sign(algorithm, privateKey, plaintext),
+    { name: 'OperationError' });
+}
+
 async function testSaltLength(keyLength, hash, hLen) {
   const { publicKey, privateKey } = await subtle.generateKey({
     name: 'RSA-PSS',
@@ -205,22 +225,28 @@ async function testSaltLength(keyLength, hash, hLen) {
   const data = Buffer.from('Hello, world!');
   const max = keyLength / 8 - hLen - 2;
 
-  const signature = await subtle.sign({ name: 'RSA-PSS', saltLength: max }, privateKey, data);
-  await assert.rejects(
-    subtle.sign({ name: 'RSA-PSS', saltLength: max + 1 }, privateKey, data), (err) => {
-      assert.strictEqual(err.name, 'OperationError');
-      assert.strictEqual(err.cause?.code, 'ERR_OUT_OF_RANGE');
-      assert.strictEqual(err.cause?.message, `The value of "algorithm.saltLength" is out of range. It must be >= 0 && <= ${max}. Received ${max + 1}`);
-      return true;
-    });
-  await subtle.verify({ name: 'RSA-PSS', saltLength: max }, publicKey, signature, data);
-  await assert.rejects(
-    subtle.verify({ name: 'RSA-PSS', saltLength: max + 1 }, publicKey, signature, data), (err) => {
-      assert.strictEqual(err.name, 'OperationError');
-      assert.strictEqual(err.cause?.code, 'ERR_OUT_OF_RANGE');
-      assert.strictEqual(err.cause?.message, `The value of "algorithm.saltLength" is out of range. It must be >= 0 && <= ${max}. Received ${max + 1}`);
-      return true;
-    });
+  const signature = await subtle.sign(
+    { name: 'RSA-PSS', saltLength: max }, privateKey, data);
+  assert.strictEqual(await subtle.verify(
+    { name: 'RSA-PSS', saltLength: max }, publicKey, signature, data), true);
+
+  for (const saltLength of [max + 1, 0x7fffffff]) {
+    await assert.rejects(
+      subtle.sign({ name: 'RSA-PSS', saltLength }, privateKey, data), {
+        name: 'OperationError',
+      });
+    assert.strictEqual(await subtle.verify(
+      { name: 'RSA-PSS', saltLength }, publicKey, signature, data), false);
+  }
+
+  for (const saltLength of [0x80000000, 0xffffffff]) {
+    await assert.rejects(
+      subtle.sign({ name: 'RSA-PSS', saltLength }, privateKey, data), {
+        name: 'OperationError',
+      });
+    assert.strictEqual(await subtle.verify(
+      { name: 'RSA-PSS', saltLength }, publicKey, signature, data), false);
+  }
 }
 
 (async function() {
@@ -228,25 +254,43 @@ async function testSaltLength(keyLength, hash, hLen) {
 
   rsa_pkcs().forEach((vector) => {
     variations.push(testVerify(vector));
-    variations.push(testSign(vector));
+    variations.push(rejectsSha1Signing && vector.hash === 'SHA-1' ?
+      testFipsSignRejected(vector) : testSign(vector));
   });
   rsa_pss().forEach((vector) => {
     variations.push(testVerify(vector));
-    variations.push(testSign(vector));
+    variations.push(rejectsSha1Signing && vector.hash === 'SHA-1' ?
+      testFipsSignRejected(vector) : testSign(vector));
   });
 
-  for (const keyLength of [1024, 2048]) {
+  if (fips3) {
+    variations.push(assert.rejects(
+      subtle.generateKey({
+        name: 'RSA-PSS',
+        modulusLength: 1024,
+        publicExponent: new Uint8Array([1, 0, 1]),
+        hash: 'SHA-256',
+      }, false, ['sign', 'verify']),
+      {
+        name: 'OperationError',
+        message: 'algorithm.modulusLength must be at least 2048',
+      }));
+  }
+
+  for (const keyLength of fips3 ? [2048] : [1024, 2048]) {
     for (const [hash, hLen] of [
       ['SHA-1', 20],
       ['SHA-256', 32],
       ['SHA-384', 48],
       ['SHA-512', 64],
-      ...(!process.features.openssl_is_boringssl ? [
+      ...(!isBoringSSL ? [
         ['SHA3-256', 32],
         ['SHA3-384', 48],
         ['SHA3-512', 64],
       ] : []),
     ]) {
+      if (rejectsSha1Signing && hash === 'SHA-1')
+        continue;
       variations.push(testSaltLength(keyLength, hash, hLen));
     }
   }
diff --git a/test/parallel/test-webcrypto-sign-verify.js b/test/parallel/test-webcrypto-sign-verify.js
index 0a6f5cffe7b9..295f13782389 100644
--- a/test/parallel/test-webcrypto-sign-verify.js
+++ b/test/parallel/test-webcrypto-sign-verify.js
@@ -5,9 +5,10 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
+const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
 // This is only a partial test. The WebCrypto Web Platform Tests
@@ -19,7 +20,7 @@ const { subtle } = globalThis.crypto;
     const ec = new TextEncoder();
     const { publicKey, privateKey } = await subtle.generateKey({
       name: 'RSASSA-PKCS1-v1_5',
-      modulusLength: 1024,
+      modulusLength: getFips() === 1 ? 2048 : 1024,
       publicExponent: new Uint8Array([1, 0, 1]),
       hash: 'SHA-256'
     }, true, ['sign', 'verify']);
@@ -151,7 +152,7 @@ if (hasOpenSSL(3)) {
 }
 
 // Test Sign/Verify Ed448
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   async function test(data) {
     const ec = new TextEncoder();
     const { publicKey, privateKey } = await subtle.generateKey({
@@ -173,7 +174,7 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 // Test Sign/Verify ML-DSA
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   async function test(name, data) {
     const ec = new TextEncoder();
     const { publicKey, privateKey } = await subtle.generateKey({
diff --git a/test/parallel/test-webcrypto-supports.mjs b/test/parallel/test-webcrypto-supports.mjs
index 43d3ee03c8bc..15874102a22b 100644
--- a/test/parallel/test-webcrypto-supports.mjs
+++ b/test/parallel/test-webcrypto-supports.mjs
@@ -4,6 +4,11 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 import * as assert from 'node:assert';
+import { hasFIPS } from '../common/crypto.js';
+
+if (hasFIPS(3))
+  common.skip('SubtleCrypto.supports() does not reflect FIPS provider availability');
+
 const { SubtleCrypto } = globalThis;
 
 const sources = [
@@ -61,21 +66,48 @@ function supportsRawSecret(alg) {
   return false;
 }
 
-function supportsEncapsulatedRawSecret(alg) {
+function getSharedKeyLength(alg) {
+  switch (alg?.name?.toLowerCase?.() ?? alg?.toLowerCase?.()) {
+    case 'ml-kem-512':
+    case 'ml-kem-768':
+    case 'ml-kem-1024':
+    case 'mlkem768-p256':
+    case 'mlkem768-x25519':
+    case 'mlkem1024-p384':
+      return 256;
+  }
+}
+
+function supportsEncapsulatedRawSecret(encapsulationAlgorithm, alg) {
   if (!supportsRawSecret(alg)) return false;
-  switch (alg?.name?.toLowerCase?.()) {
+
+  const sharedKeyLength = getSharedKeyLength(encapsulationAlgorithm);
+  const name = alg?.name?.toLowerCase?.() ?? alg?.toLowerCase?.();
+  if (name?.startsWith('aes')) {
+    return sharedKeyLength === 128 ||
+           sharedKeyLength === 192 ||
+           sharedKeyLength === 256;
+  }
+
+  switch (name) {
+    case 'chacha20-poly1305':
+      return sharedKeyLength === 256;
     case 'hmac':
+      if (sharedKeyLength === 0) return false;
+      // Fall through
     case 'kmac128':
     case 'kmac256':
-      return typeof alg.length !== 'number' || Math.ceil(alg.length / 8) === 32;
+      return typeof alg !== 'object' ||
+             typeof alg.length !== 'number' ||
+             Math.ceil(alg.length / 8) * 8 === sharedKeyLength;
     default:
-      return true;
+      return sharedKeyLength !== undefined;
   }
 }
 
 for (const encap of vectors.encapsulateBits) {
   for (const imp of vectors.importKey) {
-    if (supportsEncapsulatedRawSecret(imp[1])) {
+    if (supportsEncapsulatedRawSecret(encap[1], imp[1])) {
       vectors.encapsulateKey.push([encap[0] && imp[0], encap[1], imp[1]]);
     } else {
       vectors.encapsulateKey.push([false, encap[1], imp[1]]);
@@ -85,7 +117,7 @@ for (const encap of vectors.encapsulateBits) {
 
 for (const decap of vectors.decapsulateBits) {
   for (const imp of vectors.importKey) {
-    if (supportsEncapsulatedRawSecret(imp[1])) {
+    if (supportsEncapsulatedRawSecret(decap[1], imp[1])) {
       vectors.decapsulateKey.push([decap[0] && imp[0], decap[1], imp[1]]);
     } else {
       vectors.decapsulateKey.push([false, decap[1], imp[1]]);
diff --git a/test/parallel/test-webcrypto-util.js b/test/parallel/test-webcrypto-util.js
index 9763acfb71e0..c0c565a15f3d 100644
--- a/test/parallel/test-webcrypto-util.js
+++ b/test/parallel/test-webcrypto-util.js
@@ -27,8 +27,14 @@ const {
     bigIntArrayToUnsignedInt(new Uint8Array([1, 0, 1])),
     65537);
   assert.strictEqual(
-    bigIntArrayToUnsignedInt(new Uint8Array([1, 0, 0, 0, 0])),
-    undefined);
+    bigIntArrayToUnsignedInt(new Uint8Array([0, 0, 1, 0, 1])),
+    65537);
+  assert.throws(
+    () => bigIntArrayToUnsignedInt(new Uint8Array([1, 0, 0, 0, 0])),
+    {
+      name: 'OperationError',
+      message: 'algorithm.publicExponent must fit in an unsigned 32-bit integer',
+    });
 }
 
 {
diff --git a/test/parallel/test-webcrypto-webidl-brand.js b/test/parallel/test-webcrypto-webidl-brand.js
new file mode 100644
index 000000000000..d4d785684906
--- /dev/null
+++ b/test/parallel/test-webcrypto-webidl-brand.js
@@ -0,0 +1,38 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { subtle } = globalThis.crypto;
+const { CryptoKey } = require('internal/crypto/keys');
+const { converters } = require('internal/crypto/webidl');
+
+async function main() {
+  const bytes = new Uint8Array(16);
+  const key = await subtle.importKey('raw', bytes, 'AES-GCM', true, ['encrypt']);
+
+  for (const value of [
+    { __proto__: CryptoKey.prototype },
+    { __proto__: key },
+    Object.create(CryptoKey.prototype, Object.getOwnPropertyDescriptors(key)),
+    new Proxy(key, {}),
+  ]) {
+    assert.throws(() => converters.CryptoKey(value), {
+      name: 'TypeError',
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+    await assert.rejects(subtle.exportKey('raw', value), {
+      name: 'TypeError',
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+  }
+
+  Object.setPrototypeOf(key, null);
+  assert.strictEqual(converters.CryptoKey(key), key);
+  assert.deepStrictEqual(new Uint8Array(await subtle.exportKey('raw', key)), bytes);
+}
+
+main().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
index 18ba6dc37963..f557f2ae4736 100644
--- a/test/parallel/test-webcrypto-wrap-unwrap.js
+++ b/test/parallel/test-webcrypto-wrap-unwrap.js
@@ -5,10 +5,13 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
+const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
+const fips3 = hasFIPS(3);
+const fips35 = hasFIPS(3, 5);
 
 const kWrappingData = {
   'RSA-OAEP': {
@@ -35,7 +38,7 @@ const kWrappingData = {
     wrap: {
       iv: new Uint8Array(16),
       additionalData: new Uint8Array(16),
-      tagLength: 64
+      tagLength: fips3 ? 128 : 64
     },
     pair: false
   },
@@ -54,7 +57,10 @@ const kWrappingData = {
   }
 };
 
-if (hasOpenSSL(3)) {
+if (fips3)
+  delete kWrappingData['ChaCha20-Poly1305'];
+
+if (hasOpenSSL(3) && !fips3) {
   kWrappingData['AES-OCB'] = {
     generate: { length: 128 },
     wrap: {
@@ -87,7 +93,7 @@ async function generateKeysToWrap() {
     {
       algorithm: {
         name: 'RSASSA-PKCS1-v1_5',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256'
       },
@@ -98,7 +104,7 @@ async function generateKeysToWrap() {
     {
       algorithm: {
         name: 'RSA-PSS',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256'
       },
@@ -109,7 +115,7 @@ async function generateKeysToWrap() {
     {
       algorithm: {
         name: 'RSA-OAEP',
-        modulusLength: 1024,
+        modulusLength: getFips() === 1 ? 2048 : 1024,
         publicExponent: new Uint8Array([1, 0, 1]),
         hash: 'SHA-256'
       },
@@ -200,7 +206,7 @@ async function generateKeysToWrap() {
     },
   ];
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     for (const name of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
       parameters.push({
         algorithm: { name },
@@ -211,7 +217,7 @@ async function generateKeysToWrap() {
     }
   }
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     parameters.push(
       {
         algorithm: {
@@ -234,6 +240,20 @@ async function generateKeysToWrap() {
     common.printSkipMessage('Skipping unsupported Curve test cases');
   }
 
+  if (fips3) {
+    const unsupported = new Set([
+      'ChaCha20-Poly1305',
+    ]);
+    if (fips35) {
+      unsupported.add('X25519');
+      unsupported.add('X448');
+    }
+    for (let i = parameters.length - 1; i >= 0; --i) {
+      if (unsupported.has(parameters[i].algorithm.name))
+        parameters.splice(i, 1);
+    }
+  }
+
   const allkeys = await Promise.all(parameters.map(async (params) => {
     const usages = 'usages' in params ?
       params.usages :
@@ -360,6 +380,37 @@ function testWrapping(name, keys) {
 }
 
 (async function() {
+  if (fips3) {
+    await assert.rejects(
+      subtle.generateKey(
+        { name: 'ChaCha20-Poly1305' }, true, ['wrapKey']),
+      { name: 'NotSupportedError' });
+
+    if (fips35) {
+      for (const name of ['X25519', 'X448']) {
+        await assert.rejects(
+          subtle.generateKey({ name }, true, ['deriveBits']),
+          (err) => err.name === 'OperationError' &&
+                   err.cause?.message === 'error:0308010C:digital envelope routines::unsupported');
+      }
+    }
+
+    const wrappingKey = await subtle.generateKey(
+      { name: 'AES-OCB', length: 128 }, true, ['wrapKey']);
+    const key = await subtle.generateKey(
+      { name: 'HMAC', hash: 'SHA-256', length: 256 },
+      true,
+      ['sign']);
+    await assert.rejects(
+      subtle.wrapKey(
+        'raw',
+        key,
+        wrappingKey,
+        { name: 'AES-OCB', iv: new Uint8Array(15), tagLength: 128 }),
+      (err) => err.name === 'OperationError' &&
+               err.cause?.message === 'error:0308010C:digital envelope routines::unsupported');
+  }
+
   await generateWrappingKeys();
   const keys = await generateKeysToWrap();
   const variations = [];
@@ -434,7 +485,7 @@ async function testNonByteLengthWrapUnwrap({
     implicitAlgorithm: hmacAlgorithm,
   });
 
-  if (hasOpenSSL(3)) {
+  if (hasOpenSSL(3) && getFips() !== 1) {
     const kmacAlgorithm = { name: 'KMAC128' };
     const kmacKey = await subtle.importKey(
       'raw-secret',
@@ -455,7 +506,7 @@ async function testNonByteLengthWrapUnwrap({
 // Test that wrapKey/unwrapKey validate the wrapping/unwrapping key's
 // algorithm and usage before proceeding.
 // Spec: https://w3c.github.io/webcrypto/#SubtleCrypto-method-wrapKey
-// Steps 9-10 (wrapping key checks) must precede step 12 (exportKey).
+// Steps 9-10 (wrapping key checks) must precede step 13 (export operation).
 (async function() {
   const hmacKey = await subtle.generateKey(
     { name: 'HMAC', hash: 'SHA-256' },
@@ -500,7 +551,7 @@ async function testNonByteLengthWrapUnwrap({
     });
 
   // Correct wrapping key algorithm and usage results in the expected
-  // exportKey error (not the wrapping key validation error).
+  // export operation error (not the wrapping key validation error).
   const wrapKey = await subtle.generateKey(
     { name: 'AES-GCM', length: 128 },
     true,
@@ -512,8 +563,19 @@ async function testNonByteLengthWrapUnwrap({
       name: 'AES-GCM',
       iv: new Uint8Array(12),
     }), {
-      // exportKey('spki', privateKey) throws NotSupportedError
-      name: 'NotSupportedError',
+      message: 'Key must be a public key',
+      name: 'InvalidAccessError',
+    });
+
+  // Symmetric case: exporting a public key as 'pkcs8' must also fail with
+  // InvalidAccessError, not the generic NotSupportedError.
+  await assert.rejects(
+    subtle.wrapKey('pkcs8', ecKey.publicKey, wrapKey, {
+      name: 'AES-GCM',
+      iv: new Uint8Array(12),
+    }), {
+      message: 'Key must be a private key',
+      name: 'InvalidAccessError',
     });
 
   // --- unwrapKey validation tests ---
diff --git a/test/parallel/test-webstreams-pipeline.js b/test/parallel/test-webstreams-pipeline.js
index 79188d88bf54..5910f919ea61 100644
--- a/test/parallel/test-webstreams-pipeline.js
+++ b/test/parallel/test-webstreams-pipeline.js
@@ -212,7 +212,7 @@ const http = require('http');
         values.push(chunk?.toString());
       });
       res.on('end', common.mustCall(() => {
-        assert.deepStrictEqual(values, ['hello', 'world']);
+        assert.strictEqual(values.join(''), 'helloworld');
         server.close();
       }));
     }));
diff --git a/test/parallel/test-webstreams-writer-closed-abort-pending.js b/test/parallel/test-webstreams-writer-closed-abort-pending.js
new file mode 100644
index 000000000000..b03ccbe3ef98
--- /dev/null
+++ b/test/parallel/test-webstreams-writer-closed-abort-pending.js
@@ -0,0 +1,42 @@
+'use strict';
+
+// The writer's closed promise stays pending until the sink's abort()
+// algorithm settles, even when it is first observed after the stream has
+// already reached the 'errored' state.
+
+const common = require('../common');
+const assert = require('assert');
+const { setImmediate: immediate } = require('timers/promises');
+const { WritableStream } = require('stream/web');
+
+async function main() {
+  const error = new Error('boom');
+  const { promise: abortComplete, resolve: finishAbort } = Promise.withResolvers();
+  const ws = new WritableStream({
+    abort: common.mustCall((reason) => {
+      assert.strictEqual(reason, error);
+      return abortComplete;
+    }),
+  });
+  const writer = ws.getWriter();
+  const aborted = writer.abort(error);
+
+  // Lets the stream finish erroring and call the sink's abort().
+  await immediate();
+
+  let closedSettled = false;
+  const closed = writer.closed.catch(common.mustCall((reason) => {
+    closedSettled = true;
+    assert.strictEqual(reason, error);
+  }));
+
+  await immediate();
+  assert.strictEqual(closedSettled, false);
+
+  finishAbort();
+  await aborted;
+  await closed;
+  assert.strictEqual(closedSettled, true);
+}
+
+main().then(common.mustCall());
diff --git a/test/parallel/test-whatwg-transformstream-parked-write-error.js b/test/parallel/test-whatwg-transformstream-parked-write-error.js
new file mode 100644
index 000000000000..b457fec573fb
--- /dev/null
+++ b/test/parallel/test-whatwg-transformstream-parked-write-error.js
@@ -0,0 +1,57 @@
+'use strict';
+
+require('../common');
+const { test } = require('node:test');
+const assert = require('node:assert');
+const { TransformStream } = require('stream/web');
+const { setImmediate } = require('timers/promises');
+
+// A transform sink write arriving while the stream has backpressure is
+// parked until backpressure clears. These cases complete a parked write
+// while the writable side is already erroring.
+//
+// The setImmediate() lets the start algorithm settle so the write below
+// reaches the sink and parks (backpressure is set until the readable
+// side pulls).
+
+test('readable.cancel() rejects a parked write with the cancel reason', async () => {
+  const stream = new TransformStream();
+  const writer = stream.writable.getWriter();
+  await setImmediate();
+
+  const reason = new Error('cancelled');
+  const write = writer.write('parked');
+  await stream.readable.cancel(reason);
+  await assert.rejects(write, (err) => err === reason);
+});
+
+test('controller.error() rejects a parked write with the stored error', async () => {
+  let controller;
+  const stream = new TransformStream({
+    start(c) { controller = c; },
+  });
+  const writer = stream.writable.getWriter();
+  await setImmediate();
+
+  const reason = new Error('boom');
+  const write = writer.write('parked');
+  controller.error(reason);
+  await assert.rejects(write, (err) => err === reason);
+  await assert.rejects(writer.closed, (err) => err === reason);
+});
+
+test('controller.terminate() rejects a parked write', async () => {
+  let controller;
+  const stream = new TransformStream({
+    start(c) { controller = c; },
+  });
+  const writer = stream.writable.getWriter();
+  await setImmediate();
+
+  const write = writer.write('parked');
+  controller.terminate();
+  await assert.rejects(write, {
+    name: 'TypeError',
+    message: /terminated/,
+  });
+});
diff --git a/test/parallel/test-whatwg-webstreams-adapters-streambase.js b/test/parallel/test-whatwg-webstreams-adapters-streambase.js
index bd864ab8c141..8a42dd6a9b76 100644
--- a/test/parallel/test-whatwg-webstreams-adapters-streambase.js
+++ b/test/parallel/test-whatwg-webstreams-adapters-streambase.js
@@ -35,6 +35,8 @@ const {
 {
   const buf = Buffer.from('hello');
   const check = new Uint8Array(buf);
+  const buf2 = Buffer.from('world');
+  const check2 = new Uint8Array(buf2);
 
   const stream = new JSStream();
 
@@ -47,13 +49,20 @@ const {
     assert.deepStrictEqual(new Uint8Array(value), check);
 
     reader.read().then(common.mustCall(({ done, value }) => {
-      assert(done);
-      assert.strictEqual(value, undefined);
-    }));
+      assert(!done);
+      assert.deepStrictEqual(new Uint8Array(value), check2);
 
+      reader.read().then(common.mustCall(({ done, value }) => {
+        assert(done);
+        assert.strictEqual(value, undefined);
+      }));
+    }));
   }));
 
+  // Two reads land in the same read buffer; the second chunk must be
+  // sliced from its offset within it.
   stream.readBuffer(buf);
+  stream.readBuffer(buf2);
   stream.emitEOF();
 }
 
diff --git a/test/parallel/test-worker-heap-profile.js b/test/parallel/test-worker-heap-profile.js
index e5aff1f78978..bb445b98f951 100644
--- a/test/parallel/test-worker-heap-profile.js
+++ b/test/parallel/test-worker-heap-profile.js
@@ -18,11 +18,10 @@ worker.on('online', common.mustCall(async () => {
 
   {
     const handle = await worker.startHeapProfile();
-    try {
-      await worker.startHeapProfile();
-    } catch (err) {
-      assert.strictEqual(err.code, 'ERR_HEAP_PROFILE_HAVE_BEEN_STARTED');
-    }
+
+    await assert.rejects(worker.startHeapProfile(), {
+      code: 'ERR_HEAP_PROFILE_HAVE_BEEN_STARTED',
+    });
     JSON.parse(await handle.stop());
   }
 
diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js
index ab91e3345556..47901140cac0 100644
--- a/test/parallel/test-x509-escaping.js
+++ b/test/parallel/test-x509-escaping.js
@@ -10,7 +10,7 @@ const { X509Certificate } = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 // Test that all certificate chains provided by the reporter are rejected.
 {
@@ -59,8 +59,8 @@ const { hasOpenSSL3 } = require('../common/crypto');
     'IP Address:8.8.8.8',
     'IP Address:8.8.4.4',
     // For backward-compatibility, include invalid IP address lengths.
-    hasOpenSSL3 ? 'IP Address:<invalid length=5>' : 'IP Address:<invalid>',
-    hasOpenSSL3 ? 'IP Address:<invalid length=6>' : 'IP Address:<invalid>',
+    hasOpenSSL(3) ? 'IP Address:<invalid length=5>' : 'IP Address:<invalid>',
+    hasOpenSSL(3) ? 'IP Address:<invalid length=6>' : 'IP Address:<invalid>',
     // IPv6 addresses are represented as OpenSSL does.
     'IP Address:A0B:C0D:E0F:0:0:0:7A7B:7C7D',
     // Regular email addresses don't require escaping.
@@ -88,22 +88,22 @@ const { hasOpenSSL3 } = require('../common/crypto');
     // This is an OID that will likely never be assigned to anything, thus
     // OpenSSL should not know it.
     'Registered ID:1.3.9999.12.34',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:XmppAddr:abc123' :
       'othername:<unsupported>',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:"XmppAddr:abc123\\u002c DNS:good.example.com"' :
       'othername:<unsupported>',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:"XmppAddr:good.example.com\\u0000abc123"' :
       'othername:<unsupported>',
     // This is unsupported because the OID is not recognized.
     'othername:<unsupported>',
-    hasOpenSSL3 ? 'othername:SRVName:abc123' : 'othername:<unsupported>',
+    hasOpenSSL(3) ? 'othername:SRVName:abc123' : 'othername:<unsupported>',
     // This is unsupported because it is an SRVName with a UTF8String value,
     // which is not allowed for SRVName.
     'othername:<unsupported>',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:"SRVName:abc\\u0000def"' :
       'othername:<unsupported>',
   ];
@@ -173,7 +173,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
         ],
       },
     },
-    hasOpenSSL3 ? {
+    hasOpenSSL(3) ? {
       text: 'OCSP - othername:XmppAddr:good.example.com\n' +
             'OCSP - othername:<unsupported>\n' +
             'OCSP - othername:SRVName:abc123',
@@ -196,7 +196,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
         ],
       },
     },
-    hasOpenSSL3 ? {
+    hasOpenSSL(3) ? {
       text: 'OCSP - othername:"XmppAddr:good.example.com\\u0000abc123"',
       legacy: {
         'OCSP - othername': [
@@ -222,7 +222,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
     // Test the subjectAltName property of the X509Certificate API.
     const cert = new X509Certificate(pem);
     assert.strictEqual(cert.infoAccess,
-                       `${expected.text}${hasOpenSSL3 ? '' : '\n'}`);
+                       `${expected.text}${hasOpenSSL(3) ? '' : '\n'}`);
 
     // Test that the certificate obtained by checkServerIdentity has the correct
     // subjectaltname property.
@@ -439,7 +439,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
 
   // The hostname is the CN, but not a SAN entry.
   const servername = 'good.example.com';
-  const cnFallback = process.features.openssl_is_boringssl ? undefined :
+  const cnFallback = isBoringSSL ? undefined :
     servername;
   const certX509 = new X509Certificate(cert);
   assert.strictEqual(certX509.subject, `CN=${servername}`);
@@ -485,7 +485,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
   assert.strictEqual(certX509.subjectAltName, 'IP Address:1.2.3.4');
 
   // The newer X509Certificate API allows customizing this behavior:
-  const cnFallback = process.features.openssl_is_boringssl ? undefined :
+  const cnFallback = isBoringSSL ? undefined :
     servername;
   assert.strictEqual(certX509.checkHost(servername), cnFallback);
   assert.strictEqual(certX509.checkHost(servername, { subject: 'default' }),
diff --git a/test/parallel/test-zlib-reject-garbage-after-end.js b/test/parallel/test-zlib-reject-garbage-after-end.js
index 8039865f5f11..5cd36f42c267 100644
--- a/test/parallel/test-zlib-reject-garbage-after-end.js
+++ b/test/parallel/test-zlib-reject-garbage-after-end.js
@@ -23,10 +23,13 @@ function callAsync(fn, input, options) {
   });
 }
 
-async function collect(stream, input) {
+async function collect(stream, ...inputs) {
   const chunks = [];
   stream.on('data', (chunk) => chunks.push(chunk));
-  stream.end(input);
+  for (let i = 0; i < inputs.length - 1; i++) {
+    stream.write(inputs[i]);
+  }
+  stream.end(inputs[inputs.length - 1]);
   await finished(stream);
   return Buffer.concat(chunks);
 }
@@ -79,6 +82,7 @@ const cases = [
     decompressSync: zlib.zstdDecompressSync,
     createDecompress: zlib.createZstdDecompress,
     defaultOutput: 'a',
+    trailingInput: Buffer.from('trailing junk'),
   },
 ];
 
@@ -89,10 +93,14 @@ for (const {
   decompressSync,
   createDecompress,
   defaultOutput,
+  trailingInput,
 } of cases) {
   test(`rejectGarbageAfterEnd rejects trailing input for ${label}`, async () => {
     const compressed = compress(Buffer.from('a'));
-    const withTrailingInput = Buffer.concat([compressed, compressed]);
+    const withTrailingInput = Buffer.concat([
+      compressed,
+      trailingInput ?? compressed,
+    ]);
 
     assert.strictEqual(decompressSync(withTrailingInput).toString(), defaultOutput);
     assert.strictEqual(
@@ -122,6 +130,134 @@ for (const {
   });
 }
 
+test('zstd decompresses concatenated frames regardless of chunking', async () => {
+  const first = zlib.zstdCompressSync('a');
+  const second = zlib.zstdCompressSync('b');
+  const skippable = Buffer.alloc(12);
+  skippable.writeUInt32LE(0x184d2a50, 0);
+  skippable.writeUInt32LE(4, 4);
+  skippable.write('meta', 8);
+
+  for (const input of [
+    Buffer.concat([first, second]),
+    Buffer.concat([first, skippable, second]),
+  ]) {
+    for (const rejectGarbageAfterEnd of [false, true]) {
+      const options = { rejectGarbageAfterEnd };
+      assert.strictEqual(
+        zlib.zstdDecompressSync(input, options).toString(),
+        'ab',
+      );
+      assert.strictEqual(
+        (await callAsync(zlib.zstdDecompress, input, options)).toString(),
+        'ab',
+      );
+
+      for (let split = 0; split <= input.length; split++) {
+        assert.strictEqual(
+          (await collect(
+            zlib.createZstdDecompress(options),
+            input.subarray(0, split),
+            input.subarray(split),
+          )).toString(),
+          'ab',
+          `split at byte ${split}`,
+        );
+      }
+    }
+  }
+});
+
+test('zstd trailing junk handling is independent of chunking', async () => {
+  const compressed = zlib.zstdCompressSync('a');
+  const laterFrame = zlib.zstdCompressSync('b');
+  const junk = Buffer.from('trailing junk');
+
+  assert.strictEqual(
+    (await collect(
+      zlib.createZstdDecompress(),
+      compressed,
+      junk,
+      laterFrame,
+    )).toString(),
+    'a',
+  );
+  await assert.rejects(
+    collect(
+      zlib.createZstdDecompress({ rejectGarbageAfterEnd: true }),
+      compressed,
+      junk,
+    ),
+    trailingJunkError,
+  );
+});
+
+test('zstd handles incomplete trailing frame identifiers as junk', async () => {
+  const compressed = zlib.zstdCompressSync('a');
+  const framePrefix = zlib.zstdCompressSync('b').subarray(0, 3);
+
+  for (let length = 1; length <= framePrefix.length; length++) {
+    const trailing = framePrefix.subarray(0, length);
+    assert.strictEqual(
+      zlib.zstdDecompressSync(Buffer.concat([compressed, trailing])).toString(),
+      'a',
+    );
+    assert.throws(
+      () => zlib.zstdDecompressSync(Buffer.concat([compressed, trailing]), {
+        rejectGarbageAfterEnd: true,
+      }),
+      trailingJunkError,
+    );
+    assert.strictEqual(
+      (await collect(
+        zlib.createZstdDecompress(),
+        compressed,
+        trailing,
+      )).toString(),
+      'a',
+    );
+  }
+});
+
+test('zstd reports errors in subsequent frames', async () => {
+  const first = zlib.zstdCompressSync('a');
+  const second = zlib.zstdCompressSync('b', {
+    params: {
+      [zlib.constants.ZSTD_c_checksumFlag]: 1,
+    },
+  });
+  second[second.length - 1] ^= 1;
+  const input = Buffer.concat([first, second]);
+  const checksumError = { code: 'ZSTD_error_checksum_wrong' };
+
+  assert.throws(() => zlib.zstdDecompressSync(input), checksumError);
+  await assert.rejects(
+    collect(zlib.createZstdDecompress(), first, second),
+    checksumError,
+  );
+});
+
+test('zstd decompresses multiple frames across output buffers', async () => {
+  const firstInput = Buffer.allocUnsafe(1024);
+  const secondInput = Buffer.allocUnsafe(1024);
+  for (let i = 0; i < firstInput.length; i++) {
+    firstInput[i] = i;
+    secondInput[i] = i + 1;
+  }
+  const input = Buffer.concat([
+    zlib.zstdCompressSync(firstInput),
+    zlib.zstdCompressSync(secondInput),
+  ]);
+  const expected = Buffer.concat([firstInput, secondInput]);
+  const options = { chunkSize: 64 };
+
+  assert.deepStrictEqual(zlib.zstdDecompressSync(input, options), expected);
+  assert.deepStrictEqual(
+    await collect(zlib.createZstdDecompress(options), input),
+    expected,
+  );
+});
+
 test('rejectGarbageAfterEnd must be a boolean', () => {
   const compressed = zlib.deflateSync(Buffer.from('a'));
 
diff --git a/test/parallel/test-zlib-zstd-dictionary.js b/test/parallel/test-zlib-zstd-dictionary.js
index 41b2ab90238c..b40107b50c08 100644
--- a/test/parallel/test-zlib-zstd-dictionary.js
+++ b/test/parallel/test-zlib-zstd-dictionary.js
@@ -40,3 +40,24 @@ for (const dict of [arrayBuffer, uint8, dataView]) {
   const decompressed = zlib.zstdDecompressSync(compressed, { dictionary: dict });
   assert.strictEqual(decompressed.toString(), input.toString());
 }
+
+for (const dictionary of [null, 'string', 123, true, {}, [1, 2, 3]]) {
+  const options = { dictionary };
+  const expected = {
+    code: 'ERR_INVALID_ARG_TYPE',
+    name: 'TypeError',
+  };
+
+  assert.throws(() => zlib.createZstdCompress(options), expected);
+  assert.throws(() => zlib.createZstdDecompress(options), expected);
+  assert.throws(() => zlib.zstdCompressSync(input, options), expected);
+  assert.throws(() => zlib.zstdDecompressSync(input, options), expected);
+  assert.throws(
+    () => zlib.zstdCompress(input, options, common.mustNotCall()),
+    expected,
+  );
+  assert.throws(
+    () => zlib.zstdDecompress(input, options, common.mustNotCall()),
+    expected,
+  );
+}
diff --git a/test/parallel/test-zlib-zstd-reset.js b/test/parallel/test-zlib-zstd-reset.js
new file mode 100644
index 000000000000..839669bc630a
--- /dev/null
+++ b/test/parallel/test-zlib-zstd-reset.js
@@ -0,0 +1,68 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const { finished } = require('stream/promises');
+const test = require('node:test');
+const zlib = require('zlib');
+
+const dictionary = Buffer.from(
+  'Lorem ipsum dolor sit amet, consectetur adipiscing elit. ' +
+  'Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.',
+);
+const input = Buffer.from(
+  'Lorem ipsum dolor sit amet, consectetur adipiscing elit. '.repeat(100),
+);
+
+async function collect(stream, ...data) {
+  const chunks = [];
+  stream.on('data', (chunk) => chunks.push(chunk));
+  for (let i = 0; i < data.length - 1; i++) {
+    stream.write(data[i]);
+  }
+  stream.end(data[data.length - 1]);
+  await finished(stream);
+  return Buffer.concat(chunks);
+}
+
+test('ZstdCompress reset preserves its initial options', async () => {
+  const options = {
+    dictionary,
+    pledgedSrcSize: input.length,
+    params: {
+      [zlib.constants.ZSTD_c_compressionLevel]: 19,
+      [zlib.constants.ZSTD_c_checksumFlag]: 1,
+    },
+  };
+  const expected = await collect(zlib.createZstdCompress(options), input);
+  const reset = zlib.createZstdCompress(options);
+  reset.reset();
+
+  assert.deepStrictEqual(await collect(reset, input), expected);
+});
+
+test('ZstdDecompress reset preserves its dictionary', async () => {
+  const compressed = zlib.zstdCompressSync(input, { dictionary });
+  const decompress = zlib.createZstdDecompress({ dictionary });
+  decompress.reset();
+
+  assert.deepStrictEqual(await collect(decompress, compressed), input);
+});
+
+test('ZstdDecompress reset preserves its parameters', async () => {
+  const compressed = await collect(zlib.createZstdCompress({
+    params: {
+      [zlib.constants.ZSTD_c_windowLog]: 11,
+    },
+  }), Buffer.alloc(2048), Buffer.alloc(2048));
+  const decompress = zlib.createZstdDecompress({
+    params: {
+      [zlib.constants.ZSTD_d_windowLogMax]: 10,
+    },
+  });
+  decompress.reset();
+
+  await assert.rejects(collect(decompress, compressed), {
+    code: 'ZSTD_error_frameParameter_windowTooLarge',
+  });
+});
diff --git a/test/pummel/test-crypto-argon2-nonblocking-constructor.js b/test/pummel/test-crypto-argon2-nonblocking-constructor.js
index 37cb5363d43c..4e0ff50c3fa3 100644
--- a/test/pummel/test-crypto-argon2-nonblocking-constructor.js
+++ b/test/pummel/test-crypto-argon2-nonblocking-constructor.js
@@ -4,10 +4,12 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 if (!hasOpenSSL(3, 2))
   common.skip('requires OpenSSL >= 3.2');
+if (hasFIPS(3))
+  common.skip('Argon2 is not available in FIPS mode');
 
 // Regression test for https://github.com/nodejs/node/issues/62861.
 // `AdditionalConfig` used to invoke the full Argon2 KDF synchronously inside
diff --git a/test/pummel/test-crypto-dh-hash.js b/test/pummel/test-crypto-dh-hash.js
index 03b4a9c831ae..e428df491a34 100644
--- a/test/pummel/test-crypto-dh-hash.js
+++ b/test/pummel/test-crypto-dh-hash.js
@@ -30,9 +30,9 @@ if (common.isPi()) {
   common.skip('Too slow for Raspberry Pi devices');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('Too slow when dynamically linked against OpenSSL 1.1.1');
 }
 
diff --git a/test/pummel/test-crypto-dh-keys.js b/test/pummel/test-crypto-dh-keys.js
index 8aa1e30e354f..cbfec26d14a1 100644
--- a/test/pummel/test-crypto-dh-keys.js
+++ b/test/pummel/test-crypto-dh-keys.js
@@ -32,12 +32,22 @@ if (common.isPi()) {
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 for (const name of ['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17']) {
   // modp1 is 768 bits, FIPS requires >= 1024.
   // BoringSSL does not support modp1 or modp2.
-  if ((name === 'modp1' && crypto.getFips()) ||
-      (process.features.openssl_is_boringssl &&
+  if (hasFIPS(3) && ['modp1', 'modp2', 'modp5'].includes(name)) {
+    const parameters = crypto.getDiffieHellman(name);
+    const group = crypto.createDiffieHellman(
+      parameters.getPrime(), parameters.getGenerator());
+    assert.throws(() => group.generateKeys(), {
+      code: 'ERR_CRYPTO_OPERATION_FAILED',
+    });
+    continue;
+  }
+  if ((name === 'modp1' && crypto.getFips() === 1) ||
+      (isBoringSSL &&
        (name === 'modp1' || name === 'modp2'))) {
     common.printSkipMessage(`Skipping unsupported ${name} test case`);
     continue;
diff --git a/test/pummel/test-crypto-pqc-sign-verify-slh-dsa.mjs b/test/pummel/test-crypto-pqc-sign-verify-slh-dsa.mjs
index 772d9bab6f61..52b018e7028d 100644
--- a/test/pummel/test-crypto-pqc-sign-verify-slh-dsa.mjs
+++ b/test/pummel/test-crypto-pqc-sign-verify-slh-dsa.mjs
@@ -13,6 +13,9 @@ import { promisify } from 'node:util';
 import { randomBytes, sign, verify } from 'node:crypto';
 import fixtures from '../common/fixtures.js';
 
+const pSign = promisify(sign);
+const pVerify = promisify(verify);
+
 function getKeyFileName(type, suffix) {
   return `${type.replaceAll('-', '_')}_${suffix}.pem`;
 }
@@ -37,6 +40,8 @@ for (const [asymmetricKeyType, sigLen] of [
   };
 
   const data = randomBytes(32);
+  // Start the async signature before the sync work to overlap the two.
+  const signaturePromise = pSign(undefined, data, keys.private);
 
   // sync
   {
@@ -48,9 +53,7 @@ for (const [asymmetricKeyType, sigLen] of [
 
   // async
   {
-    const pSign = promisify(sign);
-    const pVerify = promisify(verify);
-    const signature = await pSign(undefined, data, keys.private);
+    const signature = await signaturePromise;
     assert.strictEqual(signature.byteLength, sigLen);
     assert.strictEqual(await pVerify(undefined, randomBytes(32), keys.public, signature), false);
     assert.strictEqual(await pVerify(undefined, data, keys.public, signature), true);
diff --git a/test/pummel/test-dh-regr.js b/test/pummel/test-dh-regr.js
index 961bea3246fb..8a2e71745a38 100644
--- a/test/pummel/test-dh-regr.js
+++ b/test/pummel/test-dh-regr.js
@@ -32,17 +32,33 @@ if (common.isPi()) {
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
-// FIPS requires length >= 1024 but we use 512/256 in this test to keep it from
-// taking too long and timing out in CI.
-const length = crypto.getFips() ? 1024 : hasOpenSSL3 ? 512 : 256;
+let iterations = 2000;
+if (hasFIPS(3)) {
+  assert.throws(() => crypto.createDiffieHellman(1024), {
+    code: 'ERR_INVALID_ARG_VALUE',
+    name: 'TypeError',
+  });
 
-const p = crypto.createDiffieHellman(length).getPrime();
+  // Keep a lower iteration count for FIPS jobs.
+  iterations = 100;
+}
+
+let createDH;
+if (hasOpenSSL(3)) {
+  // OpenSSL 3 recognizes named groups without validating their primes.
+  createDH = () => crypto.getDiffieHellman('modp14');
+} else {
+  // Other backends validate each peer's parameters, so keep them small.
+  const length = crypto.getFips() === 1 ? 1024 : 256;
+  const prime = crypto.createDiffieHellman(length).getPrime();
+  createDH = () => crypto.createDiffieHellman(prime);
+}
 
-for (let i = 0; i < 2000; i++) {
-  const a = crypto.createDiffieHellman(p);
-  const b = crypto.createDiffieHellman(p);
+for (let i = 0; i < iterations; i++) {
+  const a = createDH();
+  const b = createDH();
 
   a.generateKeys();
   b.generateKeys();
diff --git a/test/pummel/test-webcrypto-derivebits-pbkdf2.js b/test/pummel/test-webcrypto-derivebits-pbkdf2.js
index bfb01ac0c94f..9e6cdcad8ab0 100644
--- a/test/pummel/test-webcrypto-derivebits-pbkdf2.js
+++ b/test/pummel/test-webcrypto-derivebits-pbkdf2.js
@@ -11,7 +11,9 @@ if (common.isPi()) {
 }
 
 const assert = require('assert');
+const { hasFIPS } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
+const fips4 = hasFIPS(4);
 
 function getDeriveKeyInfo(name, length, hash, ...usages) {
   return [{ name, length, hash }, usages];
@@ -632,6 +634,19 @@ async function testWrongKeyType(
         Object.keys(kDerivations[size][saltSize][hash])
           .forEach((iterations) => {
             const args = [baseKeys, size, saltSize, hash, iterations | 0];
+            if (fips4 &&
+                (size === 'empty' || saltSize !== 'long' || iterations < 1000)) {
+              variations.push(assert.rejects(
+                testDeriveBits(...args), { name: 'OperationError' }));
+              kDerivedKeyTypes.forEach((keyType) => {
+                const keyArgs = getDeriveKeyInfo(...keyType);
+                variations.push(assert.rejects(
+                  testDeriveKey(...args, ...keyArgs),
+                  { name: 'OperationError' }));
+              });
+              return;
+            }
+
             variations.push(testDeriveBits(...args));
             variations.push(testDeriveBitsBadLengths(...args));
             variations.push(testDeriveBitsBadHash(...args));
@@ -674,12 +689,17 @@ async function testWrongKeyType(
 
 // https://github.com/w3c/webcrypto/pull/380
 {
-  crypto.subtle.importKey('raw', new Uint8Array(0), 'PBKDF2', false, ['deriveBits']).then((key) => {
+  crypto.subtle.importKey(
+    'raw',
+    new Uint8Array(fips4 ? 8 : 0),
+    'PBKDF2',
+    false,
+    ['deriveBits']).then((key) => {
     return crypto.subtle.deriveBits({
       name: 'PBKDF2',
       hash: { name: 'SHA-256' },
-      iterations: 10,
-      salt: new Uint8Array(0),
+      iterations: fips4 ? 1000 : 10,
+      salt: new Uint8Array(fips4 ? 16 : 0),
     }, key, 0);
   }).then((bits) => {
     assert.deepStrictEqual(bits, new ArrayBuffer(0));
diff --git a/test/sequential/sequential.status b/test/sequential/sequential.status
index 01a021130c15..6b5714500b23 100644
--- a/test/sequential/sequential.status
+++ b/test/sequential/sequential.status
@@ -13,6 +13,10 @@ test-watch-mode-inspect: PASS, FLAKY
 # https://github.com/nodejs/node/issues/47409
 test-http2-large-file: PASS, FLAKY
 
+[$system==win32]
+# https://github.com/nodejs/node/issues/63212#issuecomment-5423558796
+test-debugger-pid: PASS, FLAKY
+
 [$system==linux]
 # https://github.com/nodejs/node/issues/54817
 test-http-server-request-timeouts-mixed: PASS, FLAKY
diff --git a/test/sequential/test-async-wrap-getasyncid.js b/test/sequential/test-async-wrap-getasyncid.js
index 5db4a7763158..ef48f457a878 100644
--- a/test/sequential/test-async-wrap-getasyncid.js
+++ b/test/sequential/test-async-wrap-getasyncid.js
@@ -139,6 +139,7 @@ function testInitialized(req, ctor_name) {
 
 if (common.hasCrypto) { // eslint-disable-line node-core/crypto-check
   const crypto = require('crypto');
+  const { hasFIPS } = require('../common/crypto');
 
   // The handle for PBKDF2 and RandomBytes isn't returned by the function call,
   // so need to check it from the callback.
@@ -152,7 +153,8 @@ if (common.hasCrypto) { // eslint-disable-line node-core/crypto-check
     testInitialized(this, 'RandomBytesJob');
   }));
 
-  if (typeof internalBinding('crypto').ScryptJob === 'function') {
+  if (typeof internalBinding('crypto').ScryptJob === 'function' &&
+      !hasFIPS(3)) {
     crypto.scrypt('password', 'salt', 8, common.mustCall(function() {
       testInitialized(this, 'ScryptJob');
     }));
diff --git a/test/sequential/test-http2-timeout-large-write-file.js b/test/sequential/test-http2-timeout-large-write-file.js
index c0675ced2c13..fb95ee014662 100644
--- a/test/sequential/test-http2-timeout-large-write-file.js
+++ b/test/sequential/test-http2-timeout-large-write-file.js
@@ -27,7 +27,6 @@ const minReadSize = 500000;
 const serverTimeout = common.platformTimeout(500);
 let offsetTimeout = common.platformTimeout(100);
 let didReceiveData = false;
-
 const content = Buffer.alloc(writeSize, 0x44);
 const filepath = tmpdir.resolve('http2-large-write.tmp');
 fs.writeFileSync(filepath, content, 'binary');
@@ -52,8 +51,10 @@ server.on('timeout', common.mustCallAtLeast(() => {
 }, 0));
 
 server.listen(0, common.mustCall(() => {
-  const client = http2.connect(`https://localhost:${server.address().port}`,
-                               { rejectUnauthorized: false });
+  const client = http2.connect(`https://localhost:${server.address().port}`, {
+    rejectUnauthorized: false,
+    settings: { initialWindowSize: 65535 },
+  });
 
   const req = client.request({ ':path': '/' });
   req.end();
diff --git a/test/sequential/test-http2-timeout-large-write.js b/test/sequential/test-http2-timeout-large-write.js
index ea5fd1973b71..b924c175d6ea 100644
--- a/test/sequential/test-http2-timeout-large-write.js
+++ b/test/sequential/test-http2-timeout-large-write.js
@@ -23,7 +23,6 @@ const minReadSize = 500000;
 const serverTimeout = common.platformTimeout(500);
 let offsetTimeout = common.platformTimeout(100);
 let didReceiveData = false;
-
 const server = http2.createSecureServer({
   key: fixtures.readKey('agent1-key.pem'),
   cert: fixtures.readKey('agent1-cert.pem'),
@@ -49,8 +48,10 @@ server.setTimeout(serverTimeout);
 server.on('timeout', onTimeout);
 
 server.listen(0, common.mustCall(() => {
-  const client = http2.connect(`https://localhost:${server.address().port}`,
-                               { rejectUnauthorized: false });
+  const client = http2.connect(`https://localhost:${server.address().port}`, {
+    rejectUnauthorized: false,
+    settings: { initialWindowSize: 65535 },
+  });
 
   const req = client.request({ ':path': '/' });
   req.end();
diff --git a/test/sequential/test-https-connect-localport.js b/test/sequential/test-https-connect-localport.js
index 10d358c8a921..041becdc6440 100644
--- a/test/sequential/test-https-connect-localport.js
+++ b/test/sequential/test-https-connect-localport.js
@@ -26,7 +26,9 @@ const assert = require('assert');
       family: 4,
       localPort: common.PORT,
       rejectUnauthorized: false,
-    }, common.mustCall(() => {
+      agent: false,
+    }, common.mustCall((res) => {
+      res.resume();
       assert.strictEqual(req.socket.localPort, common.PORT);
       assert.strictEqual(req.socket.remotePort, port);
     }));
diff --git a/test/sequential/test-net-connect-econnrefused.js b/test/sequential/test-net-connect-econnrefused.js
index 67f5820221c5..c51e99e59b85 100644
--- a/test/sequential/test-net-connect-econnrefused.js
+++ b/test/sequential/test-net-connect-econnrefused.js
@@ -32,7 +32,7 @@ let rounds = 1;
 let reqs = 0;
 
 let port;
-const server = net.createServer().listen(0, common.mustCall(() => {
+const server = net.createServer().listen(0, common.localhostIPv4, common.mustCall(() => {
   port = server.address().port;
   server.close(common.mustCall(pummel));
 }));
@@ -40,17 +40,14 @@ const server = net.createServer().listen(0, common.mustCall(() => {
 function pummel() {
   let pending;
   for (pending = 0; pending < ATTEMPTS_PER_ROUND; pending++) {
-    net.createConnection({ port, autoSelectFamily: false }).on('error', common.mustCallAtLeast((error) => {
-      // Family autoselection might be skipped if only a single address is returned by DNS.
-      const actualError = Array.isArray(error.errors) ? error.errors[0] : error;
-
+    net.createConnection({ host: common.localhostIPv4, port }).on('error', common.mustCall((error) => {
       console.log('pending', pending, 'rounds', rounds);
-      assert.strictEqual(actualError.code, 'ECONNREFUSED');
+      assert.strictEqual(error.code, 'ECONNREFUSED');
       if (--pending > 0) return;
       if (rounds === ROUNDS) return check();
       rounds++;
       pummel();
-    }, 0));
+    }));
     reqs++;
   }
 }
diff --git a/test/sequential/test-perf-hooks-histogram-heapdump.js b/test/sequential/test-perf-hooks-histogram-heapdump.js
new file mode 100644
index 000000000000..cf310eb973b1
--- /dev/null
+++ b/test/sequential/test-perf-hooks-histogram-heapdump.js
@@ -0,0 +1,54 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const {
+  createJSHeapSnapshot,
+  validateByRetainingPathFromNodes,
+} = require('../common/heap');
+const {
+  createHistogram,
+  createSlidingWindowHistogram,
+} = require('perf_hooks');
+
+(async () => {
+  const uncached = createHistogram();
+  const cached = createHistogram();
+  cached.record(1);
+  cached.record(1000);
+  await cached.qrde({ cache: true });
+
+  const sliding = createSlidingWindowHistogram({
+    chunks: 2,
+    recordsPerChunk: 1,
+  });
+
+  const nodes = createJSHeapSnapshot();
+  const snapshots = validateByRetainingPathFromNodes(
+    nodes,
+    'Node / Histogram',
+    [{ node_name: 'Node / qrde_snapshot', edge_name: 'qrde_snapshot' }],
+  );
+  assert.strictEqual(snapshots.length, 1);
+  assert.ok(snapshots[0].self_size > 0);
+
+  const windows = validateByRetainingPathFromNodes(
+    nodes,
+    'Node / SlidingWindowHistogram',
+    [],
+  );
+  for (const [edgeName, nodeName] of [
+    ['chunks', 'Node / chunks'],
+    ['generations', 'Node / generations'],
+    ['spare', 'Node / Histogram'],
+  ]) {
+    validateByRetainingPathFromNodes(windows, 'Node / SlidingWindowHistogram', [
+      { node_name: nodeName, edge_name: edgeName },
+    ]);
+  }
+
+  // Keep all three wrappers live through snapshot generation.
+  assert.strictEqual(uncached.count, 0);
+  assert.strictEqual(cached.count, 2);
+  assert.strictEqual(sliding.snapshot().count, 0);
+})().then(common.mustCall());
diff --git a/test/sequential/test-pipe.js b/test/sequential/test-pipe.js
index 7515e4c705b0..39b11e17d51a 100644
--- a/test/sequential/test-pipe.js
+++ b/test/sequential/test-pipe.js
@@ -93,7 +93,10 @@ function startClient() {
     port: common.PORT,
     method: 'GET',
     path: '/',
-    headers: { 'content-length': buffer.length },
+    headers: {
+      'connection': 'close',
+      'content-length': buffer.length,
+    },
   }, common.mustCall((res) => {
     res.setEncoding('utf8');
     res.on('data', common.mustCall((string) => {
diff --git a/test/sequential/test-tls-psk-client.js b/test/sequential/test-tls-psk-client.js
index 2eb6228f79f2..5cb429f47dec 100644
--- a/test/sequential/test-tls-psk-client.js
+++ b/test/sequential/test-tls-psk-client.js
@@ -5,7 +5,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
diff --git a/test/sequential/test-watch-mode-restart-esm-loading-error.mjs b/test/sequential/test-watch-mode-restart-esm-loading-error.mjs
index 1d1b954588c5..73299a73bfc4 100644
--- a/test/sequential/test-watch-mode-restart-esm-loading-error.mjs
+++ b/test/sequential/test-watch-mode-restart-esm-loading-error.mjs
@@ -74,7 +74,7 @@ function runInBackground({ args = [], options = {}, completed = 'Completed runni
       future.resolve();
       return { stdout, stderr };
     },
-    restart(timeout = 1000) {
+    restart(timeout = common.platformTimeout(10_000)) {
       if (!child) {
         run();
       }
@@ -113,7 +113,7 @@ try {
 
   // Update file with syntax error
   const syntaxErrorContent = `console.log('hello, wor`;
-  const failedRestart = restart(common.platformTimeout(10_000));
+  const failedRestart = restart();
   writeFileSync(file, syntaxErrorContent);
   await sleep(common.platformTimeout(1000));
   // Wait for the failed restart
@@ -125,7 +125,7 @@ try {
     `Failed running ${inspect(file)}. Waiting for file changes before restarting...`,
   ]);
 
-  const successfulRestart = restart(common.platformTimeout(10_000));
+  const successfulRestart = restart();
   writeFileSync(file, `console.log('hello again, world');`);
   await sleep(common.platformTimeout(1000));
   const { stderr: stderr3, stdout: stdout3 } = await successfulRestart;
diff --git a/test/test-runner/test-output-junit-quote.mjs b/test/test-runner/test-output-junit-quote.mjs
new file mode 100644
index 000000000000..6d1769eea83f
--- /dev/null
+++ b/test/test-runner/test-output-junit-quote.mjs
@@ -0,0 +1,11 @@
+// Test that the output of test-runner/output/junit_quote.js matches
+// test-runner/output/junit_quote.snapshot
+import '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
+import { spawnAndAssert, junitTransform, ensureCwdIsProjectRoot } from '../common/assertSnapshot.js';
+
+ensureCwdIsProjectRoot();
+await spawnAndAssert(
+  fixtures.path('test-runner/output/junit_quote.js'),
+  junitTransform,
+);
diff --git a/test/test-runner/test-run-watch-cwd-isolation-none-argv.mjs b/test/test-runner/test-run-watch-cwd-isolation-none-argv.mjs
index 1066f8fc5d6c..a08677300b86 100644
--- a/test/test-runner/test-run-watch-cwd-isolation-none-argv.mjs
+++ b/test/test-runner/test-run-watch-cwd-isolation-none-argv.mjs
@@ -2,7 +2,8 @@
 // parent process argv when spawning the watch child.
 import * as common from '../common/index.mjs';
 import assert from 'node:assert';
-import { writeFileSync } from 'node:fs';
+import { setTimeout } from 'node:timers/promises';
+import { writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { run } from 'node:test';
 import tmpdir from '../common/tmpdir.js';
@@ -11,12 +12,15 @@ import { skipIfNoWatch } from '../common/watch.js';
 skipIfNoWatch();
 tmpdir.refresh();
 
-writeFileSync(join(tmpdir.path, 'test.js'), `
+await writeFile(join(tmpdir.path, 'test.js'), `
 const test = require('node:test');
 
 test('test ran from cwd', () => {});
 `);
 
+// Add some delay to ensure the OS sends the FS events before watch mode is started.
+await setTimeout(common.platformTimeout(100));
+
 const passed = [];
 const controller = new AbortController();
 const stream = run({
@@ -24,18 +28,20 @@ const stream = run({
   watch: true,
   signal: controller.signal,
   isolation: 'none',
-}).on('data', function({ type }) {
-  if (type === 'test:watch:drained') {
-    stream.removeAllListeners('test:fail');
-    stream.removeAllListeners('test:pass');
-    controller.abort();
-  }
+}).on('data', ({ type }) => {
+  if (type !== 'test:watch:drained') return;
+
+  stream.removeAllListeners('test:fail');
+  stream.removeAllListeners('test:pass');
+  controller.abort();
 });
 
-stream.on('test:fail', common.mustNotCall());
-stream.on('test:pass', common.mustCall((data) => passed.push(data.name), 1));
-// eslint-disable-next-line no-unused-vars
-for await (const _ of stream);
+stream.on('test:watch:restarted', common.mustNotCall('test:watch:restarted'));
+stream.on('test:fail', common.mustNotCall('test:fail'));
+stream.on('test:pass', common.mustCall((data) => passed.push(data.name)));
+
+// eslint-disable-next-line no-empty-pattern
+for await (const {} of stream);
 
 // Validate the expected test ran by name:
 assert.deepStrictEqual(passed, ['test ran from cwd']);
diff --git a/test/test-runner/test-run-watch-cwd-isolation-none.mjs b/test/test-runner/test-run-watch-cwd-isolation-none.mjs
index ce65bfb5e416..bbb1a141a4b4 100644
--- a/test/test-runner/test-run-watch-cwd-isolation-none.mjs
+++ b/test/test-runner/test-run-watch-cwd-isolation-none.mjs
@@ -1,27 +1,28 @@
 // Test run({ watch: true, cwd, isolation: 'none' }) runs with different cwd while in watch mode and isolation none
 import * as common from '../common/index.mjs';
+import * as fixtures from '../common/fixtures.mjs';
 import { run } from 'node:test';
-import tmpdir from '../common/tmpdir.js';
-import { refreshForTestRunnerWatch, skipIfNoWatch } from '../common/watch.js';
+import { skipIfNoWatch } from '../common/watch.js';
 
 skipIfNoWatch();
-refreshForTestRunnerWatch();
 
 const controller = new AbortController();
 const stream = run({
-  cwd: tmpdir.path,
+  cwd: fixtures.path('test-runner-watch'),
   watch: true,
   signal: controller.signal,
   isolation: 'none',
-}).on('data', function({ type }) {
-  if (type === 'test:watch:drained') {
-    stream.removeAllListeners('test:fail');
-    stream.removeAllListeners('test:pass');
-    controller.abort();
-  }
+}).on('data', ({ type }) => {
+  if (type !== 'test:watch:drained') return;
+
+  stream.removeAllListeners('test:fail');
+  stream.removeAllListeners('test:pass');
+  controller.abort();
 });
 
-stream.on('test:fail', common.mustNotCall());
-stream.on('test:pass', common.mustCall(1));
-// eslint-disable-next-line no-unused-vars
-for await (const _ of stream);
+stream.on('test:watch:restarted', common.mustNotCall('test:watch:restarted'));
+stream.on('test:fail', common.mustNotCall('test:fail'));
+stream.on('test:pass', common.mustCall());
+
+// eslint-disable-next-line no-empty-pattern
+for await (const {} of stream);
diff --git a/test/test-runner/test-run-watch-emit-restarted.mjs b/test/test-runner/test-run-watch-emit-restarted.mjs
index 200231c69043..fd596bd818ca 100644
--- a/test/test-runner/test-run-watch-emit-restarted.mjs
+++ b/test/test-runner/test-run-watch-emit-restarted.mjs
@@ -1,5 +1,5 @@
 // Test run({ watch: true }) emits test:watch:restarted when file is updated
-import * as common from '../common/index.mjs';
+import '../common/index.mjs';
 import { run } from 'node:test';
 import assert from 'node:assert';
 import { writeFileSync } from 'node:fs';
@@ -11,9 +11,8 @@ import { refreshForTestRunnerWatch, skipIfNoWatch, fixtureContent } from '../com
 skipIfNoWatch();
 refreshForTestRunnerWatch();
 
-let alreadyDrained = false;
 const events = [];
-const testWatchRestarted = common.mustCall(1);
+let written = false;
 
 const controller = new AbortController();
 const stream = run({
@@ -21,27 +20,24 @@ const stream = run({
   watch: true,
   signal: controller.signal,
 }).on('data', function({ type }) {
-  events.push(type);
-  if (type === 'test:watch:restarted') {
-    testWatchRestarted();
+  if (type !== 'test:watch:restarted' && type !== 'test:watch:drained') {
+    return;
   }
-  if (type === 'test:watch:drained') {
-    if (alreadyDrained) {
-      controller.abort();
-    }
-    alreadyDrained = true;
+  events.push(type);
+  // Watchers with latency (FSEvents) can still report the fixture setup after
+  // the first run has started, so only a restart after the write below counts.
+  if (written && type === 'test:watch:drained' && events.at(-2) === 'test:watch:restarted') {
+    controller.abort();
   }
 });
 
 await once(stream, 'test:watch:drained');
 
+events.length = 0;
+written = true;
 writeFileSync(join(tmpdir.path, 'test.js'), fixtureContent['test.js']);
 
 // eslint-disable-next-line no-unused-vars
 for await (const _ of stream);
 
-assert.partialDeepStrictEqual(events, [
-  'test:watch:drained',
-  'test:watch:restarted',
-  'test:watch:drained',
-]);
+assert.deepStrictEqual(events.slice(-2), ['test:watch:restarted', 'test:watch:drained']);
diff --git a/test/test-runner/test-runner.status b/test/test-runner/test-runner.status
index e8b4ff2d3224..7ad99e20a87e 100644
--- a/test/test-runner/test-runner.status
+++ b/test/test-runner/test-runner.status
@@ -6,6 +6,7 @@ prefix test-runner
 
 [true] # This section applies to all platforms
 
-# https://github.com/nodejs/node/pull/54888#issuecomment-2351128116
-# TODO(pmarchini): This test is failing when isolation is set to none and must be fixed.
-test-watch-create-isolation-none: SKIP
+[$system==win32]
+# https://github.com/nodejs/node/issues/66056
+test-run-watch-cwd-isolation-none: PASS, FLAKY
+test-run-watch-cwd-isolation-none-argv: PASS, FLAKY
diff --git a/test/wasi/c/poll.c b/test/wasi/c/poll.c
index ba12f442654b..f65cf2c7056f 100644
--- a/test/wasi/c/poll.c
+++ b/test/wasi/c/poll.c
@@ -1,13 +1,24 @@
 #include <assert.h>
 #include <poll.h>
+#include <stdint.h>
 #include <time.h>
 #include <unistd.h>
 #include <stdlib.h>
 #include <string.h>
 
+#define NANOS_PER_SECOND 1000000000LL
+// Timer granularity can make a timeout expire slightly early.
+#define TIMEOUT_TOLERANCE_NS 100000000LL
+
+static int64_t elapsed_nanoseconds(const struct timespec* before,
+                                   const struct timespec* after) {
+  return (after->tv_sec - before->tv_sec) * NANOS_PER_SECOND +
+         after->tv_nsec - before->tv_nsec;
+}
+
 int main(void) {
   struct pollfd fds[4];
-  time_t before, now;
+  struct timespec before, now;
   int ret;
   char* platform;
   int is_aix_or_os400;
@@ -18,18 +29,20 @@ int main(void) {
   is_win = platform != NULL && 0 == strcmp(platform, "win32");
 
   // Test sleep() behavior.
-  time(&before);
+  assert(clock_gettime(CLOCK_MONOTONIC, &before) == 0);
   sleep(1);
-  time(&now);
-  assert(now - before >= 1);
+  assert(clock_gettime(CLOCK_MONOTONIC, &now) == 0);
+  assert(elapsed_nanoseconds(&before, &now) >=
+         NANOS_PER_SECOND - TIMEOUT_TOLERANCE_NS);
 
   // Test poll() timeout behavior.
   fds[0] = (struct pollfd){.fd = -1, .events = 0, .revents = 0};
-  time(&before);
+  assert(clock_gettime(CLOCK_MONOTONIC, &before) == 0);
   ret = poll(fds, 1, 2000);
-  time(&now);
+  assert(clock_gettime(CLOCK_MONOTONIC, &now) == 0);
   assert(ret == 0);
-  assert(now - before >= 2);
+  assert(elapsed_nanoseconds(&before, &now) >=
+         2 * NANOS_PER_SECOND - TIMEOUT_TOLERANCE_NS);
 
   // V8 has a bug that allows unsupported parts of this test to run,
   // causing the test to fail. poll_win.c is a workaround.
diff --git a/test/wasi/c/poll_win.c b/test/wasi/c/poll_win.c
index 9a22082f0eeb..e8e41ffd6a7e 100644
--- a/test/wasi/c/poll_win.c
+++ b/test/wasi/c/poll_win.c
@@ -1,26 +1,39 @@
 #include <assert.h>
 #include <poll.h>
+#include <stdint.h>
 #include <time.h>
 #include <unistd.h>
 
+#define NANOS_PER_SECOND 1000000000LL
+// Timer granularity can make a timeout expire slightly early.
+#define TIMEOUT_TOLERANCE_NS 100000000LL
+
+static int64_t elapsed_nanoseconds(const struct timespec* before,
+                                   const struct timespec* after) {
+  return (after->tv_sec - before->tv_sec) * NANOS_PER_SECOND +
+         after->tv_nsec - before->tv_nsec;
+}
+
 int main(void) {
   struct pollfd fds[4];
-  time_t before, now;
+  struct timespec before, now;
   int ret;
 
   // Test sleep() behavior.
-  time(&before);
+  assert(clock_gettime(CLOCK_MONOTONIC, &before) == 0);
   sleep(1);
-  time(&now);
-  assert(now - before >= 1);
+  assert(clock_gettime(CLOCK_MONOTONIC, &now) == 0);
+  assert(elapsed_nanoseconds(&before, &now) >=
+         NANOS_PER_SECOND - TIMEOUT_TOLERANCE_NS);
 
   // Test poll() timeout behavior.
   fds[0] = (struct pollfd){.fd = -1, .events = 0, .revents = 0};
-  time(&before);
+  assert(clock_gettime(CLOCK_MONOTONIC, &before) == 0);
   ret = poll(fds, 1, 2000);
-  time(&now);
+  assert(clock_gettime(CLOCK_MONOTONIC, &now) == 0);
   assert(ret == 0);
-  assert(now - before >= 2);
+  assert(elapsed_nanoseconds(&before, &now) >=
+         2 * NANOS_PER_SECOND - TIMEOUT_TOLERANCE_NS);
 
   return 0;
 }
diff --git a/test/wasi/wasi.status b/test/wasi/wasi.status
index d88bd60ae4dc..a26617e01367 100644
--- a/test/wasi/wasi.status
+++ b/test/wasi/wasi.status
@@ -15,6 +15,3 @@ test-wasi-getrusage: SKIP
 # Unsupported on Windows and Android
 test-wasi-readdir: SKIP
 
-[$system==linux]
-# https://github.com/nodejs/node/issues/59146
-test-wasi-pthread: PASS, FLAKY
diff --git a/test/wasi/wasm/poll.wasm b/test/wasi/wasm/poll.wasm
index 07e09ddd39ab..d1863d1351bf 100755
Binary files a/test/wasi/wasm/poll.wasm and b/test/wasi/wasm/poll.wasm differ
diff --git a/test/wasi/wasm/poll_win.wasm b/test/wasi/wasm/poll_win.wasm
index f1f06db75469..f26d0c8a0a6e 100644
Binary files a/test/wasi/wasm/poll_win.wasm and b/test/wasi/wasm/poll_win.wasm differ
diff --git a/test/wpt/README.md b/test/wpt/README.md
index aba1b8617f90..51375fb99c84 100644
--- a/test/wpt/README.md
+++ b/test/wpt/README.md
@@ -12,6 +12,36 @@ declares build requirements, expected failures, and tests to skip.
 See [`test/fixtures/wpt/README.md`][] for the pinned WPT commit
 hashes for each module.
 
+## Running tests
+
+Run a WPT module through the Python test runner:
+
+```bash
+tools/test.py wpt/test-url
+```
+
+Pass a source file to its module runner to run all globals and variants
+generated from that file:
+
+```bash
+node test/wpt/test-url.js url-searchparams.any.js
+```
+
+Pass a generated path, as printed in the test output, to run only that test:
+
+```bash
+node test/wpt/test-url.js 'url/url-searchparams.any.html'
+```
+
+### Execution backends
+
+By default, each test runs in a worker thread. Set `WPT_BACKEND=process` to run
+tests in child processes instead:
+
+```bash
+WPT_BACKEND=process tools/test.py wpt
+```
+
 <a id="add-tests"></a>
 
 ## How to add tests for a new module
@@ -53,8 +83,8 @@ runner.runJsTests();
 ```
 
 The runner loads the tests from `test/fixtures/wpt/url`, applies the
-status rules from `test/wpt/status/url.cjs`, and runs them using
-worker threads.
+status rules from `test/wpt/status/url.cjs`, and runs them using the
+selected backend.
 
 #### `new WPTRunner(path[, options])`
 
@@ -64,15 +94,17 @@ worker threads.
   * `concurrency` {number} Number of tests to run in parallel.
     Defaults to `os.availableParallelism() - 1`. Set to `1` for tests
     that require sequential execution (e.g. web-locks, webstorage).
+  * `backend` {string} Test execution backend. Must be either `'thread'` or
+    `'process'`. Defaults to `'thread'`. `WPT_BACKEND` overrides this option.
 
 #### `runner.setFlags(flags)`
 
-* `flags` {string\[]} Node.js CLI flags passed to each worker thread
+* `flags` {string\[]} Node.js CLI flags passed to each test process or worker
   (e.g. `['--expose-internals']`).
 
 #### `runner.setInitScript(script)`
 
-* `script` {string} JavaScript code executed in the worker before
+* `script` {string} JavaScript code executed before
   the tests run. Useful for setting up globals needed by the tests.
 
 #### `runner.setScriptModifier(modifier)`
@@ -94,19 +126,7 @@ Starts running the tests. Must be called last, after all configuration.
 
 ### 4. Run the tests
 
-Run the test using `tools/test.py` and see if there are any failures.
-For example, to run all the URL tests under `test/fixtures/wpt/url`:
-
-```bash
-tools/test.py wpt/test-url
-```
-
-To run a specific test in WPT, for example, `url/url-searchparams.any.js`,
-pass the file name as argument to the corresponding test runner:
-
-```bash
-node test/wpt/test-url.js url-searchparams.any.js
-```
+Run the module as described in [Running tests](#running-tests).
 
 If there are any failures, update the corresponding status file
 (in this case, `test/wpt/status/url.cjs`) to make the test pass.
diff --git a/test/wpt/status/WebCryptoAPI.cjs b/test/wpt/status/WebCryptoAPI.cjs
index 2a32b330f7d8..d0459aea5247 100644
--- a/test/wpt/status/WebCryptoAPI.cjs
+++ b/test/wpt/status/WebCryptoAPI.cjs
@@ -1,14 +1,21 @@
 'use strict';
 
-const { hasOpenSSL } = require('../../common/crypto.js');
+const {
+  hasOpenSSL,
+  hasFIPS,
+  isBoringSSL,
+} = require('../../common/crypto.js');
 
 const conditionalFileSkips = {};
 const conditionalSubtestSkips = {};
 
 function skip(...files) {
   for (const file of files) {
+    const provider = isBoringSSL ?
+      'BoringSSL' :
+      `OpenSSL ${process.versions.openssl}${hasFIPS(3) ? ' FIPS mode' : ''}`;
     conditionalFileSkips[file] = {
-      'skip': 'Unsupported in ' + (process.features.openssl_is_boringssl ? 'BoringSSL' : `OpenSSL ${process.versions.openssl}`),
+      'skip': `Unsupported in ${provider}`,
     };
   }
 }
@@ -37,13 +44,13 @@ if (!hasOpenSSL(3, 0)) {
     'sign_verify/kmac.tentative.https.any.js');
 }
 
-if (!hasOpenSSL(3, 2)) {
+if (!hasOpenSSL(3, 2) || hasFIPS(3)) {
   skip(
     'derive_bits_keys/argon2.tentative.https.any.js',
     'import_export/Argon2_importKey.tentative.https.any.js');
 }
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3, 5) && !isBoringSSL) {
   skip(
     'encap_decap/encap_decap_bits.tentative.https.any.js',
     'encap_decap/encap_decap_keys.tentative.https.any.js',
@@ -59,10 +66,13 @@ if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
 
   skipSubtests(
     ['getPublicKey.tentative.https.any.js', /ml-(?:kem|dsa)/i],
-    ['supports-modern.tentative.https.any.js', /ml-(?:kem|dsa)/i]);
+    [
+      'supports-modern.tentative.https.any.js',
+      /(?:ml-(?:kem|dsa)|(?:en|de)capsulateKey)/i,
+    ]);
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   skip(
     'derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js',
     'derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js',
@@ -91,8 +101,90 @@ if (process.features.openssl_is_boringssl) {
     ['supports-modern.tentative.https.any.js', /ml-kem-512/i]);
 }
 
-skipSubtests(
-  ['digest/kangarootwelve.tentative.https.any.js', /C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2}) bytes/]);
+if (hasFIPS(3)) {
+  skip(
+    'encrypt_decrypt/aes_ocb.tentative.https.any.js',
+    'encrypt_decrypt/chacha20_poly1305.tentative.https.any.js',
+    'generateKey/failures_chacha20_poly1305.tentative.https.any.js',
+    'generateKey/successes_chacha20_poly1305.tentative.https.any.js',
+    'import_export/ChaCha20-Poly1305_importKey.tentative.https.any.js',
+    'serialization/chacha20-poly1305.tentative.https.any.js');
+
+  skipSubtests(
+    [
+      'supports-modern.tentative.https.any.js',
+      /(?:ChaCha20-Poly1305|^supports returns (?:true|false) for algorithm objects with (?:valid|invalid) parameters$)/,
+    ],
+    [
+      'wrapKey_unwrapKey/wrapKey_unwrapKey.https.any.js',
+      /(?=.*(?:RSASSA-PKCS1-v1_5|RSA-PSS|RSA-OAEP) private key)(?=.*non-extractable)/,
+    ]);
+}
+
+if (hasFIPS()) {
+  skip(
+    'digest/kangarootwelve.tentative.https.any.js',
+    'digest/turboshake.tentative.https.any.js');
+}
+
+// OpenSSL 3.0 through 3.3 reject SHA-1 signature generation in FIPS mode.
+// OpenSSL 3.4 permits it for legacy use cases while marking the operation as
+// non-approved through a per-operation FIPS indicator. Node does not expose
+// that indicator, so the round-trip tests succeed.
+if (hasFIPS(3) && !hasOpenSSL(3, 4)) {
+  skipSubtests(
+    ['sign_verify/ecdsa.https.any.js', /with SHA-1.*round trip$/],
+    ['sign_verify/rsa_pkcs.https.any.js', /with SHA-1.*round trip$/],
+    ['sign_verify/rsa_pss.https.any.js', /with SHA-1.*round trip$/]);
+}
+
+if (hasFIPS(3, 5)) {
+  skip(
+    'derive_bits_keys/cfrg_curves_bits_curve25519.https.any.js',
+    'derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js',
+    'derive_bits_keys/cfrg_curves_keys_curve25519.https.any.js',
+    'derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js',
+    'generateKey/successes_X25519.https.any.js',
+    'generateKey/successes_X448.tentative.https.any.js',
+    'import_export/okp_importKey_X25519.https.any.js',
+    'import_export/okp_importKey_X448.tentative.https.any.js',
+    'import_export/okp_importKey_failures_X25519.https.any.js',
+    'import_export/okp_importKey_failures_X448.tentative.https.any.js',
+    'serialization/x25519.https.any.js',
+    'serialization/x448.tentative.https.any.js');
+
+  skipSubtests(
+    [
+      'derive_bits_keys/derived_bits_length.https.any.js',
+      /^X25519 derivation/,
+    ],
+    ['getPublicKey.tentative.https.any.js', /(?:X25519|X448)/],
+    [
+      'import_export/raw_format_aliases.tentative.https.any.js',
+      /(?:X25519|X448)/,
+    ],
+    [
+      'supports.tentative.https.any.js',
+      /(?:X25519|^deriveKey promise tests$|^supports validates the ECDH public key$)/,
+    ],
+    [
+      'wrapKey_unwrapKey/wrapKey_unwrapKey.https.any.js',
+      /(?=.*(?:X25519|X448))(?=.*(?:jwk|as non-extractable using pkcs8))/,
+    ]);
+}
+
+if (hasFIPS(4)) {
+  skipSubtests(
+    [
+      'derive_bits_keys/pbkdf2.https.any.js',
+      /(?:empty password|(?:short|empty) salt|with 1 iterations)/,
+    ]);
+}
+
+if (!hasFIPS()) {
+  skipSubtests(
+    ['digest/kangarootwelve.tentative.https.any.js', /C=(?:\d{4,}|5(?:1[3-9]|[2-9]\d)|[6-9]\d{2}) bytes/]);
+}
 
 function assertNoOverlap(fileSkips, subtestSkips) {
   const subtestSkipFiles = new Set(Object.keys(subtestSkips));
diff --git a/test/wpt/status/resource-timing.json b/test/wpt/status/resource-timing.json
index 74de815387ed..0299d6652047 100644
--- a/test/wpt/status/resource-timing.json
+++ b/test/wpt/status/resource-timing.json
@@ -23,25 +23,15 @@
   "idlharness.any.js": {
     "fail": {
       "expected": [
-        "PerformanceResourceTiming interface: attribute firstInterimResponseStart",
-        "PerformanceResourceTiming interface: attribute finalResponseHeadersStart",
-        "PerformanceResourceTiming interface: resource must inherit property \"finalResponseHeadersStart\" with the proper type",
-        "PerformanceResourceTiming interface: attribute renderBlockingStatus",
-        "PerformanceResourceTiming interface: attribute contentType",
-        "PerformanceResourceTiming interface: resource must inherit property \"firstInterimResponseStart\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"renderBlockingStatus\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"contentType\" with the proper type",
         "PerformanceResourceTiming interface: default toJSON operation on resource",
         "PerformanceResourceTiming interface: attribute workerRouterEvaluationStart",
         "PerformanceResourceTiming interface: attribute workerCacheLookupStart",
         "PerformanceResourceTiming interface: attribute workerMatchedRouterSource",
         "PerformanceResourceTiming interface: attribute workerFinalRouterSource",
-        "PerformanceResourceTiming interface: attribute contentEncoding",
         "PerformanceResourceTiming interface: resource must inherit property \"workerRouterEvaluationStart\" with the proper type",
         "PerformanceResourceTiming interface: resource must inherit property \"workerCacheLookupStart\" with the proper type",
         "PerformanceResourceTiming interface: resource must inherit property \"workerMatchedRouterSource\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"workerFinalRouterSource\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"contentEncoding\" with the proper type"
+        "PerformanceResourceTiming interface: resource must inherit property \"workerFinalRouterSource\" with the proper type"
       ]
     }
   }
diff --git a/test/wpt/status/streams.json b/test/wpt/status/streams.json
index 968b33597651..5be444999b00 100644
--- a/test/wpt/status/streams.json
+++ b/test/wpt/status/streams.json
@@ -8,7 +8,14 @@
   "readable-streams/cross-realm-crash.window.js": {
     "skip": "Browser-specific test"
   },
-  "readable-streams/owning-type-message-port.any.js": {
+  "readable-streams/from.any.js": {
+    "fail": {
+      "expected": [
+        "ReadableStream.from throws on invalid iterables; specifically a string"
+      ]
+    }
+  },
+  "readable-streams/owning-type-message-port.tentative.any.js": {
     "fail": {
       "note": "Readable streams with type owning are not yet supported",
       "expected": [
@@ -17,10 +24,10 @@
       ]
     }
   },
-  "readable-streams/owning-type-video-frame.any.js": {
+  "readable-streams/owning-type-video-frame.tentative.any.js": {
     "skip": "Browser-specific test"
   },
-  "readable-streams/owning-type.any.js": {
+  "readable-streams/owning-type.tentative.any.js": {
     "fail": {
       "note": "Readable streams with type owning are not yet supported",
       "expected": [
diff --git a/test/wpt/test-user-timing.js b/test/wpt/test-user-timing.js
index 151c06a86d01..57db5837bbe0 100644
--- a/test/wpt/test-user-timing.js
+++ b/test/wpt/test-user-timing.js
@@ -1,9 +1,31 @@
 'use strict';
 
+const assert = require('assert');
+const { basename } = require('path');
 const { WPTRunner } = require('../common/wpt');
 
 const runner = new WPTRunner('user-timing');
 
 runner.pretendGlobalThisAs('Window');
 
+runner.setScriptModifier((script) => {
+  if (basename(script.filename) !== 'mark.any.js') return;
+
+  // A scheduling pause between mark() and now() can exceed any fixed
+  // tolerance. Check that the mark falls between the surrounding clock
+  // readings instead, leaving the upstream fixture unchanged.
+  // https://github.com/nodejs/node/issues/40449
+  function replace(from, to) {
+    assert(script.code.includes(from), `Unexpected contents of ${script.filename}`);
+    script.code = script.code.replaceAll(from, to);
+  }
+
+  replace('var expectedTimes = new Array();',
+          'var beforeTimes = [];\nvar expectedTimes = new Array();');
+  replace('self.performance.mark("mark");',
+          'beforeTimes.push(self.performance.now());\n    self.performance.mark("mark");');
+  replace('assert_approx_equals(entries[index].startTime, expectedTimes[index], testThreshold);',
+          'assert_between_inclusive(entries[index].startTime, beforeTimes[index], expectedTimes[index]);');
+});
+
 runner.runJsTests();
diff --git a/test/wpt/wpt.status b/test/wpt/wpt.status
index d20d108ac990..de3b3024627a 100644
--- a/test/wpt/wpt.status
+++ b/test/wpt/wpt.status
@@ -5,8 +5,6 @@ prefix wpt
 # sample-test                        : PASS,FLAKY
 
 [true] # This section applies to all platforms
-# https://github.com/nodejs/node/issues/40449
-test-user-timing: PASS,FLAKY
 
 [$system==win32]
 
diff --git a/tools/actions/commit-queue.sh b/tools/actions/commit-queue.sh
index 9fb74ed9cad8..0c3c70da89f0 100755
--- a/tools/actions/commit-queue.sh
+++ b/tools/actions/commit-queue.sh
@@ -7,6 +7,7 @@ DEFAULT_BRANCH=main
 
 COMMIT_QUEUE_LABEL="commit-queue"
 COMMIT_QUEUE_FAILED_LABEL="commit-queue-failed"
+LACKS_SECOND_APPROVAL_LABEL="lacks-second-approval"
 
 cqurl="${GITHUB_SERVER_URL:?}/${GITHUB_REPOSITORY:?}/actions/runs/${GITHUB_RUN_ID:?}"
 
@@ -24,11 +25,43 @@ escape_code_block_or_line() {
   printf '%s%s%s%s%s\n' "$fence" "$sep" "$1" "$sep" "$fence"
 }
 
+edit_pr_labels() {
+  pr=$1
+  failure_mode=$2
+  shift 2
+  if gh -R "$GITHUB_REPOSITORY" pr edit "$pr" "$@"; then
+    return
+  fi
+  if [ "$failure_mode" = warn ]; then
+    echo "::warning::Failed to update labels for PR $pr"
+    return
+  fi
+  return 1
+}
+
+remove_labels_if_present() {
+  pr=$1
+  shift
+  labels=
+  for label in "$@"; do
+    if jq -e --arg label "$label" \
+        'map(.name) | index($label)' < labels.json > /dev/null; then
+      labels="${labels}${labels:+,}${label}"
+    fi
+  done
+
+  if [ -n "$labels" ]; then
+    edit_pr_labels "$pr" warn --remove-label "$labels"
+  fi
+}
+
 commit_queue_failed() {
   pr=$1
   reported_failure=${2:-}
 
-  gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label "${COMMIT_QUEUE_FAILED_LABEL}" --remove-label "${COMMIT_QUEUE_LABEL}"
+  edit_pr_labels "$pr" required --add-label "$COMMIT_QUEUE_FAILED_LABEL" \
+    --remove-label "$COMMIT_QUEUE_LABEL"
+  remove_labels_if_present "$pr" "$LACKS_SECOND_APPROVAL_LABEL"
 
   last_output_line=$(awk 'NF { line = $0 } END { sub(/^[[:space:]]*/, "", line); print line }' output)
   # shellcheck disable=SC2016
@@ -39,7 +72,7 @@ commit_queue_failed() {
 Add https://github.com/nodejs/node/labels/commit-queue-squash to land it as one commit, or https://github.com/nodejs/node/labels/commit-queue-rebase to land the commits separately.'
   else
     if [ -z "$reported_failure" ]; then
-      reported_failure=$(grep -e '✘' -e '⚠' output | tail -n 10)
+      reported_failure=$(grep -e '✘' -e '✖' -e '⚠' output | tail -n 10)
     fi
     if [ -z "$reported_failure" ]; then
       reported_failure=$(tail -n 10 output)
@@ -145,8 +178,9 @@ for pr in "$@"; do
 
   [ -z "$MULTIPLE_COMMIT_POLICY" ] && gh -R "$GITHUB_REPOSITORY" pr close "$pr"
 
-  # Delete the commit queue label (but ignore errors, it's no big deal if a closed PR still has the label)
-  gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --remove-label "$COMMIT_QUEUE_LABEL" || true
+  # Delete the commit queue labels (but ignore errors, it's no big deal if a closed PR still has them)
+  remove_labels_if_present "$pr" "$COMMIT_QUEUE_LABEL" \
+    "$LACKS_SECOND_APPROVAL_LABEL"
 done
 
 rm -f labels.json
diff --git a/tools/actions/start-ci.sh b/tools/actions/start-ci.sh
index d4d19b92082d..a9ae07a365eb 100755
--- a/tools/actions/start-ci.sh
+++ b/tools/actions/start-ci.sh
@@ -6,6 +6,20 @@ REQUEST_CI_LABEL="request-ci"
 REQUEST_CI_FAILED_LABEL="request-ci-failed"
 cqurl="${GITHUB_SERVER_URL:?}/${GITHUB_REPOSITORY:?}/actions/runs/${GITHUB_RUN_ID:?}"
 
+escape_code_block_or_line() {
+  case $1 in
+    *"
+"*|'') fence='```' sep='
+' ;;
+    *[![:space:]]*) fence='`' sep=' ' ;;
+    *) fence='`' sep='' ;;
+  esac
+  while case $1 in *"$fence"*) ;; *) false ;; esac; do
+    fence=$fence'`'
+  done
+  printf '%s%s%s%s%s\n' "$fence" "$sep" "$1" "$sep" "$fence"
+}
+
 for pr in "$@"; do
   gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --remove-label "$REQUEST_CI_LABEL"
 
@@ -18,7 +32,28 @@ for pr in "$@"; do
     # Do we need to reset?
     gh -R "$GITHUB_REPOSITORY" pr edit "$pr" --add-label "$REQUEST_CI_FAILED_LABEL"
 
-    body="<details><summary>Failed to start CI</summary><pre>$(cat output)</pre><a href='$cqurl'>$cqurl</a></details>"
+    reported_failure=$(grep -e '✘' -e '✖' -e '⚠' -e 'ℹ' output | tail -n 10)
+    if [ -z "$reported_failure" ]; then
+      reported_failure=$(tail -n 10 output)
+    fi
+    if [ -z "$reported_failure" ]; then
+      reported_failure='No failure reason was reported.'
+    fi
+    failure_body=$(escape_code_block_or_line "$reported_failure")
+    raw_output=$(cat output)
+
+    body="### Failed to start CI
+
+$failure_body
+
+<details>
+<summary>Full Auto Start CI output</summary>
+
+$(escape_code_block_or_line "$raw_output")
+
+</details>
+
+[View workflow run]($cqurl)"
     echo "$body"
 
     gh -R "$GITHUB_REPOSITORY" pr comment "$pr" --body "$body"
diff --git a/tools/doc/type-parser.mjs b/tools/doc/type-parser.mjs
index babf0464bb66..b8c9df280b34 100644
--- a/tools/doc/type-parser.mjs
+++ b/tools/doc/type-parser.mjs
@@ -86,6 +86,7 @@ const customTypesMap = {
   'Hash': 'crypto.html#class-hash',
   'Hmac': 'crypto.html#class-hmac',
   'KeyObject': 'crypto.html#class-keyobject',
+  'Mac': 'crypto.html#class-mac',
   'Sign': 'crypto.html#class-sign',
   'Verify': 'crypto.html#class-verify',
   'crypto.constants': 'crypto.html#cryptoconstants',
@@ -225,6 +226,8 @@ const customTypesMap = {
     'perf_hooks.html#class-performanceobserver',
   'PerformanceObserverEntryList':
     'perf_hooks.html#class-performanceobserverentrylist',
+  'SlidingWindowHistogram':
+    'perf_hooks.html#class-slidingwindowhistogram',
 
   'readline.Interface':
     'readline.html#class-readlineinterface',
diff --git a/tools/eslint-rules/no-crypto-class-instanceof.js b/tools/eslint-rules/no-crypto-class-instanceof.js
new file mode 100644
index 000000000000..e54bfc0299cc
--- /dev/null
+++ b/tools/eslint-rules/no-crypto-class-instanceof.js
@@ -0,0 +1,179 @@
+/**
+ * @file Prevent internal code from brand-checking crypto classes with
+ *   instanceof.
+ */
+'use strict';
+
+const { isRequireCall, isString } = require('./rules-utils.js');
+
+const moduleClasses = new Map([
+  ['internal/crypto/keys', new Set([
+    'KeyObject',
+    'SecretKeyObject',
+    'AsymmetricKeyObject',
+    'PublicKeyObject',
+    'PrivateKeyObject',
+    'CryptoKey',
+    'InternalCryptoKey',
+  ])],
+  ['internal/crypto/webcrypto', new Set(['CryptoKey'])],
+  ['internal/crypto/x509', new Set([
+    'X509Certificate',
+    'InternalX509Certificate',
+  ])],
+]);
+
+const knownClassNames = new Set();
+for (const classes of moduleClasses.values()) {
+  for (const name of classes) knownClassNames.add(name);
+}
+
+function getRequiredModule(node) {
+  if (node?.type !== 'CallExpression' ||
+      !isRequireCall(node) ||
+      !isString(node.arguments[0])) {
+    return undefined;
+  }
+  return node.arguments[0].value;
+}
+
+function getPropertyName(node) {
+  if (!node) return undefined;
+  if (node.computed) {
+    return node.property.type === 'Literal' ? node.property.value : undefined;
+  }
+  return node.property.name;
+}
+
+module.exports = {
+  meta: {
+    messages: {
+      noCryptoClassInstanceof:
+        'Do not use `instanceof` to brand-check {{name}}; use its native or private brand.',
+      noCryptoKeyInstanceof:
+        'Use `isCryptoKey(value)` instead of `value instanceof CryptoKey`.',
+      noKeyObjectInstanceof:
+        'Use `isKeyObject(value)` instead of `value instanceof KeyObject`.',
+      noX509CertificateInstanceof:
+        'Use `isX509Certificate(value)` instead of `value instanceof X509Certificate`.',
+    },
+    schema: [],
+  },
+
+  create(context) {
+    const sourceCode = context.sourceCode;
+    const constructorNames = new Map();
+    const namespaceClasses = new Map();
+
+    function registerVariable(node, name, map, value) {
+      const variables = sourceCode.scopeManager.getDeclaredVariables(node);
+      for (const variable of variables) {
+        if (variable.name === name) map.set(variable, value);
+      }
+    }
+
+    function resolveVariable(node) {
+      let scope = sourceCode.getScope(node);
+      while (scope !== null) {
+        const variable = scope.set.get(node.name);
+        if (variable !== undefined) return variable;
+        scope = scope.upper;
+      }
+      return undefined;
+    }
+
+    function isGlobalReference(node) {
+      const variable = resolveVariable(node);
+      return variable === undefined || variable.defs.length === 0;
+    }
+
+    function registerRequire(node) {
+      const module = getRequiredModule(node.init);
+      const classes = moduleClasses.get(module);
+      if (classes === undefined) return;
+
+      if (node.id.type === 'Identifier') {
+        registerVariable(node, node.id.name, namespaceClasses, classes);
+        return;
+      }
+
+      if (node.id.type !== 'ObjectPattern') return;
+      for (const property of node.id.properties) {
+        if (property.type !== 'Property' ||
+            property.value.type !== 'Identifier') {
+          continue;
+        }
+        const importedName = property.key.name ?? property.key.value;
+        if (classes.has(importedName)) {
+          registerVariable(
+            node, property.value.name, constructorNames, importedName);
+        }
+      }
+    }
+
+    function declarationName(variable) {
+      if (!knownClassNames.has(variable.name)) return undefined;
+      for (const definition of variable.defs) {
+        if (definition.type === 'ClassName' ||
+            definition.type === 'FunctionName') {
+          return variable.name;
+        }
+      }
+      return undefined;
+    }
+
+    function constructorName(node) {
+      if (node.type === 'Identifier') {
+        const variable = resolveVariable(node);
+        if (variable !== undefined) {
+          const name = constructorNames.get(variable) ??
+            declarationName(variable);
+          if (name !== undefined) return name;
+        }
+        if (node.name === 'CryptoKey' && isGlobalReference(node)) {
+          return 'CryptoKey';
+        }
+        return undefined;
+      }
+      if (node.type !== 'MemberExpression') return undefined;
+
+      const property = getPropertyName(node);
+      if (node.object.type !== 'Identifier') return undefined;
+      if (node.object.name === 'globalThis' &&
+          property === 'CryptoKey' &&
+          isGlobalReference(node.object)) {
+        return 'CryptoKey';
+      }
+
+      const variable = resolveVariable(node.object);
+      const classes = namespaceClasses.get(variable);
+      return classes?.has(property) ? property : undefined;
+    }
+
+    return {
+      VariableDeclarator: registerRequire,
+
+      BinaryExpression(node) {
+        if (node.operator !== 'instanceof') return;
+
+        const name = constructorName(node.right);
+        if (name === undefined) return;
+
+        let messageId = 'noCryptoClassInstanceof';
+        if (name === 'CryptoKey' || name === 'InternalCryptoKey') {
+          messageId = 'noCryptoKeyInstanceof';
+        } else if (name.endsWith('KeyObject')) {
+          messageId = 'noKeyObjectInstanceof';
+        } else if (name.endsWith('X509Certificate')) {
+          messageId = 'noX509CertificateInstanceof';
+        }
+
+        context.report({
+          node,
+          messageId,
+          data: { name },
+        });
+      },
+    };
+  },
+};
diff --git a/tools/eslint-rules/no-keyobject-cryptokey-instanceof.js b/tools/eslint-rules/no-keyobject-cryptokey-instanceof.js
deleted file mode 100644
index 19e13437247a..000000000000
--- a/tools/eslint-rules/no-keyobject-cryptokey-instanceof.js
+++ /dev/null
@@ -1,122 +0,0 @@
-/**
- * @file Prevent internal code from brand-checking keys with instanceof.
- */
-'use strict';
-
-const { isRequireCall, isString } = require('./rules-utils.js');
-
-const CRYPTO_KEYS_MODULE = 'internal/crypto/keys';
-const WEBCRYPTO_MODULE = 'internal/crypto/webcrypto';
-
-const keyObjectClassNames = new Set([
-  'KeyObject',
-  'SecretKeyObject',
-  'AsymmetricKeyObject',
-  'PublicKeyObject',
-  'PrivateKeyObject',
-]);
-
-const cryptoKeyClassNames = new Set([
-  'CryptoKey',
-  'InternalCryptoKey',
-]);
-
-function isKeyModuleRequire(node) {
-  return node?.type === 'CallExpression' &&
-         isRequireCall(node) &&
-         isString(node.arguments[0]) &&
-         (node.arguments[0].value === CRYPTO_KEYS_MODULE ||
-          node.arguments[0].value === WEBCRYPTO_MODULE);
-}
-
-function getPropertyName(node) {
-  if (!node) return undefined;
-  if (node.computed) {
-    return node.property.type === 'Literal' ? node.property.value : undefined;
-  }
-  return node.property.name;
-}
-
-module.exports = {
-  meta: {
-    messages: {
-      noKeyObjectInstanceof: 'Use `isKeyObject(value)` instead of `value instanceof KeyObject`.',
-      noCryptoKeyInstanceof: 'Use `isCryptoKey(value)` instead of `value instanceof CryptoKey`.',
-    },
-    schema: [],
-  },
-
-  create(context) {
-    const namespaceNames = new Set();
-    const keyObjectConstructorNames = new Set();
-    const cryptoKeyConstructorNames = new Set(['CryptoKey']);
-
-    function registerRequire(node) {
-      if (!isKeyModuleRequire(node.init)) return;
-
-      if (node.id.type === 'Identifier') {
-        namespaceNames.add(node.id.name);
-        return;
-      }
-
-      if (node.id.type !== 'ObjectPattern') return;
-
-      for (const property of node.id.properties) {
-        if (property.type !== 'Property') continue;
-        const keyName = property.key.name ?? property.key.value;
-        if (property.value.type !== 'Identifier') continue;
-        const localName = property.value.name;
-        if (keyObjectClassNames.has(keyName)) {
-          keyObjectConstructorNames.add(localName);
-        } else if (cryptoKeyClassNames.has(keyName)) {
-          cryptoKeyConstructorNames.add(localName);
-        }
-      }
-    }
-
-    function constructorKind(node) {
-      if (node.type === 'Identifier') {
-        if (keyObjectConstructorNames.has(node.name)) return 'KeyObject';
-        if (cryptoKeyConstructorNames.has(node.name)) return 'CryptoKey';
-        return undefined;
-      }
-
-      if (node.type !== 'MemberExpression') return undefined;
-
-      const property = getPropertyName(node);
-      if (node.object.type === 'Identifier') {
-        if (namespaceNames.has(node.object.name)) {
-          if (keyObjectClassNames.has(property)) return 'KeyObject';
-          if (cryptoKeyClassNames.has(property)) return 'CryptoKey';
-        }
-        if (node.object.name === 'globalThis' &&
-            cryptoKeyClassNames.has(property)) {
-          return 'CryptoKey';
-        }
-      }
-
-      return undefined;
-    }
-
-    return {
-      VariableDeclarator: registerRequire,
-
-      BinaryExpression(node) {
-        if (node.operator !== 'instanceof') return;
-
-        const kind = constructorKind(node.right);
-        if (kind === 'KeyObject') {
-          context.report({
-            node,
-            messageId: 'noKeyObjectInstanceof',
-          });
-        } else if (kind === 'CryptoKey') {
-          context.report({
-            node,
-            messageId: 'noCryptoKeyInstanceof',
-          });
-        }
-      },
-    };
-  },
-};
diff --git a/tools/eslint/package-lock.json b/tools/eslint/package-lock.json
index fc7840daff98..52bd25321adf 100644
--- a/tools/eslint/package-lock.json
+++ b/tools/eslint/package-lock.json
@@ -8,18 +8,18 @@
       "name": "eslint-tools",
       "version": "0.0.0",
       "dependencies": {
-        "@babel/core": "^8.0.1",
-        "@babel/eslint-parser": "^8.0.1",
+        "@babel/core": "^8.0.5",
+        "@babel/eslint-parser": "^8.0.5",
         "@babel/plugin-syntax-import-defer": "^8.0.1",
         "@babel/plugin-syntax-import-source": "^8.0.1",
         "@eslint/js": "^10.0.1",
         "@eslint/markdown": "^8.0.3",
         "@stylistic/eslint-plugin": "^5.10.0",
-        "eslint": "^10.8.0",
+        "eslint": "^10.10.0",
         "eslint-formatter-tap": "^9.0.1",
-        "eslint-plugin-jsdoc": "^63.3.1",
-        "eslint-plugin-regexp": "^3.1.1",
-        "globals": "^17.8.0"
+        "eslint-plugin-jsdoc": "^64.3.10",
+        "eslint-plugin-regexp": "^3.3.0",
+        "globals": "^17.12.0"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -36,28 +36,28 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-8.0.0.tgz",
-      "integrity": "sha512-DOjnob/cXOUgDOozCDeq/aK2p5y8dUIVdf6tNhEV1HQRd6I8aQ4f4fbtHRVEvb6lP3BGomrKHiS8ICAASSVQSw==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-8.0.5.tgz",
+      "integrity": "sha512-YLsYoQMvL8l8WrGpN3Zj7O1wK5LEBN+cQtux7BcuHyxIXve724XG+zuJ1n3U1cUweRtTzQOA4IHbuQw3N34SZw==",
       "license": "MIT",
       "engines": {
         "node": "^22.18.0 || >=24.11.0"
       }
     },
     "node_modules/@babel/core": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-8.0.1.tgz",
-      "integrity": "sha512-5FgxM4dLQpMJHSiVATk8foW263dVHQHBVpXYiimNECVWG01f4nFyEbQixeT6Mwvg7TayREJ2gpKl3o2RoMdnqw==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-8.0.5.tgz",
+      "integrity": "sha512-2/oWkgTbBYoqioCWAE4XJobOrzwxTDa5/XjDP3tJ1BhDr/owcd9qnXBp4xc3/2G5X4bvXM04nrxbRJxFcXAxFQ==",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^8.0.0",
-        "@babel/generator": "^8.0.0",
-        "@babel/helper-compilation-targets": "^8.0.0",
-        "@babel/helpers": "^8.0.0",
-        "@babel/parser": "^8.0.0",
+        "@babel/generator": "^8.0.5",
+        "@babel/helper-compilation-targets": "^8.0.5",
+        "@babel/helpers": "^8.0.5",
+        "@babel/parser": "^8.0.5",
         "@babel/template": "^8.0.0",
-        "@babel/traverse": "^8.0.0",
-        "@babel/types": "^8.0.0",
+        "@babel/traverse": "^8.0.5",
+        "@babel/types": "^8.0.5",
         "@types/gensync": "^1.0.5",
         "convert-source-map": "^2.0.0",
         "empathic": "^2.0.1",
@@ -65,7 +65,7 @@
         "import-meta-resolve": "^4.2.0",
         "json5": "^2.2.3",
         "obug": "^2.1.1",
-        "semver": "^7.7.3"
+        "verkit": "^0.3.2"
       },
       "engines": {
         "node": "^22.18.0 || >=24.11.0"
@@ -76,14 +76,14 @@
       }
     },
     "node_modules/@babel/eslint-parser": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/@babel/eslint-parser/-/eslint-parser-8.0.1.tgz",
-      "integrity": "sha512-2javO8pAQv/ld6sS6OcxoLAlzZEZy+xm99bnoAfMhzKSumKhdF5wylpbZB7XTorWr3KLPtx5K95eduJPOy1mzA==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/@babel/eslint-parser/-/eslint-parser-8.0.5.tgz",
+      "integrity": "sha512-q4c+FpoJ/FKeiLnZ9Os3vWnSlZw3dBmlTUx6vuITRqbd8yn4hgUB0/OOJ+gi5lt+mOx/0IW2rXINR98JJllfag==",
       "license": "MIT",
       "dependencies": {
         "eslint-scope": "^9.1.0",
         "eslint-visitor-keys": "^5.0.0",
-        "semver": "^7.7.3"
+        "verkit": "^0.3.2"
       },
       "engines": {
         "node": "^22.18.0 || >=24.11.0"
@@ -94,15 +94,15 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-8.0.0.tgz",
-      "integrity": "sha512-NT9NrVwJsbSV6Y2FSstWa71EETOnzrjkL5/wX3D2mYHtKM+qvqB1DvR4D0Setb/gDBsHzRICifwEWMO8CnTF6g==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-8.0.5.tgz",
+      "integrity": "sha512-f/TuhuMAxJqhwxEGNsJrswuG9VHmh0oNFoQoo6TbpgtFAz9wYZXcTAcWZMHfp7ljesr0RG04bp3Aos9GI59L7w==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^8.0.0",
-        "@babel/types": "^8.0.0",
-        "@jridgewell/gen-mapping": "^0.3.12",
-        "@jridgewell/trace-mapping": "^0.3.28",
+        "@babel/parser": "^8.0.5",
+        "@babel/types": "^8.0.5",
+        "@jridgewell/gen-mapping": "0.4.0-beta.0",
+        "@jridgewell/trace-mapping": "^0.3.31",
         "@types/jsesc": "^2.5.0",
         "jsesc": "^3.0.2"
       },
@@ -111,16 +111,16 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-8.0.0.tgz",
-      "integrity": "sha512-JwculLABZvyPvyLBpwU/E/IbH2uM3mnxNtIJpxnIfb24y1PrdVxK5Dqjle4DpgqpGRnwgC7G8IkzPdSXZrO1Ew==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-8.0.5.tgz",
+      "integrity": "sha512-Qk8ahMGooH5mz6uuhoDvfZGkUf/Mf3RTBucVVl4MKx4LKMTv872TeW8O92h15iVtlN8wAROBIpI1aV6x1z0LCQ==",
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^8.0.0",
+        "@babel/compat-data": "^8.0.5",
         "@babel/helper-validator-option": "^8.0.0",
         "browserslist": "^4.24.0",
         "lru-cache": "^11.0.0",
-        "semver": "^7.7.3"
+        "verkit": "^0.3.2"
       },
       "engines": {
         "node": "^22.18.0 || >=24.11.0"
@@ -157,9 +157,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.2.tgz",
-      "integrity": "sha512-9Fr9QeyCAyi1BR1jKZ6uYQ24EIhQUx5ReHfQU7drOE+TPOb+w11/dsqLkMOT2U29OdCT71XajrOT8xDc1C7orA==",
+      "version": "8.0.4",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-8.0.4.tgz",
+      "integrity": "sha512-4wFaiLd0bVo4cIoTXI3zKI038NIWE/cr3jvBjejOVYVxV/m8Ltav1USiGzG1fmS5J2RhgEOgXNNK46cRPnRsrg==",
       "license": "MIT",
       "engines": {
         "node": "^22.18.0 || >=24.11.0"
@@ -175,25 +175,25 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-8.0.0.tgz",
-      "integrity": "sha512-wfbi91pM3py96oIiJEz7qIpyXDytgr9zQC1HEWwlGNVRAEmItuU/0a41ZUKu1sJGyhhOIpc4t5vk4PYzt8wpsg==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-8.0.5.tgz",
+      "integrity": "sha512-fQtPOXjYOYv85PIdwotp2TJGVYOycX0PQq+l844fFAxOULtBy8BVF35GyeueX0r4KvDthqPH5xAI1clQPk/2uA==",
       "license": "MIT",
       "dependencies": {
         "@babel/template": "^8.0.0",
-        "@babel/types": "^8.0.0"
+        "@babel/types": "^8.0.5"
       },
       "engines": {
         "node": "^22.18.0 || >=24.11.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.0.tgz",
-      "integrity": "sha512-aLxAE+imI9bCcyaPrUDjBv3uSkWieifjLe0kuFOZF0zli0L6GCsTmsePnTr55adbIAgYz2zhN1vnFimCBUYcRQ==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-8.0.5.tgz",
+      "integrity": "sha512-51RXvQNFakaS0bTpYiGkxNbUVwkPO4kONv6EVLorZABxsx+KZ6Z7uSYvi/wmKS/+X+rfj9RvOw0/ZNh+cmI0Rw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^8.0.0"
+        "@babel/types": "^8.0.5"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -247,17 +247,17 @@
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-8.0.0.tgz",
-      "integrity": "sha512-bxTj/W2VclGE6CctlfQOpxg8MPDzXArRqkOBePw8EHfebcjF7fETWSS3BriEECo+UiU/Yblq+xUtSImFu7cTbw==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-8.0.5.tgz",
+      "integrity": "sha512-XFfnuvapSc/vJOcUO7kwORSvpBIvraofKEZ2dhT0PjiF21BRCD7YbAFC8UEeDJNeLoQz82/gVqzgX5hCzkCbdg==",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^8.0.0",
-        "@babel/generator": "^8.0.0",
+        "@babel/generator": "^8.0.5",
         "@babel/helper-globals": "^8.0.0",
-        "@babel/parser": "^8.0.0",
+        "@babel/parser": "^8.0.5",
         "@babel/template": "^8.0.0",
-        "@babel/types": "^8.0.0",
+        "@babel/types": "^8.0.5",
         "obug": "^2.1.1"
       },
       "engines": {
@@ -265,32 +265,54 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.0.tgz",
-      "integrity": "sha512-K8ponJDxBwDHigkeFqaqT5wLGl4bTlwMafR8k7b5CPxr6Ww+UG9ls8Yx6Tcpboxu97eeGVEEyKcHmEyOwN1vSw==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-8.0.5.tgz",
+      "integrity": "sha512-eVdMqi3ej5aHhyQ2Si6yD2cAWeV8FJK9UrhK5aL0Sd8hu5GhT+YswhVNbVheOGVYMg8kuGuMaUpkB3stjj4z8A==",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-string-parser": "^8.0.0",
-        "@babel/helper-validator-identifier": "^8.0.0"
+        "@babel/helper-validator-identifier": "^8.0.4"
       },
       "engines": {
         "node": "^22.18.0 || >=24.11.0"
       }
     },
+    "node_modules/@cacheable/memory": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@cacheable/memory/-/memory-2.2.0.tgz",
+      "integrity": "sha512-CTLKqLItRCEixEAewD3/j9DB3/o96gpTPD4eJ1v+DGOlxZRZncRQkGYqqnAGCscYd6RNeXfGeiuCphsPtqyIfQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@cacheable/utils": "^2.5.0",
+        "@keyv/bigmap": "^1.3.1",
+        "hookified": "^1.15.1",
+        "keyv": "^5.6.0"
+      }
+    },
+    "node_modules/@cacheable/utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@cacheable/utils/-/utils-2.5.0.tgz",
+      "integrity": "sha512-buipgOVDkkPXNR5+xBpDw7Zk2n1EvU7qBJCNUcL7rhQ//kfpOXPAvQ511Os0vpLYJ1pZnvudNytkQt2hst3wqA==",
+      "license": "MIT",
+      "dependencies": {
+        "hashery": "^1.5.1",
+        "keyv": "^5.6.0"
+      }
+    },
     "node_modules/@es-joy/jsdoccomment": {
-      "version": "0.90.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.90.0.tgz",
-      "integrity": "sha512-51x9KxyTAN6guZOCd+lmcDdkhgdMdP/6iMMtg9dyhCWDc3+iSUyoB7f/9WAM/yGHmGFq25Vd6bXRR7CZcB+tog==",
+      "version": "0.97.0",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.97.0.tgz",
+      "integrity": "sha512-EP8uoFfh6+GsdGCduYtmWAW0h7AO+Ayik9Vh5YbA2r/3N6lmJKkCNZX+q3QBXC1K6ixjQ/9igF2b7WVvLm063g==",
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.9",
-        "@typescript-eslint/types": "^8.65.0",
-        "comment-parser": "1.4.7",
+        "@typescript-eslint/types": "^8.69.0",
+        "comment-parser": "1.4.8",
         "esquery": "^1.7.0",
-        "jsdoc-type-pratt-parser": "~7.3.0"
+        "jsdoc-type-pratt-parser": "~9.2.1"
       },
       "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
+        "node": "^22.22.2 || >=24.15.0"
       }
     },
     "node_modules/@es-joy/resolve.exports": {
@@ -434,9 +456,9 @@
       }
     },
     "node_modules/@eslint/plugin-kit": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.2.tgz",
-      "integrity": "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.3.tgz",
+      "integrity": "sha512-IkO+/KEUvwbVpiURZg+P7zF74z5Jxe0UgJxVni+RtoHQ6IZieXaO02kmadomap/q+l6bc/jdPGGqTjhuZnuz1Q==",
       "license": "Apache-2.0",
       "dependencies": {
         "@eslint/core": "^1.2.1",
@@ -447,27 +469,40 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -495,12 +530,12 @@
       }
     },
     "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "version": "0.4.0-beta.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.4.0-beta.0.tgz",
+      "integrity": "sha512-JdGNkbE4GlNPYQhM0L95fBQr7ctLZJ276QXQLTad4t1oSdnnCI3fDq9DW3BqYAWv8Wc3+HS+4Gsii1oPMCfz1w==",
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/sourcemap-codec": "^1.6.0-beta.0",
         "@jridgewell/trace-mapping": "^0.3.24"
       }
     },
@@ -514,9 +549,9 @@
       }
     },
     "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
       "license": "MIT"
     },
     "node_modules/@jridgewell/trace-mapping": {
@@ -529,6 +564,28 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@keyv/bigmap": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@keyv/bigmap/-/bigmap-1.3.1.tgz",
+      "integrity": "sha512-WbzE9sdmQtKy8vrNPa9BRnwZh5UF4s1KTmSK0KUVLo3eff5BlQNNWDnFOouNpKfPKDnms9xynJjsMYjMaT/aFQ==",
+      "license": "MIT",
+      "dependencies": {
+        "hashery": "^1.4.0",
+        "hookified": "^1.15.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "keyv": "^5.6.0"
+      }
+    },
+    "node_modules/@keyv/serialize": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@keyv/serialize/-/serialize-1.1.1.tgz",
+      "integrity": "sha512-dXn3FZhPv0US+7dtJsIi2R+c7qWYiReoEh5zUntWCf4oSpMNib8FDhSoed6m3QyZdx5hK7iLFkYk3rNxwt8vTA==",
+      "license": "MIT"
+    },
     "node_modules/@sindresorhus/base62": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/@sindresorhus/base62/-/base62-1.0.0.tgz",
@@ -642,16 +699,79 @@
       "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
       "license": "MIT"
     },
+    "node_modules/@types/node": {
+      "version": "26.4.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.4.0.tgz",
+      "integrity": "sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.3.0"
+      }
+    },
     "node_modules/@types/unist": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
       "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
       "license": "MIT"
     },
+    "node_modules/@typescript-eslint/project-service": {
+      "version": "8.70.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.70.0.tgz",
+      "integrity": "sha512-hFHbTNqhU9G+2eKFXCBVb1tjFT/LceiJ4+HfLO4pTpDI0KHi6iajpcFFkaSQ9gXmCh7n82A0PthaayEdN6mspQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/tsconfig-utils": "^8.70.0",
+        "@typescript-eslint/types": "^8.70.0",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/scope-manager": {
+      "version": "8.70.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.70.0.tgz",
+      "integrity": "sha512-8nP3Kwh5hlgZ4FicGvmznAmJe8UL4sdU8tLukrPaMuQmDuk4Y8xYfzu/aYZW4xT2JCgc7H/TpDI5cGlxcWJSqQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.70.0",
+        "@typescript-eslint/visitor-keys": "8.70.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/tsconfig-utils": {
+      "version": "8.70.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.70.0.tgz",
+      "integrity": "sha512-adnkeeNq9Sq1sUf4+FRVc0KdgYghzsgFpZSQVZVvY0LCuUuN0FnQgyGzCJeC4fW1cdXseBAjU2EOqUIjbNcZUw==",
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.65.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.65.0.tgz",
-      "integrity": "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==",
+      "version": "8.70.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.70.0.tgz",
+      "integrity": "sha512-asTOIYhDg4zdzOScCyaytrsV3cR6B4ecPQlXw/dJIm7J/MZTtCtfVII9JD8Geh4jTCrK/Xe6cg5UevoleMcoJQ==",
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -661,6 +781,73 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
+    "node_modules/@typescript-eslint/typescript-estree": {
+      "version": "8.70.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.70.0.tgz",
+      "integrity": "sha512-d9NmHMPEKQ7QCLLm1jI3zmoQBwT5KwFYjXBJ9ymZfKCUU+5rmTRykKAFvH5Qn/ZCds3CEAFS9OC9M/jkl0X2bA==",
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/project-service": "8.70.0",
+        "@typescript-eslint/tsconfig-utils": "8.70.0",
+        "@typescript-eslint/types": "8.70.0",
+        "@typescript-eslint/visitor-keys": "8.70.0",
+        "debug": "^4.4.3",
+        "minimatch": "^10.2.2",
+        "semver": "^7.7.3",
+        "tinyglobby": "^0.2.15",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/utils": {
+      "version": "8.70.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.70.0.tgz",
+      "integrity": "sha512-oZmtKJz/4fufZ2p3+Cn3ijEojcdfR+1zYDH2xKYrEly0dR/Q/1xUPRCOlKGxod78nWlU2UnDe09GZ3TaknBFGA==",
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.9.1",
+        "@typescript-eslint/scope-manager": "8.70.0",
+        "@typescript-eslint/types": "8.70.0",
+        "@typescript-eslint/typescript-estree": "8.70.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/visitor-keys": {
+      "version": "8.70.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.70.0.tgz",
+      "integrity": "sha512-BoC8PiO4Hkdo0TVJh9Ntxr5MxPDI7/oFsrygN5ADelFSeXG/qgNuucIGA+L5Z6JpPTE/uRfcTWtscjbUaufepQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.70.0",
+        "eslint-visitor-keys": "^5.0.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
     "node_modules/acorn": {
       "version": "8.16.0",
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
@@ -699,12 +886,12 @@
       }
     },
     "node_modules/are-docs-informative": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/are-docs-informative/-/are-docs-informative-0.0.2.tgz",
-      "integrity": "sha512-ixiS0nLNNG5jNQzgZJNoUpBKdo9yTYZMGJ+QgT2jmjR7G7+QHRCc4v6LQ3NgE7EBJq+o0ams3waJwkrlBom8Ig==",
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/are-docs-informative/-/are-docs-informative-0.1.1.tgz",
+      "integrity": "sha512-sqRsNQBwbKLRX0jV5Cu5uzmtflf892n4Vukz7T659ebL4pz3mpOqCMU7lxMoBTFwnp10E3YB5ZcyHM41W5bcDA==",
       "license": "MIT",
       "engines": {
-        "node": ">=14"
+        "node": ">=18"
       }
     },
     "node_modules/argparse": {
@@ -723,9 +910,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.40",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.40.tgz",
-      "integrity": "sha512-BSSLZ9/Cjjv7Gtj5B68ZzXcXUg8iOf3fme+FCuh8rC/Go+Kmh8cox7M3A8dolou16s64QjLPOSdngh7GxXvkSw==",
+      "version": "2.11.24",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.24.tgz",
+      "integrity": "sha512-hYrgxie335U08WqICoGqKRzV1HFXv6zdxwJE4ekCb80CM9a0SVVsN4QPwT67RraRo+9h8IATk6uxHJw7QSkdOg==",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.cjs"
@@ -747,9 +934,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.4",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz",
-      "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==",
+      "version": "4.29.0",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.29.0.tgz",
+      "integrity": "sha512-3GSvyjvDI4Dur1Meg2BekJquu5uF+9R9a1+5M1Mde192eZoXbeXjzgOsgqPS2V8D5wrrip0gR5Hf/GhWQ9ZzaA==",
       "funding": [
         {
           "type": "opencollective",
@@ -766,11 +953,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.38",
-        "caniuse-lite": "^1.0.30001799",
-        "electron-to-chromium": "^1.5.376",
-        "node-releases": "^2.0.48",
-        "update-browserslist-db": "^1.2.3"
+        "baseline-browser-mapping": "^2.11.23",
+        "caniuse-lite": "^1.0.30001810",
+        "electron-to-chromium": "^1.5.427",
+        "node-releases": "^2.0.55",
+        "update-browserslist-db": "^1.3.3"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -779,10 +966,23 @@
         "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
       }
     },
+    "node_modules/cacheable": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/cacheable/-/cacheable-2.5.0.tgz",
+      "integrity": "sha512-60cyAOytib/OzBw1JNSoSV/boK1AtHryDIjvVBk7XbN4ugfkM3+Sry7fEjNgPMGgOjuaZPAp8ruZ0Cxafwyq9g==",
+      "license": "MIT",
+      "dependencies": {
+        "@cacheable/memory": "^2.2.0",
+        "@cacheable/utils": "^2.5.0",
+        "hookified": "^1.15.0",
+        "keyv": "^5.6.0",
+        "qified": "^0.10.1"
+      }
+    },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001800",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001800.tgz",
-      "integrity": "sha512-MMHtuAz9Ys840zAY5F4k6fV5GaivZ9sPk+nz0mY+GYVzRBnYkN0mpqkSR92oWRQ19yQWo4HvBV/FnC16AJX8MA==",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "funding": [
         {
           "type": "opencollective",
@@ -829,9 +1029,9 @@
       }
     },
     "node_modules/comment-parser": {
-      "version": "1.4.7",
-      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.7.tgz",
-      "integrity": "sha512-0h+uSNtQGW3D98eQt3jJ8L06Fves8hncB4V/PKdw/Qb8Hnk19VaKuTr55UNRYiSoVa7WwrFls+rh3ux9agmkeQ==",
+      "version": "1.4.8",
+      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.8.tgz",
+      "integrity": "sha512-rKZTGo4fzKYna8UcL0isTg5wkBNla7bxTypLwZQXjIdi++IdP1OJ41rI5Mti3/jltkPujbu4i9LIARYA+zpotQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 12.0.0"
@@ -916,9 +1116,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.383",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.383.tgz",
-      "integrity": "sha512-I2484/KkAvl8lm9VyjH2JnbOIV0d/UCqT7gbzs6l+o6Vmn9wgB66uVcKX+Vk6HrXtY6fbWTOEXuv8waDTuFNCw==",
+      "version": "1.5.429",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.429.tgz",
+      "integrity": "sha512-/1ENIE3cx4HTIx4IfPZFaOunJmsrSVTnj6coXoRVbiJUbkeTyFkJvBeWGkdgh08OhFbxYLMT1kbkwFVSarq6Ow==",
       "license": "ISC"
     },
     "node_modules/empathic": {
@@ -952,9 +1152,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "10.8.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.8.0.tgz",
-      "integrity": "sha512-nuKKvN+oIBO0koN7Tm7dlkmnkc21mtt0QJLwAKzjLq14y6lRTdVG36MZHJ8eQHwdJMwZbQNMlPOYedMq/oVJvQ==",
+      "version": "10.10.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.10.0.tgz",
+      "integrity": "sha512-NPXn6r5zl4uET1DAVPaOwzX3rut4c0wcmw3dWJAfOsTM5+TogXo0DDjz8pwm/hL8cyVNpHqeK4JpN0NjnyFFNw==",
       "license": "MIT",
       "workspaces": [
         "packages/*"
@@ -965,7 +1165,7 @@
         "@eslint/config-array": "^0.23.5",
         "@eslint/config-helpers": "^0.7.0",
         "@eslint/core": "^1.2.1",
-        "@eslint/plugin-kit": "^0.7.2",
+        "@eslint/plugin-kit": "^0.7.3",
         "@humanfs/node": "^0.16.6",
         "@humanwhocodes/module-importer": "^1.0.1",
         "@humanwhocodes/retry": "^0.4.2",
@@ -980,7 +1180,7 @@
         "esquery": "^1.7.0",
         "esutils": "^2.0.2",
         "fast-deep-equal": "^3.1.3",
-        "file-entry-cache": "^8.0.0",
+        "file-entry-cache": "11.1.5 || >11.1.6 <12",
         "find-up": "^5.0.0",
         "glob-parent": "^6.0.2",
         "ignore": "^5.2.0",
@@ -1022,17 +1222,18 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "63.3.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-63.3.1.tgz",
-      "integrity": "sha512-yVyTPtOY2tA8EjTwUtaM3pFxj9i/3m4/FSPMv5gMnDHSSleCpzIYQLyV8KnVmEIkkPpNhDlkDQ99mTfjxgqLxA==",
+      "version": "64.3.10",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-64.3.10.tgz",
+      "integrity": "sha512-oevWxylnQJm/f4S5WfvqG/pdmX9Ndsjpfm51QpTFfG8MF92999sp4hm4/GxyboaAQRFngLRDL4iKHZz5hPs4Xw==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "@es-joy/jsdoccomment": "~0.90.0",
+        "@es-joy/jsdoccomment": "~0.97.0",
         "@es-joy/resolve.exports": "1.2.0",
-        "are-docs-informative": "^0.0.2",
-        "comment-parser": "1.4.7",
+        "@typescript-eslint/utils": "^8.69.0",
+        "are-docs-informative": "^0.1.1",
+        "comment-parser": "1.4.8",
         "debug": "^4.4.3",
-        "escape-string-regexp": "^4.0.0",
+        "escape-string-regexp": "^5.0.0",
         "espree": "^11.2.0",
         "esquery": "^1.7.0",
         "html-entities": "^2.6.0",
@@ -1043,12 +1244,24 @@
         "to-valid-identifier": "^1.0.0"
       },
       "engines": {
-        "node": "^22.13.0 || >=24"
+        "node": "^22.22.2 || >=24.15.0"
       },
       "peerDependencies": {
         "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0"
       }
     },
+    "node_modules/eslint-plugin-jsdoc/node_modules/escape-string-regexp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
+      "integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/eslint-plugin-jsdoc/node_modules/espree": {
       "version": "11.2.0",
       "resolved": "https://registry.npmjs.org/espree/-/espree-11.2.0.tgz",
@@ -1067,15 +1280,15 @@
       }
     },
     "node_modules/eslint-plugin-regexp": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-regexp/-/eslint-plugin-regexp-3.1.1.tgz",
-      "integrity": "sha512-MxR5nqoQCtVWmJwia0D2+NlXX1xzdpkslsVOZLEYQ4PQWEaL65PCZXURxaBc3lPnkNFpNxzMIRmYVxdl8giXRA==",
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-regexp/-/eslint-plugin-regexp-3.3.0.tgz",
+      "integrity": "sha512-TT0JTQbW7CRKohntpGAsMdQ1K3MsmJK4gdAhKJtIwlJ0JvuYxauymFgJdvqxIY4lqNj0EuRZWVrymQtEdJYEFg==",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.11.0",
         "comment-parser": "^1.4.0",
-        "jsdoc-type-pratt-parser": "^7.0.0",
+        "jsdoc-type-pratt-parser": "^9.0.0",
         "refa": "^0.12.1",
         "regexp-ast-analysis": "^0.7.1",
         "scslre": "^0.3.0"
@@ -1236,16 +1449,30 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/file-entry-cache": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
-      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
+      "version": "11.1.5",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-11.1.5.tgz",
+      "integrity": "sha512-+PFTHITI08JIGhnNpGNI8T8inUpgZfk3GNEqfT9R2zZV2iFXg3CvqzSl/uEhs7TSGujYRELEANyDvS8Fj7+S7Q==",
       "license": "MIT",
       "dependencies": {
-        "flat-cache": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=16.0.0"
+        "flat-cache": "^6.1.23"
       }
     },
     "node_modules/find-up": {
@@ -1265,22 +1492,20 @@
       }
     },
     "node_modules/flat-cache": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
-      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
+      "version": "6.1.23",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-6.1.23.tgz",
+      "integrity": "sha512-f++BY9pTk+983xK1FLzlLpmM0i0z+jHmx3QESGkURMXujQZz1k5wzwX6hjnQ8goaD0B+sYnDK1yZ6MTyZfUaqA==",
       "license": "MIT",
       "dependencies": {
-        "flatted": "^3.2.9",
-        "keyv": "^4.5.4"
-      },
-      "engines": {
-        "node": ">=16"
+        "cacheable": "^2.5.0",
+        "flatted": "^3.4.2",
+        "hookified": "^1.15.0"
       }
     },
     "node_modules/flatted": {
-      "version": "3.4.2",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
-      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
+      "version": "3.4.4",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.4.tgz",
+      "integrity": "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==",
       "license": "ISC"
     },
     "node_modules/format": {
@@ -1319,9 +1544,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.8.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.8.0.tgz",
-      "integrity": "sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==",
+      "version": "17.12.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.12.0.tgz",
+      "integrity": "sha512-cezEd/DTyyht9cvSSURyygXPfy04GtWO/5e6ZPvH7fCtjKz9PYOmuawphw1Ctd1f6C+5JypXfGD7ahNMXvevBA==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -1330,6 +1555,24 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/hashery": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz",
+      "integrity": "sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==",
+      "license": "MIT",
+      "dependencies": {
+        "hookified": "^1.15.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/hookified": {
+      "version": "1.15.1",
+      "resolved": "https://registry.npmjs.org/hookified/-/hookified-1.15.1.tgz",
+      "integrity": "sha512-MvG/clsADq1GPM2KGo2nyfaWVyn9naPiXrqIe4jYjXNZQt238kWyOGrsyc/DmRAQ+Re6yeo6yX/yoNCG5KAEVg==",
+      "license": "MIT"
+    },
     "node_modules/html-entities": {
       "version": "2.6.0",
       "resolved": "https://registry.npmjs.org/html-entities/-/html-entities-2.6.0.tgz",
@@ -1408,9 +1651,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "funding": [
         {
           "type": "github",
@@ -1430,12 +1673,16 @@
       }
     },
     "node_modules/jsdoc-type-pratt-parser": {
-      "version": "7.3.0",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-7.3.0.tgz",
-      "integrity": "sha512-DoyJXo7x/n48M3NsGOs9QnEws0ft0tV3YsSgvWMNxz2hZtz+Q6fpqUD96lVYX4a+jcEkzHeFNDJOn68TzXfbdA==",
+      "version": "9.2.1",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.1.tgz",
+      "integrity": "sha512-V4Ww4EHnTcTLSOMoB0FsF72JhQvcAsriCm/LWnxJeGWoxIjEL2l9na11abQok5SYShq8m0Gl02el/xAbTCulvQ==",
       "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.9",
+        "@types/node": "^26.4.0"
+      },
       "engines": {
-        "node": ">=20.0.0"
+        "node": "^22.22.2 || >=24.15.0"
       }
     },
     "node_modules/jsesc": {
@@ -1450,12 +1697,6 @@
         "node": ">=6"
       }
     },
-    "node_modules/json-buffer": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
-      "license": "MIT"
-    },
     "node_modules/json-schema-traverse": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
@@ -1497,12 +1738,12 @@
       }
     },
     "node_modules/keyv": {
-      "version": "4.5.4",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
-      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
+      "integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
       "license": "MIT",
       "dependencies": {
-        "json-buffer": "3.0.1"
+        "@keyv/serialize": "^1.1.1"
       }
     },
     "node_modules/levn": {
@@ -1544,9 +1785,9 @@
       }
     },
     "node_modules/lru-cache": {
-      "version": "11.5.1",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
-      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
@@ -2438,9 +2679,9 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.50",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz",
-      "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==",
+      "version": "2.0.55",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.55.tgz",
+      "integrity": "sha512-mIrE/Cw9y+9Au6dS5vDKDhQza9YvG6w+ZrS6X+ZzA7yFW/soAeaups4Qzn1bL6g5FVy8WtP79+0j82oPIbqRjQ==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -2453,9 +2694,9 @@
       "license": "MIT"
     },
     "node_modules/obug": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.3.tgz",
-      "integrity": "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.2.1.tgz",
+      "integrity": "sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==",
       "funding": [
         "https://github.com/sponsors/sxzz",
         "https://opencollective.com/debug"
@@ -2581,6 +2822,24 @@
         "node": ">=6"
       }
     },
+    "node_modules/qified": {
+      "version": "0.10.1",
+      "resolved": "https://registry.npmjs.org/qified/-/qified-0.10.1.tgz",
+      "integrity": "sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==",
+      "license": "MIT",
+      "dependencies": {
+        "hookified": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/qified/node_modules/hookified": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/hookified/-/hookified-2.2.0.tgz",
+      "integrity": "sha512-p/LgFzRN5FeoD3DLS6bkUapeye6E4SI6yJs6KetENd18S+FBthqYq2amJUWpt5z0EQwwHemidjY5OqJGEKm5uA==",
+      "license": "MIT"
+    },
     "node_modules/refa": {
       "version": "0.12.1",
       "resolved": "https://registry.npmjs.org/refa/-/refa-0.12.1.tgz",
@@ -2687,6 +2946,22 @@
       "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==",
       "license": "CC0-1.0"
     },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
     "node_modules/to-valid-identifier": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/to-valid-identifier/-/to-valid-identifier-1.0.0.tgz",
@@ -2703,6 +2978,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/ts-api-utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.12"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4"
+      }
+    },
     "node_modules/type-check": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
@@ -2715,6 +3002,26 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/typescript": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
+      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "license": "MIT"
+    },
     "node_modules/unist-util-is": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-6.0.1.tgz",
@@ -2785,9 +3092,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.3.tgz",
+      "integrity": "sha512-pJ2sYawQS0R/WI928Gj5GlPhTGzbMelq0+4INtSYNDV9ErKJcX6xjGWkoG/VnB3dpUm00zALaqkrUD77pO5TDQ==",
       "funding": [
         {
           "type": "opencollective",
@@ -2823,6 +3130,18 @@
         "punycode": "^2.1.0"
       }
     },
+    "node_modules/verkit": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/verkit/-/verkit-0.3.2.tgz",
+      "integrity": "sha512-zj/ob3UsvJGN0whEAKFp53REA5X66hvffVqoCtVQAakJKnKlH+/PcOfMoFwIG/o4rElqLv/ycAFlx8ZlXUorCg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sxzz"
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
diff --git a/tools/eslint/package.json b/tools/eslint/package.json
index 30b0aa50c84c..8357472e24ca 100644
--- a/tools/eslint/package.json
+++ b/tools/eslint/package.json
@@ -3,17 +3,17 @@
   "version": "0.0.0",
   "private": true,
   "dependencies": {
-    "@babel/core": "^8.0.1",
-    "@babel/eslint-parser": "^8.0.1",
+    "@babel/core": "^8.0.5",
+    "@babel/eslint-parser": "^8.0.5",
     "@babel/plugin-syntax-import-defer": "^8.0.1",
     "@babel/plugin-syntax-import-source": "^8.0.1",
     "@eslint/js": "^10.0.1",
     "@eslint/markdown": "^8.0.3",
     "@stylistic/eslint-plugin": "^5.10.0",
-    "eslint": "^10.8.0",
+    "eslint": "^10.10.0",
     "eslint-formatter-tap": "^9.0.1",
-    "eslint-plugin-jsdoc": "^63.3.1",
-    "eslint-plugin-regexp": "^3.1.1",
-    "globals": "^17.8.0"
+    "eslint-plugin-jsdoc": "^64.3.10",
+    "eslint-plugin-regexp": "^3.3.0",
+    "globals": "^17.12.0"
   }
 }
diff --git a/tools/generate_config_gypi.py b/tools/generate_config_gypi.py
index 436767e633e1..d464d4b5859c 100755
--- a/tools/generate_config_gypi.py
+++ b/tools/generate_config_gypi.py
@@ -68,18 +68,19 @@ def translate_config(out_dir, config, v8_config):
           bool_string_to_number(config['node_enable_inspector']),
       'shlib_suffix': 'dylib' if sys.platform == 'darwin' else 'so',
       'tsan': bool_string_to_number(config['is_tsan']),
-      # TODO(zcbenz): Shared components are not supported in GN config yet.
       'node_shared': 'false',
-      'node_shared_brotli': 'false',
-      'node_shared_cares': 'false',
-      'node_shared_http_parser': 'false',
-      'node_shared_libuv': 'false',
-      'node_shared_nghttp2': 'false',
+      'node_shared_brotli': config['node_shared_brotli'],
+      'node_shared_cares': config['node_shared_cares'],
+      'node_shared_hdr_histogram': config['node_shared_hdr_histogram'],
+      'node_shared_http_parser': config['node_shared_http_parser'],
+      'node_shared_libuv': config['node_shared_libuv'],
+      'node_shared_nghttp2': config['node_shared_nghttp2'],
       'node_shared_nghttp3': 'false',
       'node_shared_ngtcp2': 'false',
       'node_shared_openssl': 'false',
-      'node_shared_sqlite': 'false',
+      'node_shared_sqlite': config['node_shared_sqlite'],
       'node_shared_zlib': 'false',
+      'node_shared_zstd': config['node_shared_zstd'],
     }
   }
   config_gypi['variables'].update(v8_config)
diff --git a/tools/lint-md/package-lock.json b/tools/lint-md/package-lock.json
index 1ab4268328b2..ea6663dc369b 100644
--- a/tools/lint-md/package-lock.json
+++ b/tools/lint-md/package-lock.json
@@ -326,9 +326,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "funding": [
         {
           "type": "github",
diff --git a/tools/pgo/README.md b/tools/pgo/README.md
index 9277315508ca..234f20e638ac 100644
--- a/tools/pgo/README.md
+++ b/tools/pgo/README.md
@@ -1,7 +1,6 @@
 # Node.js PGO Training Scripts
 
-Training workloads for Profile-Guided Optimization (PGO) builds using
-Clang/LLVM (including Clang-CL on Windows).
+Training workloads for Profile-Guided Optimization (PGO) builds.
 
 ## What is PGO?
 
@@ -10,21 +9,36 @@ branch prediction, code layout), typically improving throughput by 5-20%.
 
 The process has three phases:
 
-1. **Instrument** — Build with `-fprofile-generate` (produces `.profraw` files)
+1. **Instrument** — Build with `-fprofile-generate`
 2. **Train** — Run representative workloads to collect profile data
-3. **Optimize** — Merge `.profraw` → `node.profdata` via `llvm-profdata`,
-   then rebuild with `-fprofile-use`
+3. **Optimize** — Rebuild with `-fprofile-use`
 
-## Quick Start
+## Platform Support
 
-From a VS Developer Command Prompt:
+| Platform | Supported toolchains | Driver                    |
+| -------- | -------------------- | ------------------------- |
+| Windows  | Clang-CL             | `vcbuild.bat` + `pgo.ps1` |
+| Linux    | GCC                  | `configure` + `make`      |
+| macOS    | —                    | —                         |
+
+The two supported flows differ in how profile data is collected. Clang writes
+one `.profraw` file per process, which must be merged into a single
+`.profdata` before the optimize phase. GCC's libgcov instead merges counters
+into `.gcda` files next to each object file as each process exits, so there is
+no merge step.
+
+Clang on Linux and macOS are not supported yet.
+
+## Quick Start: Windows
+
+From a VS Developer Command Prompt, at the repo root:
 
 ```powershell
 # Step 1: Build the instrumented binary
 vcbuild.bat pgo-generate
 
-# Step 2: Run workloads and merge profile data
-.\pgo.ps1
+# Step 2: Run workloads to collect profile data
+powershell -ExecutionPolicy Bypass -File .\tools\pgo\pgo.ps1
 
 # Step 3: Build the optimized binary
 vcbuild.bat pgo-use
@@ -33,16 +47,51 @@ vcbuild.bat pgo-use
 `pgo.ps1` expects the instrumented binary at `Release\node.exe` (produced by
 step 1) and writes `node.profdata` to the repo root (consumed by step 3).
 
+The script is unsigned, so the default execution policy refuses to run it
+without `-ExecutionPolicy Bypass`. Use `pwsh` in place of `powershell` on
+PowerShell 7.
+
 ```powershell
 # Optionally set a longer training duration (default: 15s per script)
-.\pgo.ps1 -Duration 30
+powershell -ExecutionPolicy Bypass -File .\tools\pgo\pgo.ps1 -Duration 30
+```
+
+## Quick Start: Linux
+
+```bash
+# Step 1: Build the instrumented binary
+./configure --enable-pgo-generate
+make
+
+# Step 2: Run workloads to collect profile data
+./out/Release/node tools/pgo/pgo-run-all.js --duration=15 --verbose
+
+# Step 3: Build the optimized binary
+./configure --enable-pgo-use
+make
 ```
 
+Step 2 needs no driver script. Each object file gets one counter file beside
+it, with the same basename and a `.gcda` extension:
+
+```text
+out/Release/obj/src/node_base.node_binding.o    # from step 1
+out/Release/obj/src/node_base.node_binding.gcda # from step 2
+```
+
+Keep `out/` intact between steps 1 and 3. GCC records the `.gcda` path into
+each object at compile time, so `make clean` or `make distclean` discards the
+training data and step 3 silently produces an ordinary build.
+
+The build passes `-fprofile-correction`, which is required here. Counter
+updates from the worker threads and the libuv thread pool race with each
+other, and GCC treats the resulting inconsistent profile as an error unless
+told to smooth it out.
+
 ## Training Scripts
 
 All scripts use only Node.js built-in modules (no npm dependencies).
-Each script is run as a separate process via `fork()`, producing its own
-`.profraw` file.
+Each script is run as a separate process via `fork()`.
 
 | Script                   | What it exercises                                             |
 | ------------------------ | ------------------------------------------------------------- |
@@ -65,13 +114,13 @@ workloads). When used with `pgo.ps1`, this is handled automatically.
 
 ```bash
 # Run all scripts
-node tools/pgo/pgo-run-all.js --duration=15 --verbose
+./out/Release/node tools/pgo/pgo-run-all.js --duration=15 --verbose
 
 # Run specific scripts
-node tools/pgo/pgo-run-all.js --scripts=http-server,json,crypto --duration=30
+./out/Release/node tools/pgo/pgo-run-all.js --scripts=http-server,json,crypto --duration=30
 
 # Show help
-node tools/pgo/pgo-run-all.js --help
+./out/Release/node tools/pgo/pgo-run-all.js --help
 ```
 
 Each script reads the `PGO_TRAINING_DURATION` environment variable (in
@@ -82,6 +131,7 @@ automatically from the `--duration` flag (in seconds).
 
 ```
 tools/pgo/
+├── pgo.ps1                 # Windows training driver (collect + merge)
 ├── pgo-run-all.js          # Training orchestrator
 ├── pgo-http-server.js      # HTTP server + client workload
 ├── pgo-json.js             # JSON parse/stringify workload
diff --git a/pgo.ps1 b/tools/pgo/pgo.ps1
similarity index 88%
rename from pgo.ps1
rename to tools/pgo/pgo.ps1
index 39f5352463e3..1cfedddd9e69 100644
--- a/pgo.ps1
+++ b/tools/pgo/pgo.ps1
@@ -4,9 +4,12 @@
 # (Release\node.exe) and merges the resulting .profraw files into
 # node.profdata for use with -fprofile-use.
 #
-# Usage (from a VS Developer Command Prompt):
-#   .\pgo.ps1                     # Run workloads (15s each) and merge
-#   .\pgo.ps1 -Duration 30        # Run workloads (30s each) and merge
+# Usage (from a VS Developer Command Prompt, at the repo root):
+#   powershell -ExecutionPolicy Bypass -File .\tools\pgo\pgo.ps1
+#   powershell -ExecutionPolicy Bypass -File .\tools\pgo\pgo.ps1 -Duration 30
+#
+# The script is unsigned, so the default execution policy blocks it without
+# -ExecutionPolicy Bypass. Default duration is 15s per workload.
 #
 # Prerequisites:
 #   - Release\node.exe must be an instrumented build (built with pgo-generate)
@@ -22,6 +25,10 @@ param(
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+# The instrumented binary and the merged profile both live at the repo root,
+# two levels up from tools\pgo. common.gypi reads node.profdata from there.
+$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot "..\..")).Path
+
 # ---------------------------------------------------------------------------
 # Locate llvm-profdata shipped with Visual Studio's LLVM toolset
 # ---------------------------------------------------------------------------
@@ -64,13 +71,13 @@ function Find-LlvmProfdata {
 # Validate prerequisites
 # ---------------------------------------------------------------------------
 
-$instrumentedNode = Join-Path $PSScriptRoot "Release\node.exe"
+$instrumentedNode = Join-Path $repoRoot "Release\node.exe"
 if (-not (Test-Path $instrumentedNode)) {
     Write-Error "Instrumented binary not found: $instrumentedNode`nBuild with: vcbuild.bat pgo-generate"
     exit 1
 }
 
-$pgoRunAll = Join-Path $PSScriptRoot "tools\pgo\pgo-run-all.js"
+$pgoRunAll = Join-Path $PSScriptRoot "pgo-run-all.js"
 if (-not (Test-Path $pgoRunAll)) {
     Write-Error "PGO training script not found: $pgoRunAll"
     exit 1
@@ -90,7 +97,7 @@ Write-Host "`n=== STEP 1: Collect PGO profiles ===" -ForegroundColor Cyan
 
 # Directory that will receive .profraw files from the instrumented binary.
 # %p (PID) and %m (module hash) keep concurrent/fork'd processes from colliding.
-$profileDir = Join-Path $PSScriptRoot "pgo-profiles"
+$profileDir = Join-Path $repoRoot "pgo-profiles"
 
 if (Test-Path $profileDir) {
     Remove-Item -Recurse -Force $profileDir
@@ -137,7 +144,7 @@ $totalSize = ($profrawFiles | Measure-Object -Property Length -Sum).Sum
 $totalSizeMB = [math]::Round($totalSize / 1MB, 1)
 Write-Host "Found $($profrawFiles.Count) .profraw file(s), ${totalSizeMB} MB total"
 
-$profdata = Join-Path $PSScriptRoot "node.profdata"
+$profdata = Join-Path $repoRoot "node.profdata"
 $mergeArgs = @("merge", "--output=$profdata") + ($profrawFiles | Select-Object -ExpandProperty FullName)
 
 $mergeStopwatch = [System.Diagnostics.Stopwatch]::StartNew()
diff --git a/tools/test.py b/tools/test.py
index 0bdfa5de7993..1495182fcc06 100755
--- a/tools/test.py
+++ b/tools/test.py
@@ -741,10 +741,11 @@ def RunProcess(context, timeout, args, **rest):
       timed_out = True
     else:
       exit_code = process.poll()
-      time.sleep(sleep_time)
-      sleep_time = sleep_time * SLEEP_TIME_FACTOR
-      if sleep_time > MAX_SLEEP_TIME:
-        sleep_time = MAX_SLEEP_TIME
+      if exit_code is None:
+        time.sleep(sleep_time)
+        sleep_time = sleep_time * SLEEP_TIME_FACTOR
+        if sleep_time > MAX_SLEEP_TIME:
+          sleep_time = MAX_SLEEP_TIME
   return (process, exit_code, timed_out)
 
 
@@ -1846,7 +1847,7 @@ def should_keep(case):
     print()
     sys.stderr.write("--- Total time: %s ---\n" % FormatTime(duration))
     timed_tests = [ t for t in cases_to_run if not t.duration is None ]
-    timed_tests.sort(key=lambda x: x.duration)
+    timed_tests.sort(key=lambda x: x.duration, reverse=True)
     for i, entry in enumerate(timed_tests[:20], start=1):
       t = FormatTimedelta(entry.duration)
       sys.stderr.write("%4i (%s) %s\n" % (i, t, entry.GetLabel()))
diff --git a/tools/v8/fetch_deps.py b/tools/v8/fetch_deps.py
index 055ffb50eafb..2d72127f9558 100755
--- a/tools/v8/fetch_deps.py
+++ b/tools/v8/fetch_deps.py
@@ -9,9 +9,6 @@
 Usage: fetch_deps.py <v8-path>
 """
 
-# for py2/py3 compatibility
-from __future__ import print_function
-
 import os
 import subprocess
 import sys
diff --git a/tools/v8/node_common.py b/tools/v8/node_common.py
index f873065c1dfe..f9b3074e3e11 100755
--- a/tools/v8/node_common.py
+++ b/tools/v8/node_common.py
@@ -3,11 +3,9 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-# for py2/py3 compatibility
-from __future__ import print_function
 
 import os
-import pipes
+import shlex
 import shutil
 import stat
 import subprocess
@@ -29,8 +27,8 @@ def _Get(v8_path):
       print("Checking out depot_tools.")
       # shell=True needed on Windows to resolve git.bat.
       subprocess.check_call("git clone {} {}".format(
-          pipes.quote(DEPOT_TOOLS_URL),
-          pipes.quote(depot_tools)), shell=True)
+          shlex.quote(DEPOT_TOOLS_URL),
+          shlex.quote(depot_tools)), shell=True)
       # Using check_output to hide warning messages.
       subprocess.check_output(
           [sys.executable, gclient_path, "metrics", "--opt-out"],
diff --git a/tools/v8_gypfiles/features.gypi b/tools/v8_gypfiles/features.gypi
index 53886830721c..373448fccfb2 100644
--- a/tools/v8_gypfiles/features.gypi
+++ b/tools/v8_gypfiles/features.gypi
@@ -166,6 +166,9 @@
     'v8_enable_pointer_compression_shared_cage%': 0,
     'v8_enable_31bit_smis_on_64bit_arch%': 0,
 
+    # Size of the contiguous read-only space reservation in the shared cage.
+    'v8_contiguous_compressed_ro_space_size_mb%': 16,
+
     # Sets -dV8_SHORT_BUILTIN_CALLS
     'v8_enable_short_builtin_calls%': 0,
 
@@ -374,7 +377,11 @@
         'defines': ['V8_COMPRESS_POINTERS_IN_MULTIPLE_CAGES'],
       }],
       ['v8_enable_pointer_compression_shared_cage==1', {
-        'defines': ['V8_COMPRESS_POINTERS_IN_SHARED_CAGE'],
+        'defines': [
+          'V8_COMPRESS_POINTERS_IN_SHARED_CAGE',
+          'V8_CONTIGUOUS_COMPRESSED_RO_SPACE',
+          'V8_CONTIGUOUS_COMPRESSED_RO_SPACE_SIZE_MB=<(v8_contiguous_compressed_ro_space_size_mb)',
+        ],
       }],
       ['v8_enable_pointer_compression==1 or v8_enable_31bit_smis_on_64bit_arch==1', {
         'defines': ['V8_31BIT_SMIS_ON_64BIT_ARCH',],
@@ -457,9 +464,21 @@
         'defines': ['V8_ENABLE_SEEDED_ARRAY_INDEX_HASH',],
       }],
       ['dcheck_always_on!=0', {
-        'defines': ['DEBUG',],
+        'defines': [
+          'DEBUG',
+          'V8_LOGGING_LEVEL=2',  # Print file, line, message on fatal checks
+        ],
       }, {
         'defines': ['NDEBUG',],
+        'configurations': {
+          'Debug': {
+            'defines': ['V8_LOGGING_LEVEL=2',],
+          },
+          'Release': {
+            # Only log message (without file or line) on fatal checks
+            'defines': ['V8_LOGGING_LEVEL=1',],
+          },
+        },
       }],
       ['v8_enable_verify_csa==1', {
         'defines': ['ENABLE_VERIFY_CSA',],
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index f90a29d102ac..370001847ee8 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -2414,6 +2414,9 @@
         ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
           'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
         }],
+        ['v8_target_arch=="riscv64"', {
+          'defines': ['HWY_BROKEN_TARGETS=HWY_RVV',],
+        }],
       ],
       'sources': [
         '<!@pymod_do_main(GN-scraper "<(HIGHWAY_ROOT)/BUILD.gn"  "source_set.\\"libhwy.*?sources = ")',
diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index e64b8e6d89fc..7363e7088ee9 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -10,8 +10,10 @@ import { CryptoBinding } from './internalBinding/crypto';
 import { DebugBinding } from './internalBinding/debug';
 import { DiagnosticsChannelBinding } from './internalBinding/diagnostics_channel';
 import { EncodingBinding } from './internalBinding/encoding_binding';
+import { FFIBinding } from './internalBinding/ffi';
 import { FsBinding } from './internalBinding/fs';
 import { FsDirBinding } from './internalBinding/fs_dir';
+import { FsEventWrapBinding } from './internalBinding/fs_event_wrap';
 import { HeapUtilsBinding } from './internalBinding/heap_utils';
 import { HttpParserBinding } from './internalBinding/http_parser';
 import { ICUBinding } from './internalBinding/icu';
@@ -23,13 +25,18 @@ import { MessagingBinding } from './internalBinding/messaging';
 import { ModulesBinding } from './internalBinding/modules';
 import { OptionsBinding } from './internalBinding/options';
 import { OSBinding } from './internalBinding/os';
+import { PerformanceBinding } from './internalBinding/performance';
+import { PermissionBinding } from './internalBinding/permission';
 import { ProcessBinding } from './internalBinding/process';
 import { ProcessWrapBinding } from './internalBinding/process_wrap';
+import { ProfilerBinding } from './internalBinding/profiler';
 import { SeaBinding } from './internalBinding/sea';
 import { SerdesBinding } from './internalBinding/serdes';
 import { SignalWrapBinding } from './internalBinding/signal_wrap';
+import { StreamPipeBinding } from './internalBinding/stream_pipe';
 import { StringDecoderBinding } from './internalBinding/string_decoder';
 import { SymbolsBinding } from './internalBinding/symbols';
+import { TaskQueueBinding } from './internalBinding/task_queue';
 import { TimersBinding } from './internalBinding/timers';
 import { TypesBinding } from './internalBinding/types';
 import { URLBinding } from './internalBinding/url';
@@ -54,8 +61,10 @@ interface InternalBindingMap {
   debug: DebugBinding;
   diagnostics_channel: DiagnosticsChannelBinding;
   encoding_binding: EncodingBinding;
+  ffi: FFIBinding;
   fs: FsBinding;
   fs_dir: FsDirBinding;
+  fs_event_wrap: FsEventWrapBinding;
   heap_utils: HeapUtilsBinding;
   http_parser: HttpParserBinding;
   icu: ICUBinding;
@@ -67,13 +76,18 @@ interface InternalBindingMap {
   modules: ModulesBinding;
   options: OptionsBinding;
   os: OSBinding;
+  performance: PerformanceBinding;
+  permission: PermissionBinding;
   process: ProcessBinding;
   process_wrap: ProcessWrapBinding;
+  profiler: ProfilerBinding;
   sea: SeaBinding;
   serdes: SerdesBinding;
   signal_wrap: SignalWrapBinding;
+  stream_pipe: StreamPipeBinding;
   string_decoder: StringDecoderBinding;
   symbols: SymbolsBinding;
+  task_queue: TaskQueueBinding;
   timers: TimersBinding;
   types: TypesBinding;
   url: URLBinding;
diff --git a/typings/internalBinding/crypto.d.ts b/typings/internalBinding/crypto.d.ts
index 03ea3e74c641..b31bd413e0b6 100644
--- a/typings/internalBinding/crypto.d.ts
+++ b/typings/internalBinding/crypto.d.ts
@@ -1,6 +1,8 @@
 declare namespace InternalCryptoBinding {
   type Buffer = Uint8Array;
-  type ByteSource = string | ArrayBuffer | SharedArrayBuffer | ArrayBufferView;
+  type BufferSource = ArrayBuffer | SharedArrayBuffer | ArrayBufferView;
+  type OptionalBufferSource = BufferSource | undefined;
+  type ByteSource = string | BufferSource;
   type OptionalByteSource = ByteSource | undefined;
   type JwkKey = Record<string, string | string[] | boolean | undefined>;
   type KeyFormatDER = 0;
@@ -123,6 +125,8 @@ declare namespace InternalCryptoBinding {
       algorithm: object | undefined,
       usagesMask: number,
       extractable: boolean,
+      secondaryHandle?: KeyObjectHandle,
+      seedData?: ArrayBuffer | SharedArrayBuffer | ArrayBufferView,
     ): CryptoKey;
   }
   interface CryptoKeyPair {
@@ -300,6 +304,8 @@ declare namespace InternalCryptoBinding {
       algorithm: string,
       data: ByteSource,
       outputLength?: number,
+      functionName?: OptionalBufferSource,
+      customization?: OptionalBufferSource,
     ): CryptoJobForMode<M, ArrayBuffer>;
   }
 
@@ -376,19 +382,19 @@ declare namespace InternalCryptoBinding {
     ): CryptoJobWebCrypto<SignJobResult<S>>;
   }
 
-  interface NidKeyPairGenJobConstructor {
+  interface NamedKeyPairGenJobConstructor {
     new<
       M extends CryptoJobRegularMode,
       PublicFormat extends PublicKeyFormat = undefined,
       PrivateFormat extends PrivateKeyFormat = undefined,
     >(
       mode: M,
-      nid: number,
+      name: string,
       ...encoding: KeyPairEncodingArgs<PublicFormat, PrivateFormat>
     ): CryptoJobForMode<M, GeneratedKeyPair<PublicFormat, PrivateFormat>>;
     new(
       mode: CryptoJobWebCryptoMode,
-      nid: number,
+      name: string,
       algorithm: object,
       publicUsagesMask: number,
       privateUsagesMask: number,
@@ -601,6 +607,8 @@ declare namespace InternalCryptoBinding {
       algorithm: object | undefined,
       usagesMask: number,
       extractable: boolean,
+      secondaryHandle?: KeyObjectHandle,
+      seedData?: ArrayBuffer | SharedArrayBuffer | ArrayBufferView,
     ): CryptoKey;
   }
 
@@ -615,6 +623,8 @@ declare namespace InternalCryptoBinding {
     algorithm: object,
     usagesMask: number,
     handle: KeyObjectHandle,
+    secondaryHandle: KeyObjectHandle | undefined,
+    seedData: Buffer | undefined,
   ];
 
   type CreateNativeKeyObjectClassCallback =
@@ -640,6 +650,11 @@ declare namespace InternalCryptoBinding {
     digest(encoding?: string): string | Buffer;
   }
 
+  interface MacHandle {
+    update(data: ByteSource, encoding?: string): boolean;
+    final(encoding?: string): string | Buffer;
+  }
+
   interface CipherBaseHandle {
     update(data: ByteSource, inputEncoding?: string): Buffer;
     final(): Buffer;
@@ -751,6 +766,33 @@ declare namespace InternalCryptoBinding {
     toLegacy(): object;
   }
 
+  interface NativeX509CertificateConstructor {
+    readonly prototype: X509CertificateHandle;
+    new(value: X509CertificateHandle | ArrayBufferView): X509CertificateHandle;
+  }
+
+  interface X509CertificateConstructor {
+    readonly prototype: object;
+    new(buffer: string | ArrayBufferView): object;
+  }
+
+  interface InternalX509CertificateConstructor {
+    readonly prototype: object;
+    new(value: X509CertificateHandle | ArrayBufferView): object;
+  }
+
+  type CreateX509CertificateClassCallback =
+    (NativeX509Certificate: NativeX509CertificateConstructor) => [
+      X509Certificate: X509CertificateConstructor,
+      InternalX509Certificate: InternalX509CertificateConstructor,
+    ];
+
+  type PKCS12ParseResult = [
+    privateKey: KeyObjectHandle | null,
+    certificate: X509CertificateHandle | null,
+    additionalCertificates: X509CertificateHandle[],
+  ];
+
   interface CipherInfo {
     name: string;
     nid: number;
@@ -767,6 +809,7 @@ declare namespace InternalCryptoBinding {
       padding: number,
       oaepHash: string | undefined,
       oaepLabel: OptionalByteSource,
+      mgf1Hash: string | undefined,
     ]
   ) => Buffer;
 }
@@ -788,7 +831,8 @@ export interface CryptoBinding {
   KEMEncapsulateJob?: InternalCryptoBinding.KEMEncapsulateJobConstructor;
   KangarooTwelveJob: InternalCryptoBinding.KangarooTwelveJobConstructor;
   KmacJob: InternalCryptoBinding.KmacJobConstructor;
-  NidKeyPairGenJob: InternalCryptoBinding.NidKeyPairGenJobConstructor;
+  getPqcKeyTypes(): string[];
+  NamedKeyPairGenJob: InternalCryptoBinding.NamedKeyPairGenJobConstructor;
   PBKDF2Job: InternalCryptoBinding.PBKDF2JobConstructor;
   RandomBytesJob: InternalCryptoBinding.RandomBytesJobConstructor;
   RandomPrimeJob: InternalCryptoBinding.RandomPrimeJobConstructor;
@@ -805,6 +849,8 @@ export interface CryptoBinding {
     credential: InternalCryptoBinding.PreparedSecretKeyData,
     iv: InternalCryptoBinding.ByteSource | null,
     authTagLength?: number,
+    ctsMode?: 'CS1' | 'CS2' | 'CS3',
+    xtsStandard?: 'GB' | 'IEEE',
   ) => InternalCryptoBinding.CipherBaseHandle;
   DiffieHellman: new (
     sizeOrKey: number | InternalCryptoBinding.ByteSource,
@@ -817,35 +863,27 @@ export interface CryptoBinding {
     xofLen?: number,
     algorithmId?: number,
     algorithmCache?: Record<string, number>,
+    functionName?: InternalCryptoBinding.OptionalBufferSource,
+    customization?: InternalCryptoBinding.OptionalBufferSource,
   ) => InternalCryptoBinding.HashHandle;
   Hmac: new () => InternalCryptoBinding.HmacHandle;
+  Mac: new (
+    algorithm: string,
+    algorithmId: number,
+    algorithmCache: Record<string, number>,
+    key: InternalCryptoBinding.PreparedSecretKeyData,
+    digest?: string,
+    cipher?: string,
+    iv?: InternalCryptoBinding.OptionalBufferSource,
+    customization?: InternalCryptoBinding.OptionalBufferSource,
+    salt?: InternalCryptoBinding.OptionalBufferSource,
+    outputLength?: number,
+  ) => InternalCryptoBinding.MacHandle;
   KeyObjectHandle: new () => InternalCryptoBinding.KeyObjectHandle;
   SecureContext: new () => InternalCryptoBinding.SecureContextHandle;
   Sign: new () => InternalCryptoBinding.SignHandle;
   Verify: new () => InternalCryptoBinding.VerifyHandle;
 
-  EVP_PKEY_ED25519: number;
-  EVP_PKEY_ED448: number;
-  EVP_PKEY_ML_DSA_44: number;
-  EVP_PKEY_ML_DSA_65: number;
-  EVP_PKEY_ML_DSA_87: number;
-  EVP_PKEY_ML_KEM_512: number;
-  EVP_PKEY_ML_KEM_768: number;
-  EVP_PKEY_ML_KEM_1024: number;
-  EVP_PKEY_SLH_DSA_SHA2_128F: number;
-  EVP_PKEY_SLH_DSA_SHA2_128S: number;
-  EVP_PKEY_SLH_DSA_SHA2_192F: number;
-  EVP_PKEY_SLH_DSA_SHA2_192S: number;
-  EVP_PKEY_SLH_DSA_SHA2_256F: number;
-  EVP_PKEY_SLH_DSA_SHA2_256S: number;
-  EVP_PKEY_SLH_DSA_SHAKE_128F: number;
-  EVP_PKEY_SLH_DSA_SHAKE_128S: number;
-  EVP_PKEY_SLH_DSA_SHAKE_192F: number;
-  EVP_PKEY_SLH_DSA_SHAKE_192S: number;
-  EVP_PKEY_SLH_DSA_SHAKE_256F: number;
-  EVP_PKEY_SLH_DSA_SHAKE_256S: number;
-  EVP_PKEY_X25519: number;
-  EVP_PKEY_X448: number;
   OPENSSL_EC_EXPLICIT_CURVE: number;
   OPENSSL_EC_NAMED_CURVE: number;
   RSA_PKCS1_PSS_PADDING: number;
@@ -925,8 +963,15 @@ export interface CryptoBinding {
     PublicKeyObject: InternalCryptoBinding.KeyObjectSubtypeConstructor,
     PrivateKeyObject: InternalCryptoBinding.KeyObjectSubtypeConstructor,
   ];
+  createX509CertificateClass(
+    callback: InternalCryptoBinding.CreateX509CertificateClassCallback,
+  ): [
+    X509Certificate: InternalCryptoBinding.X509CertificateConstructor,
+    InternalX509Certificate: InternalCryptoBinding.InternalX509CertificateConstructor,
+  ];
   getBundledRootCertificates(): string[];
   getCachedAliases(): Record<string, number>;
+  getCachedMacAliases(): Record<string, number>;
   getCertificateCompressionAlgorithms(): string[];
   getCipherInfo(
     nameOrNid: string | number,
@@ -938,7 +983,12 @@ export interface CryptoBinding {
   getCurves(): string[];
   getExtraCACertificates(): string[];
   getFipsCrypto(): 0 | 1;
+  getFipsCryptoGeneration(): bigint;
   getHashes(): string[];
+  getMacs(): string[];
+  isCryptoKey(key: unknown): boolean;
+  isKeyObject(key: unknown): boolean;
+  isX509Certificate(value: unknown): boolean;
   getKeyObjectSlots(key: object): InternalCryptoBinding.KeyObjectSlots;
   getOpenSSLSecLevelCrypto(): number | undefined;
   getSSLCiphers(): string[];
@@ -952,7 +1002,13 @@ export interface CryptoBinding {
     outputEncoding: string,
     outputEncodingId?: number,
     outputLength?: number,
+    functionName?: InternalCryptoBinding.OptionalBufferSource,
+    customization?: InternalCryptoBinding.OptionalBufferSource,
   ): string | InternalCryptoBinding.Buffer;
+  parsePKCS12(
+    bundle: InternalCryptoBinding.ByteSource,
+    passphrase?: InternalCryptoBinding.ByteSource,
+  ): InternalCryptoBinding.PKCS12ParseResult;
   parseX509(data: InternalCryptoBinding.ByteSource): InternalCryptoBinding.X509CertificateHandle;
   privateDecrypt: InternalCryptoBinding.PublicKeyCipher;
   privateEncrypt: InternalCryptoBinding.PublicKeyCipher;
@@ -962,6 +1018,7 @@ export interface CryptoBinding {
   secureBuffer(length: number): Uint8Array | undefined;
   secureHeapUsed(): bigint | undefined;
   setEngine?(engine: string, flags: number): void;
+  setupFipsIndicatorChannel(): void;
   setFipsCrypto(fips: boolean | number): void;
   startLoadingCertificatesOffThread(): void;
   testFipsCrypto(): 0 | 1;
diff --git a/typings/internalBinding/diagnostics_channel.d.ts b/typings/internalBinding/diagnostics_channel.d.ts
index e6297d45ace0..90069e52712f 100644
--- a/typings/internalBinding/diagnostics_channel.d.ts
+++ b/typings/internalBinding/diagnostics_channel.d.ts
@@ -1,5 +1,7 @@
 export interface DiagnosticsChannelBinding {
   subscribers: Uint32Array;
+  notifyChannelActive(index: number): void;
+  notifyChannelInactive(index: number): void;
   linkNativeChannel(
     callback: (name: string, index: number) => object | undefined,
   ): void;
diff --git a/typings/internalBinding/encoding_binding.d.ts b/typings/internalBinding/encoding_binding.d.ts
index 0774a21f25e2..70d6d51172e7 100644
--- a/typings/internalBinding/encoding_binding.d.ts
+++ b/typings/internalBinding/encoding_binding.d.ts
@@ -1,5 +1,6 @@
 export interface EncodingBinding {
   encodeInto(source: string, dest: Uint8Array): void;
+  encodeIntoResults: Uint32Array;
   encodeUtf8String(str: string): Uint8Array;
   decodeUTF8(buffer: ArrayBufferView | ArrayBuffer | SharedArrayBuffer, ignoreBOM?: boolean, hasFatal?: boolean): string;
   toASCII(input: string): string;
diff --git a/typings/internalBinding/ffi.d.ts b/typings/internalBinding/ffi.d.ts
new file mode 100644
index 000000000000..0294d1987b03
--- /dev/null
+++ b/typings/internalBinding/ffi.d.ts
@@ -0,0 +1,101 @@
+declare namespace InternalFFIBinding {
+  type Buffer = Uint8Array;
+  type BufferSource = Buffer | ArrayBuffer | ArrayBufferView | SharedArrayBuffer;
+  type VoidType = 'void';
+  type NumberType =
+    | 'char'
+    | 'int8' | 'i8'
+    | 'uint8' | 'u8' | 'bool'
+    | 'int16' | 'i16'
+    | 'uint16' | 'u16'
+    | 'int32' | 'i32'
+    | 'uint32' | 'u32'
+    | 'float32' | 'f32' | 'float'
+    | 'float64' | 'f64' | 'double';
+  type BigIntType = 'int64' | 'i64' | 'uint64' | 'u64';
+  type PointerType =
+    | 'pointer' | 'ptr'
+    | 'string' | 'str'
+    | 'buffer' | 'arraybuffer'
+    | 'function';
+  type ValueType = NumberType | BigIntType | PointerType;
+  type ReturnType = VoidType | ValueType;
+  type FFICallback = (...args: any[]) => unknown;
+
+  interface FFIFunction {
+    (...args: unknown[]): unknown;
+    pointer: bigint;
+  }
+  interface FunctionSignature {
+    arguments?: readonly ValueType[];
+    return?: ReturnType;
+  }
+
+  class DynamicLibrary {
+    constructor(path: string | null);
+
+    readonly path: string;
+    readonly symbols: Record<string, bigint>;
+    readonly functions: Record<string, FFIFunction>;
+
+    close(): void;
+    getFunction(name: string, signature: FunctionSignature): FFIFunction;
+    getFunctions(): Record<string, FFIFunction>;
+    getFunctions(
+      definitions: Record<string, FunctionSignature>,
+    ): Record<string, FFIFunction>;
+    getSymbol(name: string): bigint;
+    getSymbols(): Record<string, bigint>;
+    registerCallback(callback: FFICallback): bigint;
+    registerCallback(
+      signature: FunctionSignature,
+      callback: FFICallback
+    ): bigint;
+    unregisterCallback(pointer: bigint): void;
+    refCallback(pointer: bigint): void;
+    unrefCallback(pointer: bigint): void;
+    [Symbol.dispose](): void;
+  }
+}
+export interface FFIBinding {
+  DynamicLibrary: typeof InternalFFIBinding.DynamicLibrary;
+  toString(pointer: bigint): string | null;
+  toBuffer(pointer: bigint, length: number, copy?: boolean): InternalFFIBinding.Buffer;
+  toArrayBuffer(pointer: bigint, length: number, copy?: boolean): ArrayBuffer;
+
+  exportBytes(source: InternalFFIBinding.BufferSource, pointer: bigint, length: number): void;
+  getRawPointer(source: InternalFFIBinding.BufferSource): bigint;
+  getCurrentEventLoop(): bigint;
+
+  getInt8(pointer: bigint, offset?: number): number;
+  getUint8(pointer: bigint, offset?: number): number;
+  getInt16(pointer: bigint, offset?: number): number;
+  getUint16(pointer: bigint, offset?: number): number;
+  getInt32(pointer: bigint, offset?: number): number;
+  getUint32(pointer: bigint, offset?: number): number;
+  getInt64(pointer: bigint, offset?: number): bigint;
+  getUint64(pointer: bigint, offset?: number): bigint;
+  getFloat32(pointer: bigint, offset?: number): number;
+  getFloat64(pointer: bigint, offset?: number): number;
+
+  setInt8(pointer: bigint, offset: number, value: number): void;
+  setUint8(pointer: bigint, offset: number, value: number): void;
+  setInt16(pointer: bigint, offset: number, value: number): void;
+  setUint16(pointer: bigint, offset: number, value: number): void;
+  setInt32(pointer: bigint, offset: number, value: number): void;
+  setUint32(pointer: bigint, offset: number, value: number): void;
+  setInt64(pointer: bigint, offset: number, value: number | bigint): void;
+  setUint64(pointer: bigint, offset: number, value: number | bigint): void;
+  setFloat32(pointer: bigint, offset: number, value: number): void;
+  setFloat64(pointer: bigint, offset: number, value: number): void;
+
+  charIsSigned: boolean;
+  uintptrMax: bigint;
+
+  kSbSharedBuffer: symbol;
+  kSbInvokeSlow: symbol;
+  kSbArguments: symbol;
+  kSbReturn: symbol;
+  kFastArguments: symbol;
+  kFastBufferInvoke: symbol;
+}
diff --git a/typings/internalBinding/fs_event_wrap.d.ts b/typings/internalBinding/fs_event_wrap.d.ts
new file mode 100644
index 000000000000..b1b815e8a35e
--- /dev/null
+++ b/typings/internalBinding/fs_event_wrap.d.ts
@@ -0,0 +1,28 @@
+import { owner_symbol } from './symbols';
+
+declare namespace InternalFsEventWrapBinding {
+  class FSEvent {
+    constructor();
+    [owner_symbol]?: object;
+    readonly initialized: boolean;
+    onchange?: (
+      status: number,
+      eventType: string,
+      filename: string | Uint8Array | null,
+    ) => void;
+    start(
+      filename: string | Uint8Array,
+      persistent: boolean,
+      recursive: boolean,
+      encoding: string,
+    ): number;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+  }
+}
+
+export interface FsEventWrapBinding {
+  FSEvent: typeof InternalFsEventWrapBinding.FSEvent;
+}
diff --git a/typings/internalBinding/performance.d.ts b/typings/internalBinding/performance.d.ts
new file mode 100644
index 000000000000..cf3ef0a664f0
--- /dev/null
+++ b/typings/internalBinding/performance.d.ts
@@ -0,0 +1,151 @@
+declare namespace InternalPerformanceBinding {
+  interface HistogramBase {
+    count(): number;
+    countBigInt(): bigint;
+    min(): number;
+    minBigInt(): bigint;
+    max(): number;
+    maxBigInt(): bigint;
+    mean(): number;
+    exceeds(): number;
+    exceedsBigInt(): bigint;
+    stddev(): number;
+    percentile(percentile: number): number;
+    percentileBigInt(percentile: number): bigint;
+    percentiles(percentiles: Map<number, number>): void;
+    percentilesBigInt(percentiles: Map<number, bigint>): void;
+    reset(): void;
+    skewness(): number;
+    kurtosis(): number;
+    cdf(value: number): number;
+    countAt(value: number): number;
+    ksTest(other: HistogramBase): number;
+    percentilesAt(
+      percentiles: Map<number, number>,
+      values: Float64Array,
+    ): void;
+    linearBuckets(stepSize: number, buckets: Map<number, number>): void;
+    logBuckets(
+      firstBucket: number,
+      base: number,
+      buckets: Map<number, number>,
+    ): void;
+    welchTest(
+      other: HistogramBase,
+      confidence: number,
+    ): [number, number, number, number, number];
+    mannWhitneyTest(other: HistogramBase): [number, number, number];
+    cohensD(other: HistogramBase): number;
+    cliffsD(other: HistogramBase): number;
+    percentileCI(percentile: number, confidence: number): [number, number, number];
+    ewmaMean(): number;
+    ewmaStddev(): number;
+    ewmaErrorRate(): number;
+  }
+
+  interface ELDHistogram extends HistogramBase {
+    start(reset?: boolean): void;
+    stop(): void;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+    getAsyncId(): number;
+    asyncReset(resource: object, executionAsyncId?: number): void;
+    getAsyncContextFrameForDebuggingOnly(): unknown;
+    getProviderType(): number;
+  }
+
+  interface Histogram extends HistogramBase {}
+
+  class Histogram {
+    constructor(
+      lowest: number | bigint,
+      highest: number | bigint,
+      figures: number,
+      halfLife?: number,
+      threshold?: number,
+    );
+    record(value: number | bigint): void;
+    recordDelta(): void;
+    recordCorrected(
+      value: number | bigint,
+      expectedInterval: number | bigint,
+    ): void;
+    add(other: Histogram): number;
+    subtract(other: Histogram): number;
+  }
+
+  class SlidingWindowHistogram {
+    constructor(
+      lowest: number | bigint,
+      highest: number | bigint,
+      figures: number,
+      chunks: number,
+      timeBased: boolean,
+      rotateAt: bigint,
+    );
+    record(value: number | bigint): void;
+    snapshot(): Histogram;
+    reset(): void;
+  }
+
+  interface Constants {
+    NODE_PERFORMANCE_GC_MAJOR: number;
+    NODE_PERFORMANCE_GC_MINOR: number;
+    NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP: number;
+    NODE_PERFORMANCE_GC_INCREMENTAL: number;
+    NODE_PERFORMANCE_GC_WEAKCB: number;
+    NODE_PERFORMANCE_GC_FLAGS_NO: number;
+    NODE_PERFORMANCE_GC_FLAGS_CONSTRUCT_RETAINED: number;
+    NODE_PERFORMANCE_GC_FLAGS_FORCED: number;
+    NODE_PERFORMANCE_GC_FLAGS_SYNCHRONOUS_PHANTOM_PROCESSING: number;
+    NODE_PERFORMANCE_GC_FLAGS_ALL_AVAILABLE_GARBAGE: number;
+    NODE_PERFORMANCE_GC_FLAGS_ALL_EXTERNAL_MEMORY: number;
+    NODE_PERFORMANCE_GC_FLAGS_SCHEDULE_IDLE: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_GC: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_HTTP: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_HTTP2: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_NET: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_DNS: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_QUIC: number;
+    NODE_PERFORMANCE_MILESTONE_TIME_ORIGIN_TIMESTAMP: number;
+    NODE_PERFORMANCE_MILESTONE_TIME_ORIGIN: number;
+    NODE_PERFORMANCE_MILESTONE_ENVIRONMENT: number;
+    NODE_PERFORMANCE_MILESTONE_NODE_START: number;
+    NODE_PERFORMANCE_MILESTONE_V8_START: number;
+    NODE_PERFORMANCE_MILESTONE_LOOP_START: number;
+    NODE_PERFORMANCE_MILESTONE_LOOP_EXIT: number;
+    NODE_PERFORMANCE_MILESTONE_BOOTSTRAP_COMPLETE: number;
+  }
+}
+
+type PerformanceObserverCallback =
+  | ((name: string,
+      type: string,
+      startTime: number,
+      duration: number,
+      details: unknown) => void)
+  | ((entry: unknown) => void);
+
+export interface PerformanceBinding {
+  Histogram: typeof InternalPerformanceBinding.Histogram;
+  SlidingWindowHistogram:
+    typeof InternalPerformanceBinding.SlidingWindowHistogram;
+  constants: InternalPerformanceBinding.Constants;
+  observerCounts: Uint32Array;
+  milestones: Float64Array;
+  setupObservers(callback: PerformanceObserverCallback): void;
+  installGarbageCollectionTracking(): void;
+  removeGarbageCollectionTracking(): void;
+  notify(type: string, entry: unknown): void;
+  loopIdleTime(): number;
+  createELDHistogram(
+    interval: number,
+    samplePerIteration: boolean,
+  ): InternalPerformanceBinding.ELDHistogram;
+  markBootstrapComplete(): void;
+  uvMetricsInfo(): void;
+  uvMetricsBuffer: Int32Array;
+  now(): number;
+}
diff --git a/typings/internalBinding/permission.d.ts b/typings/internalBinding/permission.d.ts
new file mode 100644
index 000000000000..5fe422d1820b
--- /dev/null
+++ b/typings/internalBinding/permission.d.ts
@@ -0,0 +1,6 @@
+type Buffer = Uint8Array;
+
+export interface PermissionBinding {
+  has(scope: string, reference?: string | Buffer | null): boolean;
+  drop(scope: string, reference?: string | Buffer | null): void;
+}
diff --git a/typings/internalBinding/profiler.d.ts b/typings/internalBinding/profiler.d.ts
new file mode 100644
index 000000000000..67e5dca87696
--- /dev/null
+++ b/typings/internalBinding/profiler.d.ts
@@ -0,0 +1,8 @@
+export interface ProfilerBinding {
+  setCoverageDirectory(directory: string): void;
+  setSourceMapCacheGetter(getter: () => object | undefined): void;
+  startCoverage(): void;
+  takeCoverage(): void;
+  stopCoverage(): void;
+  endCoverage(): void;
+}
diff --git a/typings/internalBinding/sea.d.ts b/typings/internalBinding/sea.d.ts
index 15f4430d87d1..258e7f112ed0 100644
--- a/typings/internalBinding/sea.d.ts
+++ b/typings/internalBinding/sea.d.ts
@@ -1,5 +1,8 @@
 export interface SeaBinding {
   getAsset(key: string): ArrayBuffer | undefined;
+  getAssetKeys(): string[];
   isExperimentalSeaWarningNeeded(): boolean;
   isSea(): boolean;
+  isVfsEnabled(): boolean;
+  mainCodePath?: string;
 }
diff --git a/typings/internalBinding/stream_pipe.d.ts b/typings/internalBinding/stream_pipe.d.ts
new file mode 100644
index 000000000000..17568409af54
--- /dev/null
+++ b/typings/internalBinding/stream_pipe.d.ts
@@ -0,0 +1,17 @@
+declare namespace InternalStreamPipeBinding {
+  class StreamPipe {
+    constructor(source: object, sink: object);
+    readonly source: object | null;
+    readonly sink: object | null;
+    onunpipe?: () => void;
+    oncomplete?: () => void;
+    unpipe(): void;
+    start(): void;
+    isClosed(): boolean;
+    pendingWrites(): number;
+  }
+}
+
+export interface StreamPipeBinding {
+  StreamPipe: typeof InternalStreamPipeBinding.StreamPipe;
+}
diff --git a/typings/internalBinding/task_queue.d.ts b/typings/internalBinding/task_queue.d.ts
new file mode 100644
index 000000000000..5690317f3bfd
--- /dev/null
+++ b/typings/internalBinding/task_queue.d.ts
@@ -0,0 +1,13 @@
+export interface TaskQueueBinding {
+  enqueueMicrotask(callback: () => void): void;
+  setTickCallback(callback: () => void): void;
+  runMicrotasks(): void;
+  tickInfo: Uint8Array;
+  promiseRejectEvents: {
+    kPromiseRejectWithNoHandler: 0;
+    kPromiseHandlerAddedAfterReject: 1;
+  };
+  setPromiseRejectCallback(
+    callback: (type: 0 | 1, promise: Promise<unknown>, value: unknown) => void,
+  ): void;
+}
\ No newline at end of file
diff --git a/typings/internalBinding/timers.d.ts b/typings/internalBinding/timers.d.ts
index e03deeeca240..ccdee1db5044 100644
--- a/typings/internalBinding/timers.d.ts
+++ b/typings/internalBinding/timers.d.ts
@@ -5,4 +5,5 @@ export interface TimersBinding {
   toggleTimerRef(value: boolean): void;
   toggleImmediateRef(value: boolean): void;
   immediateInfo: Uint32Array;
+  timeoutInfo: Int32Array;
 }
diff --git a/typings/internalBinding/util.d.ts b/typings/internalBinding/util.d.ts
index a3026b5a0305..4c3eeca8ed82 100644
--- a/typings/internalBinding/util.d.ts
+++ b/typings/internalBinding/util.d.ts
@@ -47,6 +47,7 @@ export interface UtilBinding {
   styleText(format: Array<string> | string, text: string): string;
   isInsideNodeModules(frameLimit?: number): boolean;
   constructSharedArrayBuffer(length?: number): SharedArrayBuffer;
+  getSharedArrayBufferGrowable(this: SharedArrayBuffer): boolean;
 
   constants: {
     kPending: 0;
diff --git a/typings/internalBinding/zlib.d.ts b/typings/internalBinding/zlib.d.ts
index 3f937df22503..84c437350433 100644
--- a/typings/internalBinding/zlib.d.ts
+++ b/typings/internalBinding/zlib.d.ts
@@ -15,7 +15,7 @@ declare namespace InternalZlibBinding {
     writeSync(flushFlag: number, input: TypedArray, inputOff: number, inputLen: number, out: TypedArray, outOff: number, outLen: number): void;
   }
 
-  class Zlib extends ZlibBase{
+  class Zlib extends ZlibBase {
     constructor(mode: number)
     init(windowBits: number, level: number, memLevel: number, strategy: number, writeState: Uint32Array, callback: VoidFunction, dictionary: Uint32Array): number;
   }
@@ -29,10 +29,24 @@ declare namespace InternalZlibBinding {
     constructor(mode: number);
     init(initParamsArray: Uint32Array, writeState: Uint32Array, callback: VoidFunction): boolean;
   }
+
+  class ZstdCompress extends ZlibBase {
+    constructor();
+    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView, rejectGarbageAfterEnd?: boolean): void;
+  }
+
+  class ZstdDecompress extends ZlibBase {
+    constructor();
+    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView, rejectGarbageAfterEnd?: boolean): void;
+  }
 }
 
 export interface ZlibBinding {
   BrotliDecoder: typeof InternalZlibBinding.BrotliDecoder;
   BrotliEncoder: typeof InternalZlibBinding.BrotliEncoder;
+  ZLIB_VERSION: string;
   Zlib: typeof InternalZlibBinding.Zlib;
+  ZstdCompress: typeof InternalZlibBinding.ZstdCompress;
+  ZstdDecompress: typeof InternalZlibBinding.ZstdDecompress;
+  crc32(data: string | ArrayBufferView, value: number): number;
 }
diff --git a/unofficial.gni b/unofficial.gni
index aa78f9ce60c0..aa35cd4664e9 100644
--- a/unofficial.gni
+++ b/unofficial.gni
@@ -94,7 +94,7 @@ template("node_gn_build") {
       "-Wno-unused-function",
     ]
 
-    if (current_cpu == "x86") {
+    if (target_cpu == "x86") {
       node_arch = "ia32"
     } else {
       node_arch = target_cpu